From 435ba124236c2066d289e43ca7328cb8970cbc21 Mon Sep 17 00:00:00 2001 From: "JJediny (merge automation)" Date: Sat, 10 Oct 2026 22:12:53 -0400 Subject: [PATCH] fix(ci): float otel-collector-contrib matrix entry as #115 rebuild monitor MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit 2026-10-10 verification (re-scan gate, #82 rules): - pinned 0.161.0 digest (fd328de2) now shows 4 HIGH after new Go CVEs published against its frozen package versions: stdlib 78667/97031, stdlib+x-net 78669 (fixes: Go 1.26.9/1.27.2, x/net 0.60.0) -> issue #115 - registry :latest (8b9211db) scanned on the same DB: IDENTICAL 4 findings -> upstream rebuild not yet shipped; re-pin correctly NOT adopted (gate: equal-or-better only; this would be a lateral move with zero security gain) - grype:debug candidate (3518aea7) likewise rejected: same 4 findings, while the deployed 1d10432f pin stays clean (0 HIGH) -> keep pin With the matrix pinned, CI could never observe the upstream fix — the frozen digest reports the same 4 findings forever. Floating the otel matrix entry restores the re-pin trigger (clamav/#113 and goflow2/dcgm doctrine); compose keeps the deployed digest pin unchanged (the security boundary; #115 keeps the findings visible — no .trivyignore suppression on the core path, and these IDs collide with #83/#84 anyway). Docs corrected to reflect the wave honestly: otel row 0->4 HIGH with #115 link, grype footnote (monitor noise vs clean deployed pin), core-stack "100% clean" claim narrowed to openobserve/rsigma/falco, scan-date line notes the 2026-10-10 recheck. Verification: workflow YAML parses; image-security, release, and compliance test files green (no test pins the matrix entry). --- .github/workflows/container-image-scan.yml | 5 ++++- docs/container_security_scan.md | 8 ++++---- 2 files changed, 8 insertions(+), 5 deletions(-) diff --git a/.github/workflows/container-image-scan.yml b/.github/workflows/container-image-scan.yml index fdf8b59..ccca5b4 100644 --- a/.github/workflows/container-image-scan.yml +++ b/.github/workflows/container-image-scan.yml @@ -35,8 +35,11 @@ jobs: image: 'openobserve/openobserve@sha256:d4a878fac1f6c56003764f7f2a1625668917388f167e222c8c810de3f54c56ba' - name: dcgm-exporter image: 'nvcr.io/nvidia/k8s/dcgm-exporter:latest' + # Drift monitor for the pinned 0.161.0 deployment (issue #115): + # scanning the frozen digest cannot show when upstream rebuilds with + # fixed Go/x-net, so this entry floats while compose keeps the pin. - name: otel-collector-contrib - image: 'otel/opentelemetry-collector-contrib@sha256:fd328de2552466ad78385e1b1289c3f2402b1c45f265b252aab1955b42845ac1' + image: 'otel/opentelemetry-collector-contrib:latest' # Drift monitor, not the deployment ref: compose runs these images at # their pinned digests (guarded by tests/test_container_security_scan.py). # Scanning the floating tags here keeps the weekly CI able to detect an diff --git a/docs/container_security_scan.md b/docs/container_security_scan.md index 6d8ad21..019a1c4 100644 --- a/docs/container_security_scan.md +++ b/docs/container_security_scan.md @@ -1,6 +1,6 @@ # Container Image Vulnerability Scan -**Scan date:** 2026-09-28 (full stack) · **2026-10-03** (`localobserve-webhook` rebuild verification) +**Scan date:** 2026-09-28 (full stack) · **2026-10-03** (`localobserve-webhook` rebuild verification) · **2026-10-10** (recheck: new Go stdlib/x-net wave hit pinned/floating images — see #115) **Scanner:** [Trivy](https://github.com/aquasecurity/trivy) v0.74.0 (local install via Docker / mise) **Severity filter:** `HIGH`, `CRITICAL` (MEDIUM/LOW intentionally excluded to focus on actionable risk) **Methodology:** All images declared in `docker-compose.yaml` were pulled locally and scanned. The self-built `localobserve-webhook` image is included as of 2026-10-03: Trivy's `gobinary` scanner reads the Go module and stdlib info embedded in the compiled webhook binary, so local builds have real vulnerability findings too. Host filesystem / mounted volumes are out of scope (covered separately by the secret scanner evaluation, see issue #58). @@ -18,7 +18,7 @@ | 🔴 Falco CRITICAL regression | 0 / 10 | 0% | - **0 