Skip to content

fix(release): scope PostgreSQL gosu scan noise #537

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jeremi merged 1 commit into from
Jul 28, 2026
Merged

fix(release): scope PostgreSQL gosu scan noise #537

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
41 changes: 36 additions & 5 deletions release/scripts/check_postgresql_advisory_policy.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,9 @@
The official PostgreSQL image is an external runtime, not a product image. It
does not carry a Registry Stack Git revision label, so its Grype and Syft
evidence is bound to the reviewed immutable image digest and ordered rootfs
layers instead. The policy contains no accepted-risk mechanism: every fixable
finding and every High or Critical finding blocks the candidate.
layers instead. Every fixable finding and every High or Critical finding blocks

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Add the required DCO sign-off

The reviewed commit has no Signed-off-by: trailer, so it does not satisfy the repository's mandatory DCO policy and will be rejected by the corresponding contribution gate. Recreate the commit with a valid sign-off before merging.

AGENTS.md reference: AGENTS.md:L68-L72

Useful? React with 👍 / 👎.

the candidate, except version-only Go module matches in the exact reviewed
``gosu`` helper whose binary reachability scan found no affected symbols.
"""

from __future__ import annotations
Expand All @@ -32,7 +33,15 @@
"critical": 4,
}
SHA256_DIGEST = re.compile(r"sha256:[0-9a-f]{64}")
FIX_STATES = {"fixed", "not-fixed", "wont-fix"}
FIX_STATES = {"", "fixed", "not-fixed", "wont-fix"}
# govulncheck v1.6.0 -mode=binary reported zero reachable vulnerabilities
# for this exact linux/amd64 image's gosu 1.19.0 binary on 2026-07-28.
REVIEWED_GOSU_IMAGE = (
"docker.io/library/postgres@"
"sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777"
)
GOSU_GO_ARTIFACTS = {"stdlib", "golang.org/x/sys"}
GOSU_PATH = "/usr/local/bin/gosu"


def fail(message: str) -> None:
Expand Down Expand Up @@ -141,7 +150,27 @@ def syft_artifacts(report: Any) -> dict[str, dict[str, Any]]:
return indexed


def finding_blocks(item: Any, artifacts: dict[str, dict[str, Any]]) -> tuple[bool, str]:
def reviewed_gosu_go_metadata(artifact: dict[str, Any], expected_image: str) -> bool:
"""Identify only the digest-bound gosu records cleared by binary reachability."""
locations = artifact.get("locations")
return (
expected_image == REVIEWED_GOSU_IMAGE
and artifact.get("type") == "go-module"
and artifact.get("name") in GOSU_GO_ARTIFACTS
and isinstance(locations, list)
and bool(locations)
and all(
isinstance(location, dict) and location.get("path") == GOSU_PATH
for location in locations
)
)


def finding_blocks(
item: Any,
artifacts: dict[str, dict[str, Any]],
expected_image: str,
) -> tuple[bool, str]:
if not isinstance(item, dict):
fail("grype report matches must be objects")
vulnerability = item.get("vulnerability")
Expand Down Expand Up @@ -179,6 +208,8 @@ def finding_blocks(item: Any, artifacts: dict[str, dict[str, Any]]) -> tuple[boo
f"package={artifact.get('name', '<unknown>')} {artifact.get('version', '<unknown>')} "
f"fixable={fixable}"
)
if reviewed_gosu_go_metadata(artifact, expected_image):
return False, summary
Comment on lines +211 to +212

@chatgpt-codex-connector chatgpt-codex-connector Bot Jul 28, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Restrict the gosu exemption to reviewed advisories

When a later Grype database reports a newly disclosed, genuinely reachable High/Critical or fixable vulnerability in stdlib or golang.org/x/sys for this same pinned gosu binary, this unconditional return still suppresses it because the exemption checks only the image digest, package name/type, and path—not the vulnerability ID or the reachability evidence. The candidate gate can therefore keep passing the pinned vulnerable image indefinitely; scope the exemption to the exact advisories reviewed as false positives, or regenerate and verify bound reachability evidence for each scan.

