From 5cfe9f6677a49fd67466157e812c1fbb4ae2c5e5 Mon Sep 17 00:00:00 2001 From: Jeremi Joslin Date: Tue, 28 Jul 2026 21:15:56 +0700 Subject: [PATCH] fix(release): scope PostgreSQL gosu scan noise Signed-off-by: Jeremi Joslin --- .../check_postgresql_advisory_policy.py | 41 ++++++++++-- release/scripts/test_registry_release.py | 63 ++++++++++++++++++- 2 files changed, 97 insertions(+), 7 deletions(-) diff --git a/release/scripts/check_postgresql_advisory_policy.py b/release/scripts/check_postgresql_advisory_policy.py index 3fa88a8837..864aeff533 100644 --- a/release/scripts/check_postgresql_advisory_policy.py +++ b/release/scripts/check_postgresql_advisory_policy.py @@ -5,8 +5,9 @@ The official PostgreSQL image is an external runtime, not a product image. It does not carry a Registry Stack Git revision label, so its Grype and Syft evidence is bound to the reviewed immutable image digest and ordered rootfs -layers instead. The policy contains no accepted-risk mechanism: every fixable -finding and every High or Critical finding blocks the candidate. +layers instead. Every fixable finding and every High or Critical finding blocks +the candidate, except version-only Go module matches in the exact reviewed +``gosu`` helper whose binary reachability scan found no affected symbols. """ from __future__ import annotations @@ -32,7 +33,15 @@ "critical": 4, } SHA256_DIGEST = re.compile(r"sha256:[0-9a-f]{64}") -FIX_STATES = {"fixed", "not-fixed", "wont-fix"} +FIX_STATES = {"", "fixed", "not-fixed", "wont-fix"} +# govulncheck v1.6.0 -mode=binary reported zero reachable vulnerabilities +# for this exact linux/amd64 image's gosu 1.19.0 binary on 2026-07-28. +REVIEWED_GOSU_IMAGE = ( + "docker.io/library/postgres@" + "sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777" +) +GOSU_GO_ARTIFACTS = {"stdlib", "golang.org/x/sys"} +GOSU_PATH = "/usr/local/bin/gosu" def fail(message: str) -> None: @@ -141,7 +150,27 @@ def syft_artifacts(report: Any) -> dict[str, dict[str, Any]]: return indexed -def finding_blocks(item: Any, artifacts: dict[str, dict[str, Any]]) -> tuple[bool, str]: +def reviewed_gosu_go_metadata(artifact: dict[str, Any], expected_image: str) -> bool: + """Identify only the digest-bound gosu records cleared by binary reachability.""" + locations = artifact.get("locations") + return ( + expected_image == REVIEWED_GOSU_IMAGE + and artifact.get("type") == "go-module" + and artifact.get("name") in GOSU_GO_ARTIFACTS + and isinstance(locations, list) + and bool(locations) + and all( + isinstance(location, dict) and location.get("path") == GOSU_PATH + for location in locations + ) + ) + + +def finding_blocks( + item: Any, + artifacts: dict[str, dict[str, Any]], + expected_image: str, +) -> tuple[bool, str]: if not isinstance(item, dict): fail("grype report matches must be objects") vulnerability = item.get("vulnerability") @@ -179,6 +208,8 @@ def finding_blocks(item: Any, artifacts: dict[str, dict[str, Any]]) -> tuple[boo f"package={artifact.get('name', '')} {artifact.get('version', '')} " f"fixable={fixable}" ) + if reviewed_gosu_go_metadata(artifact, expected_image): + return False, summary return blocking, summary @@ -207,7 +238,7 @@ def main() -> None: fail("grype report must contain a matches list") blockers = [] for item in matches: - blocking, summary = finding_blocks(item, artifacts) + blocking, summary = finding_blocks(item, artifacts, args.expected_image) if blocking: blockers.append(summary) print(f"PostgreSQL advisory policy: blocking={len(blockers)}") diff --git a/release/scripts/test_registry_release.py b/release/scripts/test_registry_release.py index 6f19cdf180..43131e9cc3 100755 --- a/release/scripts/test_registry_release.py +++ b/release/scripts/test_registry_release.py @@ -765,7 +765,7 @@ def test_release_image_scans_are_policy_enforced_and_preserved(self) -> None: self.assertIn("retention-days: 7", images_job[upload_step:]) def test_postgresql_advisory_policy_fails_closed(self) -> None: - digest = "sha256:" + "b" * 64 + digest = "sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777" layer = "sha256:" + "c" * 64 image_ref = f"docker.io/library/postgres@{digest}" target = { @@ -797,6 +797,7 @@ def run_checker( fix: dict[str, object], grype_artifact: dict[str, object] | None = None, syft_artifact: dict[str, object] | None = None, + expected_image: str = image_ref, ) -> subprocess.CompletedProcess[str]: grype_artifact = grype_artifact or artifact syft_artifact = syft_artifact or artifact @@ -840,7 +841,7 @@ def run_checker( "--rootfs", str(rootfs), "--expected-image", - image_ref, + expected_image, ], cwd=ROOT, capture_output=True, @@ -874,6 +875,64 @@ def run_checker( ) self.assertEqual(0, extra_metadata_result.returncode, extra_metadata_result.stderr) + empty_fix_state_result = run_checker( + "Low", {"versions": [], "state": ""} + ) + self.assertEqual( + 0, + empty_fix_state_result.returncode, + empty_fix_state_result.stderr, + ) + + gosu_artifact = { + "id": "gosu-stdlib", + "name": "stdlib", + "version": "go1.24.6", + "type": "go-module", + "locations": [{"path": "/usr/local/bin/gosu", "layerID": layer}], + } + gosu_result = run_checker( + "Critical", + {"versions": ["1.24.13"], "state": "fixed"}, + gosu_artifact, + gosu_artifact, + ) + self.assertEqual(0, gosu_result.returncode, gosu_result.stderr) + + other_image = "docker.io/library/postgres@sha256:" + "e" * 64 + target["userInput"] = other_image + target["repoDigests"] = [other_image] + unreviewed_gosu_result = run_checker( + "Critical", + {"versions": ["1.24.13"], "state": "fixed"}, + gosu_artifact, + gosu_artifact, + expected_image=other_image, + ) + self.assertEqual(1, unreviewed_gosu_result.returncode) + self.assertIn( + "blocking finding: CVE-2026-0001 severity=Critical", + unreviewed_gosu_result.stderr, + ) + target["userInput"] = image_ref + target["repoDigests"] = [image_ref] + + other_go_binary = { + **gosu_artifact, + "locations": [{"path": "/usr/local/bin/other", "layerID": layer}], + } + other_go_binary_result = run_checker( + "Critical", + {"versions": ["1.24.13"], "state": "fixed"}, + other_go_binary, + other_go_binary, + ) + self.assertEqual(1, other_go_binary_result.returncode) + self.assertIn( + "blocking finding: CVE-2026-0001 severity=Critical", + other_go_binary_result.stderr, + ) + target["repoDigests"] = [ f"index.docker.io/library/postgres@{digest}" ]