.grype.yaml

# Grype vulnerability scanner configuration for gh-aw-firewall container images.
#
# This file is mounted into the grype container by the supply-chain-scan workflow
# so that known-accepted / unresolvable findings do not block every PR.
#
# Each entry must include a justification comment explaining:
#   1. Why the finding cannot be fixed in the image layer we control.
#   2. What the risk acceptance decision is and who should revisit it.
#
# Format reference: https://github.com/anchore/grype?tab=readme-ov-file#configuration

ignore:
  # ── stdlib@go1.24.6 embedded in gosu binary ──────────────────────────────────
  #
  # GO-2026-4337 (stdlib go1.24.6 -> 1.24.13 / 1.25.7 / 1.26.0-rc.3, CRITICAL):
  #   During TLS session resumption, changes to ClientCAs or RootCAs between
  #   the original and resumed handshakes may be ignored, allowing a peer
  #   whose certificate is no longer trusted to resume the session.
  #
  #   Risk acceptance — NOT REACHABLE in gosu:
  #     gosu is a minimal setuid/exec privilege-drop binary (github.com/tianon/gosu
  #     v1.19.0). It accepts a user specification and a command, sets up credentials
  #     via setuid(2)/setgid(2), and calls execve(2). It contains no network code,
  #     opens no TLS connections, and never calls any crypto/tls function. The
  #     affected TLS resumption path is entirely unreachable in this binary.
  #     govulncheck analysis confirms: gosu does not import or exercise any
  #     crypto/tls code paths (upstream tracking: tianon/gosu#176).
  #
  #   No fix is shippable today:
  #     gosu 1.19.0 is the latest upstream release; no newer official release
  #     rebuilt with Go >= 1.24.13 exists as of 2026-07-27. Building gosu from
  #     unreleased source would ship an untagged, unofficial binary (worse
  #     supply-chain posture than accepting a non-reachable CVE finding).
  #
  #   Revisit: once a new official gosu release (> 1.19.0) built with Go >= 1.24.13
  #   is published, update the GOSU_VERSION pin and per-architecture SHA256
  #   checksums in containers/agent/Dockerfile and DELETE this entry.
  #   Tracked in github/gh-aw-firewall#6640.
  - vulnerability: GO-2026-4337
    package:
      name: stdlib
      version: "go1.24.6"
      type: go-module
      location: "/usr/local/bin/gosu"

  # ── brace-expansion bundled inside the vendored npm CLI ──────────────────────
  #
  # GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7 -> 5.0.8, HIGH):
  #   DoS via unbounded brace expansion length causing an out-of-memory crash.
  #
  #   Risk acceptance — BOUNDED DoS in a build-time CLI tool, no other impact:
  #     This brace-expansion is NOT an application dependency. The agent,
  #     api-proxy, and cli-proxy images all vendor the npm CLI (pinned
  #     npm@11.18.0, extracted into /usr/local/lib/node_modules/npm), and npm
  #     bundles brace-expansion inside its own node_modules. The sidecars build
  #     with `npm ci --omit=dev`, which prunes their app-level dev copies, so the
  #     only brace-expansion left in the runtime images is npm's bundled one.
  #     The worst case is that an `npm` invocation over a hostile brace pattern
  #     hangs/OOMs that npm process — no privilege escalation, data exfiltration,
  #     or RCE. npm is a trusted build tool here, not exposed to untrusted input.
  #
  #   No fix is shippable today: npm 11.18.0 is the latest npm release and still
  #   bundles brace-expansion <=5.0.7. brace-expansion 5.0.8 (the patched
  #   version) exists on the registry but no npm release ships it yet, and
  #   hand-patching npm's internal bundle would produce a non-official npm.
  #   Revisit: once an npm release bundling brace-expansion >= 5.0.8 is
  #   available, bump the npm pin (NPM_TGZ_URL / sha256) in agent/Dockerfile,
  #   api-proxy/Dockerfile, and cli-proxy/Dockerfile and DELETE this entry.
  #   Tracked in github/gh-aw-firewall.
  - vulnerability: GHSA-mh99-v99m-4gvg
    package:
      name: brace-expansion
      type: npm