fix(security): refresh nla-cli Trivy ignore list - #210
moizpgedge merged 2 commits into
Conversation
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
🚧 Files skipped from review as they are similar to previous changes (1)
WalkthroughThe Trivy ignore policy now covers vulnerabilities in coreutils, libattr, libgcc, ncurses, pcre2, and ChangesTrivy ignore policy refresh
Estimated code review effort: 2 (Simple) | ~10 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Up to standards ✅🟢 Issues
|
moizpgedge
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
🧹 Nitpick comments (2)
.trivy/nla-cli.trivyignore.yaml (2)
46-56: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winVerify the
openpgpexclusion independently ofgovulncheck.“0 reachable vulnerabilities” does not by itself prove that
golang.org/x/crypto/openpgpis absent;govulnchecknarrows known vulnerability reports based on analyzed reachability. Add a dependency/import or SBOM assertion that the CLI excludesopenpgp, and verify that the exact scanned PURL ispkg:golang/golang.org/x/crypto@v0.54.0. (pkg.go.dev)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.trivy/nla-cli.trivyignore.yaml around lines 46 - 56, The GO-2026-5932 ignore statement relies only on govulncheck reachability. Add an independent dependency/import or SBOM assertion proving the CLI excludes golang.org/x/crypto/openpgp, and verify that the scanned dependency is exactly pkg:golang/golang.org/x/crypto@v0.54.0; update the statement with those verified results.
3-56: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick winAdd expiration dates to the ignore entries.
These suppressions are permanent because
expired_atis omitted. Bound them to a review date so future base-image or dependency updates cannot remain silently ignored after fixes become available. Trivy’s YAML ignore format supportsexpired_at. (trivy.dev)🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In @.trivy/nla-cli.trivyignore.yaml around lines 3 - 56, Add an expired_at review date to every CVE and advisory entry in the ignore configuration, including the entries for CVE-2026-56391, CVE-2026-56392, CVE-2026-54371, CVE-2021-46195, CVE-2022-27943, CVE-2023-50495, CVE-2022-41409, and GO-2026-5932. Use Trivy’s supported date format and choose a bounded future review date consistently across the suppressions.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Nitpick comments:
In @.trivy/nla-cli.trivyignore.yaml:
- Around line 46-56: The GO-2026-5932 ignore statement relies only on
govulncheck reachability. Add an independent dependency/import or SBOM assertion
proving the CLI excludes golang.org/x/crypto/openpgp, and verify that the
scanned dependency is exactly pkg:golang/golang.org/x/crypto@v0.54.0; update the
statement with those verified results.
- Around line 3-56: Add an expired_at review date to every CVE and advisory
entry in the ignore configuration, including the entries for CVE-2026-56391,
CVE-2026-56392, CVE-2026-54371, CVE-2021-46195, CVE-2022-27943, CVE-2023-50495,
CVE-2022-41409, and GO-2026-5932. Use Trivy’s supported date format and choose a
bounded future review date consistently across the suppressions.
ℹ️ Review info
⚙️ Run configuration
Configuration used: Path: .coderabbit.yaml
Review profile: CHILL
Plan: Pro Plus
Run ID: e9a76bcd-df63-4b68-8afe-e1c3b2bcce4d
📒 Files selected for processing (1)
.trivy/nla-cli.trivyignore.yaml
moizpgedge
changed the title
tsivaprasad
left a comment
tsivaprasad
left a comment
There was a problem hiding this comment.
For consistency with #209 (which added purls: scoping and expired_at: expiry to every ignore entry), please add the same to the entries here as well.
| vulnerabilities: | ||
| # coreutils-single - Present in UBI9 micro base image. | ||
| - id: CVE-2025-5278 | ||
| - id: CVE-2026-56391 |
There was a problem hiding this comment.
For consistency with #209 (which added purls: scoping and expired_at: expiry to every ignore entry), please add the same to the entries here as well.
Rebuilt nla-cli from current source (go.mod already carries the patched pgx/x/crypto/x/net versions from earlier PLAT-701 work) and rescanned: all 27 High + 32 Medium + 10 Low findings in the reported scan resolve, leaving only 10 residual findings in the fresh scan. The existing ignore file was stale, referencing CVE IDs (coreutils CVE-2025-5278, glibc CVE-2026-4046/CVE-2026-4437) that don't appear in the current scan at all -- already resolved by the ubi9-micro base image's own freshness. Replaced with entries for the 10 findings actually present: coreutils-single, libattr, libgcc, ncurses, pcre2 (all no-fix-available, none reachable from this statically linked Go binary), and GO-2026-5932 (x/crypto/openpgp unmaintained-package advisory -- the CLI only imports x/crypto/bcrypt, confirmed via govulncheck: 0 reachable vulnerabilities). Verified: trivy image --ignorefile .trivy/nla-cli.trivyignore.yaml reports 0 findings at every severity.
Addresses review feedback on #210 (tsivaprasad): for consistency with #209, scope every entry to its exact package via purls and add an expired_at date, rather than matching a CVE ID globally across the scan. Rebuilt nla-cli fresh from current source, took a raw scan (10 findings across the 8 CVE/advisory IDs already in this file, 0 gaps, 0 orphans), and generated package-scoped purls (bare, unqualified, consistent with the other trivyignore files in this repo) plus expired_at: 2026-11-02T00:00:00Z for all 8 entries. Verified: trivy image --ignorefile .trivy/nla-cli.trivyignore.yaml reports 0 findings on both scan targets, and a structural check against ExperimentalModifiedFindings confirms all 10 raw findings are individually tracked with Status: ignored -- none slipping through on a broad ID match.
1e0d2be to
8ce6044
Compare
tsivaprasad
left a comment
tsivaprasad
left a comment
There was a problem hiding this comment.
Awesome...!
Looks good.
2 participants
What this fixes
A security scan of the published command-line tool image flagged 27
High, 32 Medium, and 10 Low warnings.
Rebuilding the tool from the current version, with no code changes,
already fixes every one of these — they were all caused by software
updates that had already happened but hadn't made it into a new build
of this image yet.
What was left
A fresh scan of the rebuilt image shows only 10 minor warnings left:
doesn't actually use (no fix is available for these from the vendor
yet, and none apply here).
library as something people shouldn't use going forward. It's not a
security bug with a fix — it's a "don't use this anymore" notice.
Checked the tool's code directly: it only uses a different, unrelated
part of that same library, never the flagged part.
Each of these is documented with a specific, checkable reason rather
than a generic one.
Results
Scanning the newly built image against the updated list of "checked,
doesn't apply" items shows zero warnings, at every severity level.
What this doesn't do
This doesn't publish a new version of the image — that's a separate
release step. The already-published image is unaffected until that
happens.
https://pgedge.atlassian.net/browse/PLAT-703
Summary by CodeRabbit