Repository navigation
🤖 ci: establish a jointly green security baseline #100
Description
Observed blocker
PR #92's focused MCP update removes four native govulncheck advisory sections without adding findings. Its test, build, vendor, lint and docs checks pass locally. The CI-equivalent vulnerability scan still fails on both baseline and candidate:
- Baseline:
b1d48e3a64b42a23cb0cfaee8c30f3f21b761424, 55 symbol-result advisory sections. - Candidate:
fc52a605d202286b59794449e34c9dc8738186d9, 51 sections. - Go 1.25.7, govulncheck 1.1.4; both native scan commands exit 3.
These are static-analysis findings, not a claim that every advisory is exploitable in a deployment. Frozen-database Trivy filesystem/image comparison is still pending. A successful make lint does not include the separate vulnerability-scanning step run by CI.
Decision
Accept a bounded, non-publishing compatibility experiment to identify the smallest supported toolchain/dependency set that passes the required security gates together. Advisory fix versions are lower bounds, not a tested solution or automatic upgrade targets.
A pure toolchain prerequisite would still fail on vulnerable dependencies. A dependency prerequisite excluding the MCP fixes would still fail on MCP findings. Do not create an unmergeable stack or waive inherited failures just to preserve artificial PR boundaries.
Experiment boundaries
- Verify current supported Go and Coder release channels from primary sources. Select exact versions deliberately; do not choose the numerically newest release by default.
- Use isolated source snapshots and scanner databases. Retain source/tool/database identities, commands, native exits, dependency inventories, and baseline/candidate differences. Reuse the ongoing Trivy baseline rather than duplicate it.
- Try at most three deliberate candidate dependency graphs. Private toolchain/dependency edits and strictly necessary compatibility fixes are allowed. No experimental pushes, new PRs, release/image publishing, CI suppressions, branch-rule changes, or unrelated cleanup.
- Run actual CI-equivalent security analysis plus test/build/vendor/lint/docs gates. A scanner loading failure, incomplete analysis, or reduced finding count is not a pass. Hands-on verification must include screenshots and video, accurately labeled.
- Keep publishing configuration under issue 🤖 ci: diagnose and restore verified main image publishing #98's owner. Share the proposed toolchain before any delivery integration; rerun its non-publishing main/release checks with an adopted toolchain.
- Return a tested set and delivery boundaries, or a specific blocker when the candidate budget is exhausted. Substantial API redesign requires a new scope decision.
Delivery decision after the experiment
Split only if each proposed PR can independently satisfy the existing gates. Otherwise, explicitly reopen #92's scope for the smallest tested, jointly green security remediation, with understandable commit boundaries and updated acceptance criteria. This issue does not yet authorize that expansion or experimental publication.
Keep existing dependency PRs open. No review-counter resets, replacement PRs, premature review requests, or automatic merges. Repository policy still reserves merging to the user. Maintainer owns the scope decision and post-merge verification.
Generated with xum • Model: coder:openai/gpt-6-astra • Thinking: xhigh
Activity
ThomasK33 commentedon Sep 18, 2026
Scope decision: adopt graph 2 for combined delivery in PR #92
The private experiment used two of its three allowed candidates. Graph 2 passed all requested local repository and native security gates on tree
e1a059e4988c6f00db898f6457abe04dd7a15871, based on PR #92 headfc52a605d202286b59794449e34c9dc8738186d9.PR #92 will be explicitly expanded to a cohesive security-baseline and CI-compatibility repair. It is not ready to merge. This is a deliberate scope change, not an unexplained dependency expansion.
Why one delivery unit
The merge queue forces the full Go, workflow and Terraform checks. A toolchain-only fix, dependency-only fix excluding MCP, scanner-only fix, or scripts-only helper fix would leave other required gates failing. Separate red prerequisite PRs would not be independently landable. Keep the work reviewable as distinct logical commits inside the existing PR; do not create a replacement PR or reset review counts.
Authorized scope
Size and evidence
The tested graph changes 374 modules relative to the scoped #92 candidate: 152 additions, 14 removals and 208 version changes. Its generated dependency patch changes 2,320 files, with 305,522 additions and 210,083 deletions; only
go.modandgo.sumchange outsidevendor/. This is substantial dependency churn, not a small ordinary source diff. Preserve the full inventory and explain consequential direct/transitive changes in the PR.Against the same frozen databases, native main→graph-2 results were govulncheck 55→0, Trivy filesystem 41→0, and Trivy image 60→0 gated findings. Six non-called govulncheck advisories remain outside its failing symbol-level gate. These results do not establish deployment exploitability or production readiness.
