chore(ci): accept GO-2026-5932 (unmaintained x/crypto/openpgp)#28
Closed
rodrigodh wants to merge 1 commit into
Closed
chore(ci): accept GO-2026-5932 (unmaintained x/crypto/openpgp)#28rodrigodh wants to merge 1 commit into
rodrigodh wants to merge 1 commit into
Conversation
Fiber v3 pulls golang.org/x/crypto transitively via acme/autocert. The Go advisory GO-2026-5932 (openpgp unmaintained) has no fixed version and the openpgp package is not imported by this module, so it is suppressed via .trivyignore to unblock the Fiber v3 migration PRs across the wave. X-Lerian-Ref: 0x1
📝 WalkthroughWalkthroughChangesSecurity suppression
✨ Finishing Touches✨ Simplify code
Comment |
Contributor
🔍 PR Validation Summary✅ PR Mergeable — no blocking failures
|
Contributor
📊 Unit Test Coverage Report:
|
| Metric | Value |
|---|---|
| Overall Coverage | 85.7% ✅ PASS |
| Threshold | 80% |
Coverage by Package
| Package | Coverage |
|---|---|
github.com/LerianStudio/lib-observability/assert |
97.9% |
github.com/LerianStudio/lib-observability/constants |
83.3% |
github.com/LerianStudio/lib-observability/log |
94.9% |
github.com/LerianStudio/lib-observability/metrics |
91.4% |
github.com/LerianStudio/lib-observability/middleware |
76.9% |
github.com/LerianStudio/lib-observability/redaction |
95.8% |
github.com/LerianStudio/lib-observability/runtime |
80.4% |
github.com/LerianStudio/lib-observability/tracing |
84.8% |
github.com/LerianStudio/lib-observability/zap |
96.0% |
github.com/LerianStudio/lib-observability |
91.5% |
Generated by Go PR Analysis workflow
Contributor
🔒 Security Scan Results —
|
| Stage | Status | Blocking? |
|---|---|---|
| Filesystem Scan | 🔴 Yes | |
| Docker Image Scan | ➖ Skipped | — |
| Docker Hub Health Score | ➖ Skipped | — |
| Pre-release Version Check | ✅ Clean | — |
Trivy
Filesystem Scan
| Severity | Library | Vulnerability | Installed | Fixed | Title |
|---|---|---|---|---|---|
| 🟡 MEDIUM | github.com/gofiber/fiber/v2 |
CVE-2026-45045 | v2.52.13 | N/A | GoFiber Vulnerable to X-Real-IP Spoofing via Header.Add()... |
Pre-release Version Check
✅ No unstable version pins found.
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.trivyignore:
- Line 9: Scope the GO-2026-5932 suppression in .trivyignore so it only applies
to the intended openpgp dependency, and add an expiration via a Trivy YAML rule
or an equivalent CI check that verifies openpgp remains unreachable. Do not
retain an unbounded ID-only ignore entry.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
| # - The openpgp package is NOT imported by this module (only acme/autocert is | ||
| # reachable), so the unmaintained-package risk is not exercised here. | ||
| # - Accepted until an upstream (fiber/x-crypto) change removes the transitive edge. | ||
| GO-2026-5932 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
printf '\n== Files of interest ==\n'
git ls-files | rg '(^|/)(\.trivyignore|go\.mod|go\.sum|trivy.*yml|trivy.*yaml|\.github/workflows/.*)$' || true
printf '\n== .trivyignore ==\n'
if [ -f .trivyignore ]; then
cat -n .trivyignore
fi
printf '\n== go.mod ==\n'
if [ -f go.mod ]; then
cat -n go.mod
fi
printf '\n== Search for openpgp / acme/autocert references ==\n'
rg -n 'openpgp|acme/autocert|GO-2026-5932|trivyignore|trivy' -S .Repository: LerianStudio/lib-observability
Length of output: 4010
Scope or expire this ignore entry. .trivyignore suppresses GO-2026-5932 by ID only, so a later openpgp dependency would also be hidden. Prefer a scoped Trivy YAML rule with expired_at, or pair this ignore with a CI check that keeps openpgp unreachable.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.trivyignore at line 9, Scope the GO-2026-5932 suppression in .trivyignore
so it only applies to the intended openpgp dependency, and add an expiration via
a Trivy YAML rule or an equivalent CI check that verifies openpgp remains
unreachable. Do not retain an unbounded ID-only ignore entry.
Contributor
Author
|
Closing — wrong vehicle. Based on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The Fiber v3 migration PR (#27) is blocked by the security gate on a single Trivy finding:
golang.org/x/cryptogolang.org/x/cryptois a new transitive dependency introduced by Fiber v3 (gofiber/fiber/v3 → golang.org/x/crypto/acme/autocert) — it is not in the currentgo.modon develop.This cannot be fixed by updating the dependency: GO-2026-5932 flags
golang.org/x/crypto/openpgpas unmaintained, an advisory with no fixed version — it applies to every release, including the latestv0.54.0.What
Adds a root
.trivyignoreaccepting GO-2026-5932 as a reviewed risk, because:openpgppackage is not imported anywhere in this module — onlyacme/autocertis reachable, so the unmaintained-package risk is not exercised.Scope / impact
Merging this to
developunblocks #27 and pre-empts the identical failure in every downstream Fiber v3 PR in the wave (lib-commons, lib-auth, lib-license-go, lib-systemplane, plugin-access-manager — all pull x/crypto via Fiber v3).After merge, re-run #27's security check (or merge develop into #27) so its merge-ref scan picks up the ignore.