Repository navigation
Resolve scanner dependency advisories before adoption #5553
Description
🤖 Generated by the Agentic Engineer
Problem and impact
The public kubevuln scanner release reports reachable dependency advisories in both executable entrypoints. A functional scanner repair therefore needs a separate security disposition before adoption; a verified signature does not establish that result.
An audit of unmodified v0.3.571 reproduces eight advisory records across three modules. Some records cover broad legacy modules, so their reported count must not be presented as eight proven exploitable defects. The HTTP dependency has a published fixed release; the existing upstream RAR-decoder issue remains separately tracked by the project.
Acceptance criteria
- Establish a reproducible source and actual published-binary baseline with the public advisory database.
- Apply supported dependency corrections without changing scanner capabilities, discarding results or suppressing advisories.
- Analyze remaining records against their upstream advisories and real call paths; retain unresolved findings as blockers.
- Validate both scanner entrypoints and the existing functional regression suite, with an independent review of the proposed head.
- Adopt only a reviewed, tested, signed immutable artifact, then prove complete current-image result coverage through the protected deployment path.
This is a prerequisite for the scanner adoption in #5403, under the platform roadmap #2043. Detailed audit and runtime evidence stays in private operator evidence. Upstream dependency coordination remains with the upstream maintainers; no unrelated Syft or Grype version change is proposed.
Metadata
Metadata
Assignees
Labels
Type
Fields
Projects
- Status
Activity
chore: agent-claim #5553 nonce=74d3f8abd09ebfa331cfa9535cb97125
devantler commentedon Oct 29, 2026
The latest published upstream scanner reproduces the dependency audit blocker. A manifest pin cannot change embedded executable dependencies, and no existing portfolio-owned artifact supplies the correction. The sufficient source change is a small upstream dependency update; the public project and its contribution policies have been checked, and its PR template is available.
The prepared change updates only the HTTP dependency and its Go-generated checksums. Both entrypoints build; the complete source race suite, vet and pinned lint pass. The target's full test command passes with its four existing skips explicitly retained as unexecuted coverage. Source and both executable audits remove the HTTP records while preserving three other unresolved records. A clean overall audit and deployment acceptance have not been established, so the image-adoption hold remains.
chore: agent-claim #5553 nonce=239ca78e67341083bb6a0bb4b2a5449d
devantler commentedon Oct 29, 2026
The minimal HTTP dependency correction is offered upstream as kubescape/kubevuln#1218, Ready for Review at signed head
8ec68b4582dbb185b1b9ca8d827ec468d182f7e3. The target template and published body are now verified through the required write gate. Local validation is complete with the declared integration-test skips; hosted fork workflows require upstream maintainer approval, so no hosted success is claimed.The remaining dependency records and protected artifact/adoption acceptance remain unresolved. This issue and the scanner adoption stay open; the upstream review handoff does not establish platform recovery.
devantler commentedon Oct 29, 2026
The HTTP dependency correction kubescape/kubevuln#1218 merged on 29 October after upstream approval at its exact proposed head. The resulting upstream revision is
3f1c4edc7a5a667ffba357122add316900daacd3.The post-merge executable audit still fails with three remaining advisory records. This confirms partial upstream delivery, without establishing a clean audit, an accepted published artifact or platform adoption. The remaining analysis and protected adoption criteria above remain open; #5403 and its delivery PR stay held.
devantler commentedon Oct 29, 2026
The existing upstream stack upgrade now covers the Syft, stereoscope and container-registry dependency changes, so a duplicate proposal is unnecessary. At
6462921584b809d48e76f986280d9f336d9e912e, native build, lint and Basic-Test checks pass. The upstream review still requests the fixed Syft fork, and the proposed upgrade retains other dependency-audit findings.This is static source and native-check evidence only. The branch has not been executed locally, no new scanner artifact has been accepted, and #5405 stays held. After the upstream repair lands, independently audit both published executables and validate current-image scan coverage through protected deployment before closing this issue.