From 558511d9b20ff0ae762d003ec18b6b1788c5b1e4 Mon Sep 17 00:00:00 2001 From: Charles Green Date: Thu, 10 Sep 2026 18:06:09 +0900 Subject: [PATCH] chore(security): suppress GO-2026-5932 (unfixable openpgp notice) Trivy flags golang.org/x/crypto/openpgp as unmaintained on every scan, regardless of x/crypto's version, because the advisory has no fixed version (it's a "don't use this package" notice, not a vulnerable version range). This repo never imports openpgp (grep -rn openpgp --include=*.go . returns nothing) -- x/crypto is only present transitively via grpc/otel. Per-alert dismissal doesn't hold: bumping x/crypto's version (as in #255) makes Trivy mark the old alert "fixed" and immediately open a new one for the new version, so the previously-filed dismissal requests (#254-258, #280) are already orphaned against alerts that no longer exist (#305/310/313/316/319/322 replaced them within the same day). A .trivyignore entry is scanner-level and survives version bumps; the currently-open alerts should auto-resolve to "fixed" once this lands, since Trivy will stop reporting the finding. Verified locally: `trivy fs --scanners vuln .` reports 6 GO-2026-5932 findings without this file, 0 with it. --- .trivyignore | 9 +++++++++ 1 file changed, 9 insertions(+) create mode 100644 .trivyignore diff --git a/.trivyignore b/.trivyignore new file mode 100644 index 0000000..2e39b72 --- /dev/null +++ b/.trivyignore @@ -0,0 +1,9 @@ +# GO-2026-5932: golang.org/x/crypto/openpgp is flagged as an unmaintained, +# unsafe-by-design package. This repo never imports openpgp directly +# (grep -rn openpgp --include=*.go . returns nothing) — golang.org/x/crypto +# is only present as a transitive dependency of grpc/otel. The advisory has +# no fixed version (it's a "don't use this package" notice, not a version +# bump), so Trivy re-flags it on every x/crypto version change with no way +# to resolve it via dependency bumps. Re-evaluate if openpgp usage is ever +# introduced. +GO-2026-5932