CRITICAL** findings total across all images in the entire stack. -- **66 HIGH** findings total across auxiliary profile-gated images (`dcgm-exporter`, `goflow2`, `osquery`). The core stack (`openobserve`, `otel-collector`, `rsigma`, `falco`) is **100% clean of HIGH and CRITICAL CVEs**; `clamav` acquired 1 HIGH (pcre2 CVE-2026-103111) via floating-tag drift in October 2026 and is now digest-pinned — see [#111](https://github.com/JJediny/LocalObserve/issues/111) and the update below. +- **66 HIGH** findings total across auxiliary profile-gated images (`dcgm-exporter`, `goflow2`, `osquery`). The core stack (`openobserve`, `rsigma`, `falco`) is **100% clean of HIGH and CRITICAL CVEs**; `clamav` acquired 1 HIGH (pcre2 CVE-2026-103111) via floating-tag drift in October 2026 and is now digest-pinned — see [#111](https://github.com/JJediny/LocalObserve/issues/111). **2026-10-10 recheck:** newly published Go CVEs (78667/78669/97031 — stdlib HTTP/2+TLS DoS, `x/net` http2) retroactively mark `otel-collector-contrib` (pinned, core path: 4 HIGH — [#115](https://github.com/JJediny/LocalObserve/issues/115)) plus `dcgm-exporter` and `goflow2:latest`/`grype:latest` monitors; the re-pin gate verified upstream `:latest` builds carry the identical findings, so **no re-pin was adopted** and CI matrix entries for these now float as upstream-rebuild monitors. - **Webhook rebuild verified (2026-10-03):** replacing the prebuilt `almir/webhook` runtime base with a from-source build (`go install github.com/adnanh/webhook@2bbdeb9f90b5` — the 2026-09-04 commit whose `version.go` reports 2.8.3 — on `golang:alpine`, **Go 1.27.1**, on a pinned Alpine 3.24 base) cut fixable findings from **2 CRITICAL / 37 HIGH → 0 / 0**. Upstream tags carry no `v` prefix and stop at 2.6.11, so semver pins like `@v2.8.3` are unresolvable; the build pins the commit instead and installs `git` in the builder for the direct VCS fetch. See [Webhook source rebuild](#-localobserve-webhook-0-high-0-critical--rebuilt-from-source-go-1271-2026-10-03). ## Per-Image Results @@ -32,11 +32,11 @@ | 5 | `clamav/clamav` (`:latest_base`) | **pinned `latest_base@sha256:4bd75…` (2026-10-04)** | 127 MB | 1 | 0 | ⚠️ Same pcre2 finding — #111. | | 6 | `localobserve-webhook` | **rebuilt from source** (`webhook@2bbdeb9f90b5` ≈ v2.8.3 on `golang:alpine` → pinned Alpine 3.24) | 81 MB | 0 | 0 | ✅ Clean. Was 2 CRIT / 37 HIGH on `almir/webhook:latest` before the rebuild (2026-10-03). | | 7 | `osquery/osquery` | **pinned `5.17.0-ubuntu22.04`** | 187.8 MB | 2 | 0 | ⚠️ 2 in-distro base CVEs (libssl3, gpgv). No CRITICAL; profile-gated to `agents`. | -| 8 | `otel/opentelemetry-collector-contrib` | **bumped to `@sha256:fd328...` (0.161.0)** | 359.8 MB | 0 | 0 | ✅ Clean. Zero HIGH / CRITICAL findings (RabbitMQ & stdlib CVEs resolved). | +| 8 | `otel/opentelemetry-collector-contrib` | **pinned `@sha256:fd328...` (0.161.0)** | 359.8 MB | 4 | 0 | ⚠️ 2026-10-10: Go stdlib/x-net wave published after pin (0→4 HIGH, [#115]). Upstream `:latest` verified carrying identical findings — re-pin gate rejected; CI floats `:latest` as rebuild monitor. | | 9 | `nvcr.io/nvidia/k8s/dcgm-exporter` | `latest` | 146.9 MB | 34 | 0 | 🟡 Upstream rebuild required (Go stdlib & grpc). Gated to `gpu` profile. | | 10 | `netsampler/goflow2` | `latest` | 25.5 MB | 30 | 0 | 🟡 Upstream rebuild required (Go stdlib & x/crypto). Gated to `netflow` profile. | -**`anchore/grype` (latest 0 HIGH, 0 CRIT — resolved by upstream 2026-10-04)** is pulled by `scripts/scan-images.sh`; the compose `scanner` service runs the digest-pinned `:debug` (verified 0 HIGH / 0 CRITICAL pre-pin), closing the floating-tag drift gap (#85 / #111 pattern). +**`anchore/grype` (latest 0 HIGH at 2026-10-04; 4 HIGH again 2026-10-10 — Go wave, upstream rebuild pending)** is pulled by `scripts/scan-images.sh`; the compose `scanner` service runs the digest-pinned `:debug` `1d10432f...` which remains **0 HIGH / 0 CRITICAL** — the newer `:debug` (`3518aea7...`) was scanned on 2026-10-10 and rejected by the re-pin gate (same 4 findings; adopting it would downgrade the deployment). Closing the floating-tag drift gap (#85 / #111 pattern). ## Findings Detail