Repository navigation
fix: Correct and bound the GO-2026-5932 osv-scanner suppression - #1393
Merged
Merged
Conversation
The suppression reason claimed golang.org/x/crypto is reached only through go-git's use of hkdf; the build graph also uses ssh, ssh/agent, ssh/knownhosts, blowfish, cast5, argon2, sha3 and more. List them with their importers, and say none is openpgp. Give the entry an ignoreUntil expiry so renewal is forced, strengthen the re-verification command to cover test imports and other GOOS build constraints, and record that the ID-only match cannot be scoped to a Go package, with govulncheck as the backstop. The govulncheck SARIF filter now honours ignoreUntil (matching osv-scanner's same-day expiry) and refuses config keys it does not implement, including an entry without id, so the two scanners cannot silently diverge. The toml header names the filter as a consumer and states that it covers ./go.mod only, since osv-scanner applies a config to its own directory. SECURITY-POSTURE.md no longer duplicates the per-entry rationale; it states the expiry rule and the ID-scoping limit and points at the toml. Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com>
Deploying genealogix with
|
| Latest commit: |
2d989a8
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://88843fe8.genealogix.pages.dev |
| Branch Preview URL: | https://fix-osv-scanner-suppression.genealogix.pages.dev |
Assisted-by: Claude <noreply@anthropic.com> Signed-off-by: Isaac Schepp <isaac.schepp@gmail.com>
noahbjohnson
approved these changes
Oct 14, 2026
isaacschepp
added a commit
that referenced
this pull request
Oct 27, 2026
Resolve the CHANGELOG.md and Makefile conflicts: - CHANGELOG.md: keep the changie-rendered file. The 12 [Unreleased] entries main gained since the last merge (#1382, #1384, #1386, #1393, #1395, #1396, #1407, #1413) become fragments Added-main-56 .. Fixed-main-67, with trailing/inline refs moved into custom.Issue as in the existing migrated fragments. Main's released sections were unchanged since the merge base. - Makefile: .PHONY carries both main's lint-workflows and this branch's changelog/changelog-check targets. - tools/fragmentcheck: import go.yaml.in/yaml/v3. #1407 dropped gopkg.in/yaml.v3 from go.mod, so the checker no longer built and `make changelog-check` failed with "go mod tidy needed". Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What and why
A review of
osv-scanner.tomlfound seven problems with theGO-2026-5932suppression and the tooling around it. The suppression itself still holds: nogolang.org/x/crypto/openpgppackage is in the build graph, including test imports on linux, darwin and windows.ssh,ssh/agent,ssh/knownhosts,bcrypt_pbkdf/blowfish(go-git SSH transport, skeema/knownhosts, xanzy/ssh-agent),cast5,argon2,sha3,hkdf(ProtonMail/go-crypto/openpgp), andcryptobyte,curve25519,chacha20,blake2band internals. The reason now lists these with their importers.ignoreUntil = 2027-04-14so renewal (and re-verification) is forced.SECURITY-POSTURE.mdnow record this limit, name govulncheck as the backstop, and say to re-read the advisory's package list before renewing.go list -deps -test ./...acrossGOOSlinux/darwin/windows.scripts/filter-govulncheck-sarif.py. The filter honoursignoreUntil, using osv-scanner's same-day expiry, and exits with an error on keys it doesn't implement (e.g.[[PackageOverrides]]) and on entries withoutid, instead of silently diverging or raising a KeyError.SECURITY-POSTURE.mdno longer repeats the entry's reasoning. It states the expiry rule and points at the toml../go.modalone. The header saysci-tools/go.modis scanned unsuppressed (it doesn't depend on x/crypto) and where a future suppression for it would go.Related issues
None. Follow-up to a code review of
osv-scanner.toml(introduced in #1262, extended to govulncheck in #1341).Review focus
Correctness of the dependency attribution in the
reason, and the filter's expiry/validation semantics.Testing
go list -deps -test ./...for linux/darwin/windows: nox/crypto/openpgp. Per-package importers checked withgo list -f.warningkept), an expired entry (nothing dropped), a datetimeignoreUntil, an entry with noid, a[[PackageOverrides]]block and a non-dateignoreUntil. The last three exit 1 with a clear message.make check-linkspasses.Breaking changes
None.
🤖 Generated with Claude Code