Remaining delivery gates and exclusions
8aa69887a61ccca0d21964eebc98d552c0a764bcwhere possible. Its four historical assessments count; review capacity and a valid fresh-check route must be reconciled before any head change.The scoped PR #92 workspace owns integration and CI/review readiness. The maintainer owns this scope decision; the user retains the repository's merge step. Issue #100 remains open until the security/CI baseline is verified after an authorized landing.
Generated with
xum• Model:coder:openai/gpt-6-astra• Thinking:xhigh🤖 fix: adopt the supported security dependency graph
ThomasK33 commentedon Sep 21, 2026
Backlog disposition: retain one dependency delivery path
The maintainer is retiring the redundant dependency proposals #91, #93, #94, #95, and #96 in favor of #92 at
97b940310f7e2dddcc11dc288254ad61bd3da1dd. Their changes are confined to module files and vendor data; #92 meets or exceeds each requested version.Superseded does not mean fixed. This issue stays open. #92 has not landed; its security review and independent final assessment remain outstanding. The maintainer owns reconsideration of the retired proposals if #92 is abandoned or its scope drops any of these updates.
Delivery order: finish #92's review and verify the security/CI baseline after landing; then refresh #99's CI and complete publishing recovery tracked in #98; then reassess the distinct installer work in #89. Issue #97 remains a separate accepted external-database-Secret enhancement awaiting implementation. No issue is being closed merely because a candidate PR exists.
Generated with
xum• Model:coder:bedrock-mantle-us-west-2/openai.gpt-6-astra• Thinking:xhighThomasK33 commentedon Sep 21, 2026
Baseline repair complete; advisory follow-up remains
The original delivery goal is complete: #92 landed the tested dependency/toolchain and CI repairs; #99 restored normal main publishing. Both passed full merge-queue CI. The final publisher run 35605551335 succeeded, and both platform image revisions were independently verified against
cd378781a116dac8c68f908bdc74d8425413677f(details in #98).This issue stays open only for the recorded advisory follow-up, not because CI or publishing is still broken. The accepted September 18 native scanner evidence recorded these six advisories without a called-symbol finding:
“Not called” describes the scanner evidence; it does not mean fixed or not exploitable. No gate was suppressed. Owner: the standing maintainer desk. Reassess on the next relevant dependency update, a change to the application's call paths, or a changed upstream advisory. Record current versions, available fixes and fresh reachability evidence before deciding each disposition. Close this follow-up only when every entry has an evidence-backed resolution or a separately tracked owner.
The superseded proposals #91/#93/#94/#95/#96 now have their dependency coverage landed through #92; they need no reopening. No new PR is being created for unrelated hygiene.
Generated with
xum• Model:coder:bedrock-mantle-us-west-2/openai.gpt-6-astra• Thinking:xhighThomasK33 commentedon Sep 21, 2026
Correction: proposed CEL version does not resolve the observed behavior
The upstream repository advisory lists v0.22.0–v0.29.2 as vulnerable and v0.30.0 as patched. Its metadata conflicts with the global/Dependabot advisory, which identifies v0.29.0 as fixed.
A private, identical scratch probe against current main (cel-go v0.26.0) and PR101 combined with main (v0.29.0) observed both versions registering a
json:"-"field and returning its sentinel value through escaped field access (x.followed by the backtick-quoted-identifier, with identifier escaping enabled). The public-field control also succeeded. This probe reports observations; its successful process exit does not mean the security property passed. The advisory's exact dynamic-indexing expression remains to be tested separately.No affected deployment path has been demonstrated in this project. This is a library-behavior reproduction, not a claim of project exploitation. A metadata-driven alert closure would not establish remediation.
Maintainer decision: do not deliver v0.29.0 as the advisory fix. Expand the existing #101 version scope narrowly to a private v0.30.0 validation candidate, with explicit red/green nondisclosure assertions, both access forms and public-field controls, Kubernetes CEL compatibility checks, full repository/security gates, and recorded runtime testing of the current-main combination. No application redesign, unrelated upgrades, or new PR. If v0.30.0 fails these gates, stop with that blocker.
Owner: maintainer desk. Formal assessments consumed on #101: zero. The public branch is unchanged; the corrected candidate has not been published. This also corrects the CEL follow-up assumptions recorded under #100.
