Repository navigation
fix(ci): restore clamav drift monitoring in CI matrix (#111 re-pin signal) - #113
Conversation
The clamav matrix entries were pinned to the deployed digests in 507c288, which froze the weekly scan output: when ClamAV ships a rebuild clearing pcre2 CVE-2026-103111, a digest-pinned matrix job cannot report the change. Floating the matrix refs restores the re-pin signal while compose continues to run the pinned digests (the actual security boundary, guarded by test_compose_clamav_and_scanner_digest_pinned). Same doctrine already applied to grype (floating :latest monitor + pinned :debug deployment scan) — this makes clamav consistent. Verified: workflow YAML parses; image-security test files green. NOTE: not exercised against GH Actions runner; weekly/push scans will show the clamav jobs reporting 1 HIGH (pcre2) until upstream rebuilds, then 0 — that transition is the feature.
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
|
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬───────┬─────────────────┐
|
|
Report Summary ┌───────────────────────────────────────────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. usr/bin/dcgm-exporter (gobinary)Total: 4 (HIGH: 4, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ usr/bin/shelless_ulimit (gobinary)Total: 3 (HIGH: 3, CRITICAL: 0) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ usr/bin/sleep (gobinary)Total: 3 (HIGH: 3, CRITICAL: 0) ┌─────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. grype (gobinary)Total: 4 (HIGH: 4, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌──────────────────────────────────────┬────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. clamav/clamav:latest (alpine 3.24.2)Total: 1 (HIGH: 1, CRITICAL: 0) ┌─────────┬─────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐ |
|
Report Summary ┌─────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. otelcol-contrib (gobinary)Total: 4 (HIGH: 4, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬────────┬─────────────────┐
|
|
Report Summary ┌──────────────────────────────────────────────────────────────────────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. grype (gobinary)Total: 4 (HIGH: 4, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬────────────────┬──────────────────────────────────────────────────────────────┐ |
|
Report Summary ┌───────────────────────────────────────────┬────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. clamav/clamav:latest_base (alpine 3.24.2)Total: 1 (HIGH: 1, CRITICAL: 0) ┌─────────┬─────────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────┐ |
|
Report Summary ┌───────────────────────────────────────────┬──────────┬─────────────────┐
For OSS Maintainers: VEX NoticeIf you're an OSS maintainer and Trivy has detected vulnerabilities in your project that you believe are not actually exploitable, consider issuing a VEX (Vulnerability Exploitability eXchange) statement. To disable this notice, set the TRIVY_DISABLE_VEX_NOTICE environment variable. goflow2 (gobinary)Total: 1 (HIGH: 1, CRITICAL: 0) ┌──────────────────┬────────────────┬──────────┬────────┬───────────────────┬───────────────┬─────────────────────────────────────────────────────────┐ |
|
Report Summary ┌────────┬──────┬─────────────────┐
|
|
Report Summary ┌─────────────────────────────────────────────┬──────────┬─────────────────┐
|
…nitor (#116) 2026-10-10 verification (re-scan gate, #82 rules): - pinned 0.161.0 digest (fd328de2) now shows 4 HIGH after new Go CVEs published against its frozen package versions: stdlib 78667/97031, stdlib+x-net 78669 (fixes: Go 1.26.9/1.27.2, x/net 0.60.0) -> issue #115 - registry :latest (8b9211db) scanned on the same DB: IDENTICAL 4 findings -> upstream rebuild not yet shipped; re-pin correctly NOT adopted (gate: equal-or-better only; this would be a lateral move with zero security gain) - grype:debug candidate (3518aea7) likewise rejected: same 4 findings, while the deployed 1d10432f pin stays clean (0 HIGH) -> keep pin With the matrix pinned, CI could never observe the upstream fix — the frozen digest reports the same 4 findings forever. Floating the otel matrix entry restores the re-pin trigger (clamav/#113 and goflow2/dcgm doctrine); compose keeps the deployed digest pin unchanged (the security boundary; #115 keeps the findings visible — no .trivyignore suppression on the core path, and these IDs collide with #83/#84 anyway). Docs corrected to reflect the wave honestly: otel row 0->4 HIGH with #115 link, grype footnote (monitor noise vs clean deployed pin), core-stack "100% clean" claim narrowed to openobserve/rsigma/falco, scan-date line notes the 2026-10-10 recheck. Verification: workflow YAML parses; image-security, release, and compliance test files green (no test pins the matrix entry). Co-authored-by: JJediny (merge automation) <jjediny+localmerge@gsa.gov>
Why
Commit 507c288 pinned the `clamav` + `clamav-base` CI-matrix entries to the deployed digests. That accidentally froze #111's re-pin signal: a pinned digest reports the same 1 HIGH (pcre2 CVE-2026-103111) forever, so when ClamAV ships a rebuild the weekly scan cannot show it cleared.
Today's check confirms upstream is still pending: registry `clamav:latest` / `:latest_base` digests are byte-identical to our Oct-4 pins — which also proves the pin is doing its deployment job (no silent drift).
What
Expected CI behavior until upstream rebuilds: `Trivy scan (clamav)` / `(clamav-base)` report 1 HIGH (informational — the CRITICAL gate still passes). The day upstream ships pcre2 10.49-r0, those jobs drop to 0 = the re-pin trigger for #111.
Validation