Repository navigation
fix(ci): float otel matrix entry as #115 rebuild monitor; honest docs for 2026-10 wave - #116
Conversation
…nitor 2026-10-10 verification (re-scan gate, #82 rules): - pinned 0.161.0 digest (fd328de2) now shows 4 HIGH after new Go CVEs published against its frozen package versions: stdlib 78667/97031, stdlib+x-net 78669 (fixes: Go 1.26.9/1.27.2, x/net 0.60.0) -> issue #115 - registry :latest (8b9211db) scanned on the same DB: IDENTICAL 4 findings -> upstream rebuild not yet shipped; re-pin correctly NOT adopted (gate: equal-or-better only; this would be a lateral move with zero security gain) - grype:debug candidate (3518aea7) likewise rejected: same 4 findings, while the deployed 1d10432f pin stays clean (0 HIGH) -> keep pin With the matrix pinned, CI could never observe the upstream fix — the frozen digest reports the same 4 findings forever. Floating the otel matrix entry restores the re-pin trigger (clamav/#113 and goflow2/dcgm doctrine); compose keeps the deployed digest pin unchanged (the security boundary; #115 keeps the findings visible — no .trivyignore suppression on the core path, and these IDs collide with #83/#84 anyway). Docs corrected to reflect the wave honestly: otel row 0->4 HIGH with #115 link, grype footnote (monitor noise vs clean deployed pin), core-stack "100% clean" claim narrowed to openobserve/rsigma/falco, scan-date line notes the 2026-10-10 recheck. Verification: workflow YAML parses; image-security, release, and compliance test files green (no test pins the matrix entry).
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. grype (gobinary)Total: 4 (HIGH: 4, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌──────────────────────────────────────┬────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. clamav/clamav:latest (alpine 3.24.2)Total: 1 (HIGH: 1, CRITICAL: 0) ┌─────────┬─────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐ |
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬───────┬─────────────────┐
|
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
|
|
Report Summary ┌───────────────────────────────────────────┬────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. clamav/clamav:latest_base (alpine 3.24.2)Total: 1 (HIGH: 1, CRITICAL: 0) ┌─────────┬─────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐ |
|
Report Summary ┌────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. grype (gobinary)Total: 4 (HIGH: 4, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌───────────────────────────────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. goflow2 (gobinary)Total: 1 (HIGH: 1, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────┐ |
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
|
|
Report Summary ┌─────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. otelcol-contrib (gobinary)Total: 4 (HIGH: 4, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌───────────────────────────────────────────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. usr/bin/dcgm-exporter (gobinary)Total: 4 (HIGH: 4, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ usr/bin/shelless_ulimit (gobinary)Total: 3 (HIGH: 3, CRITICAL: 0) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ usr/bin/sleep (gobinary)Total: 3 (HIGH: 3, CRITICAL: 0) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌────────┬──────┬─────────────────┐
|
|
Report Summary ┌─────────────────────────────────────────────┬──────────┬─────────────────┐
|
Context
New Go CVEs (78667/78669/97031 — stdlib HTTP/2 & TLS DoS, x/net http2) were published after our pins were set. They retroactively mark: `otel` pinned digest (core path, 4 HIGH, tracked in #115), `dcgm`/`goflow2`/:latest monitors (grype :latest too). Nothing drifted; no images broke — this was DB movement against frozen builds, exactly the scenario the doc's re-scan notice predicted.
Re-scan gate results (verified 2026-10-10, same Trivy 0.74.0 + current DB)
What changes here
otel/opentelemetry-collector-contrib\pinned digest (4 HIGH, 0 CRITICAL — 2026 Go stdlib/x-net wave) #115 link, grype footnote rewritten (monitor noise vs clean deployed pin), "core stack 100% clean" narrowed to openobserve/rsigma/falco, scan-date line notes the recheck.otel/opentelemetry-collector-contrib\pinned digest (4 HIGH, 0 CRITICAL — 2026 Go stdlib/x-net wave) #115 keeps them visible; once the monitor flips to 0, re-pin and then per-image suppressions for Reduce HIGH findings on nvcr.io/nvidia/k8s/dcgm-exporter (34 HIGH, 0 CRITICAL) #83/Reduce HIGH findings on netsampler/goflow2 (30 HIGH, 0 CRITICAL) — active runtime #84 become safe.Validation
otel/opentelemetry-collector-contrib\pinned digest (4 HIGH, 0 CRITICAL — 2026 Go stdlib/x-net wave) #115 re-pin trigger