From 834076db31dcffd582e55f0c2a1888fe4c8a70a3 Mon Sep 17 00:00:00 2001 From: Louis Parkin Date: Wed, 12 Aug 2026 08:53:31 +0200 Subject: [PATCH] Renew the GO-2026-5932 exception, unbreaking master The exception expired on 2026-08-11, so the first master build after that date failed its image scan gate on an expired exception rather than on any new finding. The commit it failed on only added a workflow file. No compatible patch exists to remediate instead: the advisory covers every version of golang.org/x/crypto (introduced 0, no fixed release) because the openpgp packages are permanently unmaintained, so a bump cannot clear it. Re-verified the not-affected claim against this commit rather than trusting the original text. go list -deps ./cmd/... resolves 1329 packages and contains no openpgp package; the linked x/crypto packages are cryptobyte, chacha20, chacha20poly1305, pbkdf2, scrypt and ocsp, which are also why the indirect module cannot be dropped. Renewed for the 14 days the SLA allows a finding with no known patch. The durable fix is a vexhub statement, tracked in StackVista/cve-reporter#27. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- exceptions/GO-2026-5932.yaml | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/exceptions/GO-2026-5932.yaml b/exceptions/GO-2026-5932.yaml index d6ef718b..3214545b 100644 --- a/exceptions/GO-2026-5932.yaml +++ b/exceptions/GO-2026-5932.yaml @@ -11,7 +11,7 @@ component: - opt/stackstate-agent/bin/agent/process-agent status: accepted_with_compensating_control reason: unpublished_image_vex_identity_bridge -expires: 2026-08-11 +expires: 2026-08-26 owner: "@StackVista/observability-team" upstream_owner: golang upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932 @@ -24,3 +24,11 @@ statement: | VEX hub in advance. Keep this bridge only until the scan pipeline can apply the reviewed statement to unpublished images without broadening it to every consumer of golang.org/x/crypto. + + Renewed 2026-08-12. No compatible patch exists: the advisory covers all + versions (introduced 0, no fixed release) because the openpgp packages are + permanently unmaintained, so upgrading golang.org/x/crypto cannot clear it. + Absence re-verified against this commit with `go list -deps ./cmd/...`, which + resolves 1329 packages and no openpgp package; the only linked x/crypto + packages are cryptobyte, chacha20, chacha20poly1305, pbkdf2, scrypt and ocsp, + which are also why the indirect module cannot simply be dropped.