VEX the collector OpenPGP module finding (GO-2026-5932) - #33
Merged
Merged
Conversation
golang.org/x/crypto carries no fix for this advisory — it declares the deprecated openpgp tree unsafe by design, so the affected range is introduced-at-0 with no fix event. Both sts-opentelemetry-collector distributions link x/crypto for chacha20, cryptobyte, pkcs12 and friends but none of the seven openpgp packages the advisory names, which is the vulnerable_code_not_present case. Product purls follow the Lane 2 convention: one entry per distribution registry plus the bare pkg:oci form Grype generates. The subcomponent purl is deliberately left unversioned so a routine x/crypto bump does not silently drop the statement; go-vex treats the missing version as a wildcard, verified against Trivy on both image variants. Withdrawal is handled by scripts/check_no_openpgp.sh in the collector repo, which fails the build if an openpgp package ever enters either link graph, rather than by a version pin that only re-opens the finding after the fact. Refs: #32 Refs: StackVista/cve-reporter#56 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
LouisLotter
reviewed
Aug 28, 2026
LouisLotter
reviewed
Aug 28, 2026
Contributor
|
Grype consumption is confirmed against |
ai-collaboration-app Bot
pushed a commit
to StackVista/sts-opentelemetry-collector
that referenced
this pull request
Aug 28, 2026
The VEX statement clears GO-2026-5932 for the published multi-architecture image, but the guard only inspected linux-amd64. An arm64-only dependency or build-tag path could have linked an openpgp package while this check stayed green, and publication would then ship the affected arm64 image under a statement that no longer held. The link graph does differ by architecture: the server binary records 27 x/crypto packages on amd64 and 25 on arm64, the difference being assembly variants selected by GOARCH build tags. So per-architecture inspection is not a formality. The guard now walks every image-* artifact the build produced instead of a hardcoded arch list, so a newly published architecture is covered without editing this job, and it fails when no artifact was downloaded rather than passing on an empty set. The binary to inspect comes from each image's own entrypoint, which removes the variant-to-binary table. Setup Go went with it: the check is grep over the pclntab. Refs: StackVista/cve-reporter#56 Refs: StackVista/vexhub#33 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
The Rancher product entry pointed at registry.rancher.com/stackstate, which is not a published alias: image-pipeline stamps the collector's OCI ref.name as registry.rancher.com/suse-observability/sts-opentelemetry-collector, and every other statement in this hub uses that namespace. Verified by scanning the customer image name with the Rancher entry as the only product — the old namespace leaves GO-2026-5932 active, the corrected one clears it. The bare pkg:oci form masked the mistake, so the entry was wrong rather than harmful. The action statement claimed the collector CI check withdraws this document. It cannot: check_no_openpgp.sh blocks publication when the assumption breaks, which stops a release shipping under a false claim, but removing a published statement stays a reviewed change here. Consumers should not be told an automatic mechanism exists when it does not. Evidence now covers linux/arm64 as well. The link graph is not identical across architectures — the server binary records 27 x/crypto packages on amd64 and 25 on arm64, differing in GOARCH-selected assembly variants — so the claim needed per-architecture proof, and none of the four published binaries link openpgp. Refs: StackVista/cve-reporter#56 Refs: StackVista/sts-opentelemetry-collector#172 Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
This was referenced Aug 28, 2026
Merged
Collector PR #172 was closed, so the statement must not claim an ongoing publication gate. Retain the reviewed four-binary evidence and require re-evaluation when the component or dependency graph changes. Refs: #32
rb3ckers
approved these changes
Aug 31, 2026
This was referenced Sep 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds an image-scoped GO-2026-5932 statement for both collector distributions. The four published linux/amd64 and linux/arm64 binaries were inspected and none links an affected OpenPGP package; scanners report only the parent x/crypto module.
This is point-in-time evidence, not a permanent CI guard. The statement must be reconsidered if collector component selection or its x/crypto dependency graph changes.
Tracking: #32
Owning-repo ticket: https://github.com/StackVista/cve-reporter/issues/56
Validation:
python3 tools/build_index.py --check; Trivy product/subcomponent matching verified. Grype should be verified again through the published-image pipeline after merge.