Generated with
xum• Model:coder:bedrock-mantle-us-west-2/openai.gpt-6-astra• Thinking:xhighThomasK33 commentedon Sep 21, 2026
CEL follow-up disposition: resolved by #101
The CEL dependency correction landed as
cfdd89749111d542e3fc7632ea1b8fa1fae1b49b, using v0.30.0, the fixed release identified by the upstream repository advisory. v0.29.0 still disclosed the excluded field in the reproduced library probe despite conflicting global advisory metadata.The identical assertion-based probe failed on v0.26.0/v0.29.0 and passed on v0.30.0. Public-field controls passed. Final-SHA local/security checks, the actual merge-queue E2E, and normal main publishing passed. Alert #46 is fixed. The open Dependabot alert inventory is now empty, but that does not erase other recorded advisories or establish non-exploitability.
This issue remains open for the other five baseline advisory follow-ups:
These were recorded as non-called in the baseline scan, not proven unexploitable. No new reachability finding or resolution is claimed for them here. Owner: maintainer desk; reassess when the dependency, relevant usage, or advisory information changes. The CEL item GO-2026-6094 is resolved for the tested library disclosure routes; no JSON-conversion or nested-type coverage claim is made.
Generated with
xum• Model:coder:bedrock-mantle-us-west-2/openai.gpt-6-astra• Thinking:xhighThomasK33 commentedon Sep 23, 2026
Advisory refresh on
main(c58c8514)Five advisories from the original baseline remain open. None of the changes merged since the last scan adds use of the affected packages. The earlier "not called" result came from a scan of a specific build and does not mean these are fixed or unexploitable.
github.com/klauspost/compressv1.18.6golang.org/x/crypto/openpgpv0.55.0golang.org/x/crypto/sshv0.55.0golang.org/x/crypto/sshv0.55.0go.etcd.io/etcd/client/pkg/v3v3.6.5Fixed versions are from the Go vulnerability database. All three affected modules are indirect dependencies.
Next step: one narrow dependency update to
klauspost/compressv1.18.7,golang.org/x/cryptov0.56.0 andgo.etcd.io/etcd/client/pkg/v3v3.6.14. It will include only the transitive changes Go's module resolution requires, with vendoring refreshed and the full CI and merge-queue E2E. GO-2026-5932 stays open here until the dependency that pulls inopenpgpdrops it.Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:xhighThomasK33 commentedon Sep 23, 2026
Four advisories cleared by #118
#118 landed as
92ff1f1aaf366c484bac13ccd69e6ec546fbbb85. It raisedgithub.com/klauspost/compressto v1.18.7,golang.org/x/cryptoto v0.56.0 andgo.etcd.io/etcd/client/pkg/v3to v3.6.14, with no other module changes.s2)transport)ssh)ssh)openpgp)govulncheckbefore and after the change, with the same tool (v1.1.4) and database snapshot (2026-09-16), shows only GO-2026-5932 remaining, at module level. No new advisories appeared, and neither scan found calls to affected functions.ghcr.io/coder/coder-k8s:mainwas published from92ff1f1a. Its linux/amd64 and linux/arm64 images both carry that revision.GO-2026-5932: the
openpgppackage is not compiled into our builds. It does not appear invendor/modules.txt; the finding is module-level because otherx/cryptopackages are required. This corrects my earlier comment, which said a dependency pulls it in. With no fixed release, this issue stays open to track it. The next step is triggered by an upstream fix or withdrawal of the advisory.Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:xhigh• Cost:$1416.26ThomasK33 commentedon Sep 24, 2026
Closing: required security gates are green on
mainThis issue's goal was a tested dependency set that passes the required security gates together. On
main(116e2ecf), the merge-queue run passedgovulncheck(in the lint job), the Trivy filesystem scan and the Trivy image scan. There are no open Dependabot or code-scanning alerts.Baseline advisory follow-ups:
golang.org/x/crypto/openpgp): residual, not fixed. No fixed release exists for any version. Theopenpgppackage is not compiled into our builds, because it does not appear invendor/modules.txt.govulncheckreports it at module level only, because otherx/cryptopackages are required. This is not a claim that the advisory is fixed or can never matter.Residual ownership: the maintainer desk checks GO-2026-5932 on its regular monitoring runs. It will open a new issue if any of these happens:
golang.org/x/crypto/openpgpappears invendor/modules.txt, meaning a dependency started building it.Generated with
xum• Model:anthropic:claude-opus-5-5• Thinking:xhigh