trufflehog/3.88.16-r0: cve remediation

[octo-sts]

trufflehog/3.88.16-r0: fix CVE-2025-22868

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/trufflehog.advisories.yaml

Source code for this service: https://go/cve-remedy-automation-source

Logs for this execution: https://go/cve-remedy-automation-logs

Docs for this service: (not provided yet)

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

• Detected Error:
"FAIL Expected commit c1f2e912239240108482d79ea01ab25d90b27ac7 for v3.88.17, found 12164e38f0f1b673ab0594c7d94daf71b0be6823"

• Error Category: Version

• Failure Point:
git-checkout step in the pipeline, specifically the commit hash verification

• Root Cause Analysis:
The expected commit hash in the melange YAML (c1f2e912239240108482d79ea01ab25d90b27ac7) doesn't match the actual commit hash of the v3.88.17 tag (12164e38f0f1b673ab0594c7d94daf71b0be6823)

• Suggested Fix:
Update the expected-commit hash in the git-checkout step to:

  - uses: git-checkout
    with:
      repository: https://github.com/trufflesecurity/trufflehog
      tag: v${{package.version}}
      expected-commit: 12164e38f0f1b673ab0594c7d94daf71b0be6823

• Explanation:
The build system verifies the commit hash as a security measure to ensure the exact version of code being built. The current mismatch indicates the tag points to a different commit than expected. The fix updates the hash to match the actual commit that the v3.88.17 tag references.

• Additional Notes:

• This type of mismatch often occurs when:
  1. The tag was moved to a different commit
  2. The original commit hash was copied incorrectly
  3. The repository history was modified
• You can verify the correct commit hash using:
  git ls-remote https://github.com/trufflesecurity/trufflehog refs/tags/v3.88.17

• References:

• https://github.com/trufflesecurity/trufflehog/releases/tag/v3.88.17
• trufflesecurity/trufflehog@12164e3