Repository navigation
fix(release): scope PostgreSQL gosu scan noise - #537
Conversation
Signed-off-by: Jeremi Joslin <jeremi@joslin.fr>
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5cfe9f6677
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| evidence is bound to the reviewed immutable image digest and ordered rootfs | ||
| layers instead. The policy contains no accepted-risk mechanism: every fixable | ||
| finding and every High or Critical finding blocks the candidate. | ||
| layers instead. Every fixable finding and every High or Critical finding blocks |
There was a problem hiding this comment.
The reviewed commit has no Signed-off-by: trailer, so it does not satisfy the repository's mandatory DCO policy and will be rejected by the corresponding contribution gate. Recreate the commit with a valid sign-off before merging.
AGENTS.md reference: AGENTS.md:L68-L72
Useful? React with 👍 / 👎.
| if reviewed_gosu_go_metadata(artifact, expected_image): | ||
| return False, summary |
There was a problem hiding this comment.
When a later Grype database reports a newly disclosed, genuinely reachable High/Critical or fixable vulnerability in stdlib or golang.org/x/sys for this same pinned gosu binary, this unconditional return still suppresses it because the exemption checks only the image digest, package name/type, and path—not the vulnerability ID or the reachability evidence. The candidate gate can therefore keep passing the pinned vulnerable image indefinitely; scope the exemption to the exact advisories reviewed as false positives, or regenerate and verify bound reachability evidence for each scan.
Useful? React with 👍 / 👎.
Summary
/usr/local/bin/gosuin the reviewed, digest-locked PostgreSQL imageEvidence
gosu1.19.0 binary from the locked PostgreSQL image:govulncheck v1.6.0 -mode=binaryreports 0 reachable vulnerabilitiesPostgreSQL advisory policy: blocking=0Verification
python3 release/scripts/test_registry_release.py(92 passed)python3 release/scripts/check-gates-inventory.py(168 gates)git diff --checkThis narrows a scanner-only external-helper false positive after candidate run 30363651864. Notary, Relay, and all three candidate builds passed in that run.