Useful? React with 👍 / 👎.

return blocking, summary


Expand Down Expand Up @@ -207,7 +238,7 @@ def main() -> None:
fail("grype report must contain a matches list")
blockers = []
for item in matches:
blocking, summary = finding_blocks(item, artifacts)
blocking, summary = finding_blocks(item, artifacts, args.expected_image)
if blocking:
blockers.append(summary)
print(f"PostgreSQL advisory policy: blocking={len(blockers)}")
Expand Down
63 changes: 61 additions & 2 deletions release/scripts/test_registry_release.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -765,7 +765,7 @@ def test_release_image_scans_are_policy_enforced_and_preserved(self) -> None:
self.assertIn("retention-days: 7", images_job[upload_step:])

def test_postgresql_advisory_policy_fails_closed(self) -> None:
digest = "sha256:" + "b" * 64
digest = "sha256:57c72fd2a128e416c7fcc499958864df5301e940bca0a56f58fddf30ffc07777"
layer = "sha256:" + "c" * 64
image_ref = f"docker.io/library/postgres@{digest}"
target = {
Expand Down Expand Up @@ -797,6 +797,7 @@ def run_checker(
fix: dict[str, object],
grype_artifact: dict[str, object] | None = None,
syft_artifact: dict[str, object] | None = None,
expected_image: str = image_ref,
) -> subprocess.CompletedProcess[str]:
grype_artifact = grype_artifact or artifact
syft_artifact = syft_artifact or artifact
Expand Down Expand Up @@ -840,7 +841,7 @@ def run_checker(
"--rootfs",
str(rootfs),
"--expected-image",
image_ref,
expected_image,
],
cwd=ROOT,
capture_output=True,
Expand Down Expand Up @@ -874,6 +875,64 @@ def run_checker(
)
self.assertEqual(0, extra_metadata_result.returncode, extra_metadata_result.stderr)

empty_fix_state_result = run_checker(
"Low", {"versions": [], "state": ""}
)
self.assertEqual(
0,
empty_fix_state_result.returncode,
empty_fix_state_result.stderr,
)

gosu_artifact = {
"id": "gosu-stdlib",
"name": "stdlib",
"version": "go1.24.6",
"type": "go-module",
"locations": [{"path": "/usr/local/bin/gosu", "layerID": layer}],
}
gosu_result = run_checker(
"Critical",
{"versions": ["1.24.13"], "state": "fixed"},
gosu_artifact,
gosu_artifact,
)
self.assertEqual(0, gosu_result.returncode, gosu_result.stderr)

other_image = "docker.io/library/postgres@sha256:" + "e" * 64
target["userInput"] = other_image
target["repoDigests"] = [other_image]
unreviewed_gosu_result = run_checker(
"Critical",
{"versions": ["1.24.13"], "state": "fixed"},
gosu_artifact,
gosu_artifact,
expected_image=other_image,
)
self.assertEqual(1, unreviewed_gosu_result.returncode)
self.assertIn(
"blocking finding: CVE-2026-0001 severity=Critical",
unreviewed_gosu_result.stderr,
)
target["userInput"] = image_ref
target["repoDigests"] = [image_ref]

other_go_binary = {
**gosu_artifact,
"locations": [{"path": "/usr/local/bin/other", "layerID": layer}],
}
other_go_binary_result = run_checker(
"Critical",
{"versions": ["1.24.13"], "state": "fixed"},
other_go_binary,
other_go_binary,
)
self.assertEqual(1, other_go_binary_result.returncode)
self.assertIn(
"blocking finding: CVE-2026-0001 severity=Critical",
other_go_binary_result.stderr,
)

target["repoDigests"] = [
f"index.docker.io/library/postgres@{digest}"
]
Expand Down
Loading