ci: ignore CVE-2026-56854 and document the Trivy ignore policy - #391
Merged
Conversation
The x/crypto/ssh source-address advisory lands on three binaries the images cannot fix yet: OpenTofu 1.12.6 carries golang.org/x/crypto v0.52.0, OpenTofu Language Server 0.5.3 v0.53.0 and Terraform Language Server 0.39.0 v0.54.0, while the fix is in v0.55.0. Terraform 1.16.0 already ships it, so the terraform binary needs no entry. OpenTofu and the Terraform Language Server carry the fixed version on the branches their next releases come from, so the entry expires at the end of October, by when both are expected to have released. The OpenTofu Language Server has no fix upstream at all; the same date re-opens the review for it rather than a later one. Also write down the policy the entry follows in AGENTS.md: take an upstream release that fixes the finding instead of ignoring it, record the versions that were checked, scope the entry to the reported binaries, and expire it when the fix is expected — or, when that cannot be estimated, at a re-check date no more than three months out. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The entry carries the vulnerability id, so describing the advisory in the statement only duplicates it. Leave the versions that were checked, which is what the entry cannot be read without, and say so in the policy: the id is the reference for what the finding is. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE-2026-56854 (
golang.org/x/crypto/ssh, CRITICAL) started failing the Trivy scan of theterraformandopentofuimages — the four amd64check-imagejobs on #389 and, from the next scan on,trivy.ymlonmain. It is one new finding on three binaries, and no other image reports it (golang/goplsscans clean).What the scan reports
golang.org/x/cryptousr/local/bin/tofuusr/local/bin/tofu-lsusr/local/bin/terraform-lsusr/local/bin/terraformEvery pinned version above is the newest upstream release, so there is nothing to bump:
terraformis clean because 1.16.0 already carries the fixed dependency, and the other three have no fixed release to take. That is what makes this an ignore entry rather than a version bump.The entry
One entry keyed by the CVE id, listing the three reported paths, expiring
2026-10-31. The statement records the versions that were checked and nothing more — the id is the reference for what the finding itself is.mainand thev1.13branch (the onev1.13.0-beta1, cut 2026-08-27, comes from) already use v0.55.0, so the fix arrives with 1.13.0. The 1.12.0 cycle ran ~5 weeks from beta1 to GA, so October. Thev1.12maintenance branch still declares v0.52.0, so a 1.12.7 patch would not carry it.mainmoved to v0.55.0 on 2026-08-20, and releases land roughly monthly (0.38.7 Jun 8 → 0.38.8 Jul 2 → 0.39.0 Jul 23), so its next release fixes it.mainstill declares v0.53.0 and has no commit since 0.5.3 (2026-07-08); no fixed release is in sight. On its own it would take the three-month re-check date, but a single entry takes the earliest of the three dates, so the October expiry re-opens the review for it too.AGENTS.md
Writes down the policy this entry follows, since none of it was recorded: take an upstream release that fixes the finding instead of ignoring it; ignore only what the newest upstream release still carries; record the versions checked in
statementand never restate the advisory; scope the entry to the reportedpaths; setexpired_atto when the fix is expected, or — when that cannot be estimated — a re-check date at most three months out, taking the earliest date when one entry spans several binaries; and leave expired entries to a reviewer, which is whattrivyignore-cleanup.ymlalready does..trivyignore.yamlis also added to the repository map at the top.Verification
prune-trivyignore.shrun against the edited file: a report containing every current finding prunes nothing and leaves the file byte-for-byte unchanged; a report simulating upstream fixingtofuandterraform-lsdrops exactly those two paths and keeps the entry, comments and blank lines intact.changed-images.shselects every image for this change, so the build checks on this pull request rescanterraformandopentofuand confirm the suppression.Two older entries (CVE-2026-56864, CVE-2026-56865) still explain their advisories in prose, which the policy above now rules out, and several name the versions current when they were written (Terraform 1.15.8, OpenTofu 1.12.5). Neither is touched here;
trivyignore-cleanup.ymldrops those entries once the published images stop reporting them.