fix(release): scope PostgreSQL gosu scan noise (#537)

Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>

Author: jeremi

release/scripts/check_postgresql_advisory_policy.py

@@ -5,8 +5,9 @@
 The official PostgreSQL image is an external runtime, not a product image. It
 does not carry a Registry Stack Git revision label, so its Grype and Syft
 evidence is bound to the reviewed immutable image digest and ordered rootfs
-layers instead. The policy contains no accepted-risk mechanism: every fixable
-finding and every High or Critical finding blocks the candidate.
+layers instead. Every fixable finding and every High or Critical finding blocks
+the candidate, except version-only Go module matches in the exact reviewed
+``gosu`` helper whose binary reachability scan found no affected symbols.
 """
 
 from __future__ import annotations
@@ -32,7 +33,15 @@
     "critical": 4,
 }
 SHA256_DIGEST = re.compile(r"sha256:[0-9a-f]{64}")
-FIX_STATES = {"fixed", "not-fixed", "wont-fix"}
+FIX_STATES = {"", "fixed", "not-fixed", "wont-fix"}
+# govulncheck v1.6.0 -mode=binary reported zero reachable vulnerabilities
+# for this exact linux/amd64 image's gosu 1.19.0 binary on 2026-07-28.
+REVIEWED_GOSU_IMAGE = (
+    "docker.io/library/postgres@"
+    "sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777"
+)
+GOSU_GO_ARTIFACTS = {"stdlib", "golang.org/x/sys"}
+GOSU_PATH = "/usr/local/bin/gosu"
 
 
 def fail(message: str) -> None:
@@ -141,7 +150,27 @@ def syft_artifacts(report: Any) -> dict[str, dict[str, Any]]:
     return indexed
 
 
-def finding_blocks(item: Any, artifacts: dict[str, dict[str, Any]]) -> tuple[bool, str]:
+def reviewed_gosu_go_metadata(artifact: dict[str, Any], expected_image: str) -> bool:
+    """Identify only the digest-bound gosu records cleared by binary reachability."""
+    locations = artifact.get("locations")
+    return (
+        expected_image == REVIEWED_GOSU_IMAGE
+        and artifact.get("type") == "go-module"
+        and artifact.get("name") in GOSU_GO_ARTIFACTS
+        and isinstance(locations, list)
+        and bool(locations)
+        and all(
+            isinstance(location, dict) and location.get("path") == GOSU_PATH
+            for location in locations
+        )
+    )
+
+
+def finding_blocks(
+    item: Any,
+    artifacts: dict[str, dict[str, Any]],
+    expected_image: str,
+) -> tuple[bool, str]:
     if not isinstance(item, dict):
         fail("grype report matches must be objects")
     vulnerability = item.get("vulnerability")
@@ -179,6 +208,8 @@ def finding_blocks(item: Any, artifacts: dict[str, dict[str, Any]]) -> tuple[boo
         f"package={artifact.get('name', '<unknown>')} {artifact.get('version', '<unknown>')} "
         f"fixable={fixable}"
     )
+    if reviewed_gosu_go_metadata(artifact, expected_image):
+        return False, summary
     return blocking, summary
 
 
@@ -207,7 +238,7 @@ def main() -> None:
         fail("grype report must contain a matches list")
     blockers = []
     for item in matches:
-        blocking, summary = finding_blocks(item, artifacts)
+        blocking, summary = finding_blocks(item, artifacts, args.expected_image)
         if blocking:
             blockers.append(summary)
     print(f"PostgreSQL advisory policy: blocking={len(blockers)}")

release/scripts/test_registry_release.py

@@ -765,7 +765,7 @@ def test_release_image_scans_are_policy_enforced_and_preserved(self) -> None:
         self.assertIn("retention-days: 7", images_job[upload_step:])
 
     def test_postgresql_advisory_policy_fails_closed(self) -> None:
-        digest = "sha256:" + "b" * 64
+        digest = "sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777"
         layer = "sha256:" + "c" * 64
         image_ref = f"docker.io/library/postgres@{digest}"
         target = {
@@ -797,6 +797,7 @@ def run_checker(
                 fix: dict[str, object],
                 grype_artifact: dict[str, object] | None = None,
                 syft_artifact: dict[str, object] | None = None,
+                expected_image: str = image_ref,
             ) -> subprocess.CompletedProcess[str]:
                 grype_artifact = grype_artifact or artifact
                 syft_artifact = syft_artifact or artifact
@@ -840,7 +841,7 @@ def run_checker(
                         "--rootfs",
                         str(rootfs),
                         "--expected-image",
-                        image_ref,
+                        expected_image,
                     ],
                     cwd=ROOT,
                     capture_output=True,
@@ -874,6 +875,64 @@ def run_checker(
             )
             self.assertEqual(0, extra_metadata_result.returncode, extra_metadata_result.stderr)
 
+            empty_fix_state_result = run_checker(
+                "Low", {"versions": [], "state": ""}
+            )
+            self.assertEqual(
+                0,
+                empty_fix_state_result.returncode,
+                empty_fix_state_result.stderr,
+            )
+
+            gosu_artifact = {
+                "id": "gosu-stdlib",
+                "name": "stdlib",
+                "version": "go1.24.6",
+                "type": "go-module",
+                "locations": [{"path": "/usr/local/bin/gosu", "layerID": layer}],
+            }
+            gosu_result = run_checker(
+                "Critical",
+                {"versions": ["1.24.13"], "state": "fixed"},
+                gosu_artifact,
+                gosu_artifact,
+            )
+            self.assertEqual(0, gosu_result.returncode, gosu_result.stderr)
+
+            other_image = "docker.io/library/postgres@sha256:" + "e" * 64
+            target["userInput"] = other_image
+            target["repoDigests"] = [other_image]
+            unreviewed_gosu_result = run_checker(
+                "Critical",
+                {"versions": ["1.24.13"], "state": "fixed"},
+                gosu_artifact,
+                gosu_artifact,
+                expected_image=other_image,
+            )
+            self.assertEqual(1, unreviewed_gosu_result.returncode)
+            self.assertIn(
+                "blocking finding: CVE-2026-0001 severity=Critical",
+                unreviewed_gosu_result.stderr,
+            )
+            target["userInput"] = image_ref
+            target["repoDigests"] = [image_ref]
+
+            other_go_binary = {
+                **gosu_artifact,
+                "locations": [{"path": "/usr/local/bin/other", "layerID": layer}],
+            }
+            other_go_binary_result = run_checker(
+                "Critical",
+                {"versions": ["1.24.13"], "state": "fixed"},
+                other_go_binary,
+                other_go_binary,
+            )
+            self.assertEqual(1, other_go_binary_result.returncode)
+            self.assertIn(
+                "blocking finding: CVE-2026-0001 severity=Critical",
+                other_go_binary_result.stderr,
+            )
+
             target["repoDigests"] = [
                 f"index.docker.io/library/postgres@{digest}"
             ]