From 470623e22a37e197f3be295e7606c028d5dbf785 Mon Sep 17 00:00:00 2001 From: chen21019 Date: Mon, 2 Nov 2026 01:41:52 +0800 Subject: [PATCH] Bind the existing OpenPGP decision to the qualified Compose 0.14.41 bytes --- server/security/check_scan_coverage.py | 2 +- server/security/openvex.json | 6 +- .../reviews/compose-0.14.41-openpgp.json | 78 +++++++++++++++++++ server/security/test_scan_coverage.py | 25 ++++++ 4 files changed, 107 insertions(+), 4 deletions(-) create mode 100644 server/security/reviews/compose-0.14.41-openpgp.json diff --git a/server/security/check_scan_coverage.py b/server/security/check_scan_coverage.py index 2d2b69b038..eb088f1f87 100644 --- a/server/security/check_scan_coverage.py +++ b/server/security/check_scan_coverage.py @@ -28,7 +28,7 @@ 'usr/bin/authentication-service.real': 'e121cee8b7a6bd3c0eb6fe3e15ff304b78119b426642ed76f13e3d92be161192', 'usr/bin/docker-machine': '8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c', 'usr/bin/docker-machine-driver-packet': 'a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79', - 'usr/bin/compose-executor.real': 'a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc', + 'usr/bin/compose-executor.real': '56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa', 'usr/bin/host-provisioner.real': '92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff', } diff --git a/server/security/openvex.json b/server/security/openvex.json index d16c668e44..e345828473 100644 --- a/server/security/openvex.json +++ b/server/security/openvex.json @@ -2,8 +2,8 @@ "@context": "https://openvex.dev/ns/v0.2.0", "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.565", "author": "PastureStack Security", - "timestamp": "2026-11-01T17:19:43Z", - "version": 78, + "timestamp": "2026-11-01T17:40:13Z", + "version": 79, "statements": [ { "vulnerability": { @@ -350,7 +350,7 @@ ], "status": "not_affected", "justification": "vulnerable_code_not_present", - "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The authentication-service 0.4.46 (v0.57.0) and machine-driver-bundle 0.16.6 (v0.58.0) release dependency graphs and source-mode/symbol govulncheck evidence contain no OpenPGP package import or reachable function, including both docker-machine and docker-machine-driver-packet. The compose-executor 0.14.40 v0.56.0 original binary has a qualified source package-graph gate and an inspected Go function/inline-name table with no OpenPGP code; maintained bcrypt/scrypt symbols provide positive controls. The host-provisioner v0.56.0 path is unchanged. Before applying this VEX, the publisher requires exact reviewed executable paths, module versions and binary SHA256 values; it rejects any new consumer or changed bytes. This is a code-absence decision, not a claim that the full crypto module is fixed." + "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The authentication-service 0.4.46 (v0.57.0) and machine-driver-bundle 0.16.6 (v0.58.0) release dependency graphs and source-mode/symbol govulncheck evidence contain no OpenPGP package import or reachable function, including both docker-machine and docker-machine-driver-packet. The compose-executor 0.14.41 v0.56.0 original binary has a qualified source package-graph gate and an inspected Go function/inline-name table with no OpenPGP code; maintained bcrypt/scrypt symbols provide positive controls. The host-provisioner v0.56.0 path is unchanged. Before applying this VEX, the publisher requires exact reviewed executable paths, module versions and binary SHA256 values; it rejects any new consumer or changed bytes. This is a code-absence decision, not a claim that the full crypto module is fixed. The updated Compose payload is independently requalified in server/security/reviews/compose-0.14.41-openpgp.json; no consumer, module-version or executable-path scope is added." }, { "vulnerability": { diff --git a/server/security/reviews/compose-0.14.41-openpgp.json b/server/security/reviews/compose-0.14.41-openpgp.json new file mode 100644 index 0000000000..70093d380a --- /dev/null +++ b/server/security/reviews/compose-0.14.41-openpgp.json @@ -0,0 +1,78 @@ +{ + "format": "pasturestack-qualified-go-code-absence-v1", + "scope": { + "executable": "usr/bin/compose-executor.real", + "module": "pkg:golang/golang.org/x/crypto@v0.56.0", + "advisory": "GO-2026-5932", + "decision": "not_affected", + "justification": "vulnerable_code_not_present", + "moduleDeclaredFixed": false, + "newConsumerOrScopeAllowed": false + }, + "artifact": { + "releaseVersion": "0.14.41", + "releaseGzipSha256": "a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0", + "binarySha256": "56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa", + "binaryBytes": 21729404, + "source": "ed3dbddda8a04522e6969fef12672bfb30f3d180", + "tree": "d6279b05f6e3ccc8f9ff28b1300979502f5079c8", + "officialCiArtifactZipSha256": "33b85bb0dfdd8dcf5225289dca817710d3de645c58e9acb3a224f133cab9b142", + "releaseGzipAndOfficialTestedProductBytesIdentical": true, + "compiler": "go1.27.3", + "binaryVcsRevisionEmbedded": false + }, + "sourceGraph": { + "packages": 390, + "openpgp": 0, + "bcrypt": 1, + "scrypt": 1, + "inspectorGo": "go1.26.5 windows/amd64", + "GOOS": "linux", + "GOARCH": "amd64", + "vendorMode": true, + "officialGo127SourceGatePassed": true, + "dependencyAndVendorGraphChangedFrom01440": false, + "cryptoModule": "v0.56.0", + "vendoredCryptoPackages": [ + "# golang.org/x/crypto v0.56.0", + "golang.org/x/crypto/bcrypt", + "golang.org/x/crypto/blowfish", + "golang.org/x/crypto/pbkdf2", + "golang.org/x/crypto/scrypt" + ], + "changedGoFiles": [ + "cataloglaunch/prepare.go", + "cataloglaunch/wire.go", + "cataloglaunch/wire_test.go" + ], + "wireHasOnlyStandardLibraryAndExistingNativeSdkImports": true, + "packageGraphSha256": "3557ce5497c33d06a6bad6dabd5eb08221efbde33d68140630aa2bde518522ce" + }, + "symbolEvidence": { + "emittedFunctions": 21993, + "functionAndInlineNameEntries": 26700, + "uniqueFunctionAndInlineNames": 26657, + "nonEmittedUniqueNames": 4706, + "openpgpEmitted": 0, + "openpgpFunctionInlineNames": 0, + "bcryptEmitted": 10, + "bcryptFunctionInlineNames": 11, + "bcryptNonEmittedNames": 1, + "scryptEmitted": 4, + "scryptFunctionInlineNames": 7, + "scryptNonEmittedNames": 3, + "tableDialect": "Linker funcnametab includes every emitted and inlined function name. Non-emitted names are not asserted to equal inline call-site count.", + "parserSha256": "ac4950908c4bbeeac05f390fae6139b83f6b4e6378eec7bb6d4bf677d734cced", + "fullCountProofSha256": "eff61dcf31d0c0dd2b44958c9f2470ce2cf71cfa7bcc22277a3e6e99d11c21d0" + }, + "linkerLayout": { + "sha256": "6562c101bb8555579af885b2ea016007d76db7fccf00de993ac0398e25cb0e99", + "goVersion": "go1.27.3", + "description": "generateFuncnametab includes every function and inlined function; genInlTreeSym stores nameOff from that same nameOffsets map.", + "officialSource": "Go1.27.3/src/cmd/link/internal/ld/pcln.go" + }, + "qualificationReceiptSha256": "a4674e7d593ffb9184bd04d8987e49b44455f4ea40ff8f2787ee4904244c5fd4", + "functionalTestsRun": 0, + "artifactRebuilt": false, + "moduleClaimedFixed": false +} diff --git a/server/security/test_scan_coverage.py b/server/security/test_scan_coverage.py index 93edf5ccaa..c6579a0fb6 100644 --- a/server/security/test_scan_coverage.py +++ b/server/security/test_scan_coverage.py @@ -1,5 +1,6 @@ import copy import hashlib +import json import re from pathlib import Path import tempfile @@ -128,6 +129,30 @@ def test_clean_null_vulnerabilities_need_no_exception(self): with tempfile.TemporaryDirectory() as folder: self.assertEqual(validate_vex_payloads(report, Path(folder)), 0) + def test_compose_openpgp_review_binds_exact_new_payload_and_positive_controls(self): + review = json.loads((Path(__file__).parent / 'reviews/compose-0.14.41-openpgp.json').read_bytes()) + scope, artifact = review['scope'], review['artifact'] + self.assertIn((scope['executable'], scope['module']), OPENPGP_VEX_SCOPE) + self.assertEqual(scope['advisory'], 'GO-2026-5932') + self.assertEqual(scope['decision'], 'not_affected') + self.assertEqual(scope['justification'], 'vulnerable_code_not_present') + self.assertFalse(scope['moduleDeclaredFixed']) + self.assertFalse(scope['newConsumerOrScopeAllowed']) + self.assertEqual(OPENPGP_VEX_BINARY_SHA256[scope['executable']], artifact['binarySha256']) + self.assertEqual(artifact['releaseVersion'], '0.14.41') + self.assertEqual(artifact['compiler'], 'go1.27.3') + self.assertTrue(artifact['releaseGzipAndOfficialTestedProductBytesIdentical']) + graph, symbols = review['sourceGraph'], review['symbolEvidence'] + self.assertTrue(graph['officialGo127SourceGatePassed']) + self.assertFalse(graph['dependencyAndVendorGraphChangedFrom01440']) + self.assertEqual(graph['openpgp'], 0) + self.assertEqual(symbols['openpgpEmitted'], 0) + self.assertEqual(symbols['openpgpFunctionInlineNames'], 0) + for prefix in ('bcrypt', 'scrypt'): + self.assertGreater(graph[prefix], 0) + self.assertGreater(symbols[prefix + 'Emitted'], 0) + self.assertGreater(symbols[prefix + 'FunctionInlineNames'], 0) + if __name__ == '__main__': unittest.main()