Requalify the exact Compose payload for the existing OpenPGP decision

server/security/check_scan_coverage.py

@@ -28,7 +28,7 @@
     'usr/bin/authentication-service.real': 'e121cee8b7a6bd3c0eb6fe3e15ff304b78119b426642ed76f13e3d92be161192',
     'usr/bin/docker-machine': '8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c',
     'usr/bin/docker-machine-driver-packet': 'a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79',
-    'usr/bin/compose-executor.real': 'a5e5eaad64ac1938118c648546b63ee9e056ebea6d2a0f1618cb79ec0c3924cc',
+    'usr/bin/compose-executor.real': '56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa',
     'usr/bin/host-provisioner.real': '92c6d9ce1222a93802ff2c92b100eeb6c58286f3fca90698f9687b92d6fa9dff',
 }
 

server/security/openvex.json

@@ -2,8 +2,8 @@
   "@context": "https://openvex.dev/ns/v0.2.0",
   "@id": "https://github.com/PastureStack/server/security/openvex/v1.6.565",
   "author": "PastureStack Security",
-  "timestamp": "2026-11-01T17:19:43Z",
-  "version": 78,
+  "timestamp": "2026-11-01T17:40:13Z",
+  "version": 79,
   "statements": [
     {
       "vulnerability": {
@@ -350,7 +350,7 @@
       ],
       "status": "not_affected",
       "justification": "vulnerable_code_not_present",
-      "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The authentication-service 0.4.46 (v0.57.0) and machine-driver-bundle 0.16.6 (v0.58.0) release dependency graphs and source-mode/symbol govulncheck evidence contain no OpenPGP package import or reachable function, including both docker-machine and docker-machine-driver-packet. The compose-executor 0.14.40 v0.56.0 original binary has a qualified source package-graph gate and an inspected Go function/inline-name table with no OpenPGP code; maintained bcrypt/scrypt symbols provide positive controls. The host-provisioner v0.56.0 path is unchanged. Before applying this VEX, the publisher requires exact reviewed executable paths, module versions and binary SHA256 values; it rejects any new consumer or changed bytes. This is a code-absence decision, not a claim that the full crypto module is fixed."
+      "impact_statement": "GO-2026-5932 applies only to the unmaintained golang.org/x/crypto/openpgp packages. The authentication-service 0.4.46 (v0.57.0) and machine-driver-bundle 0.16.6 (v0.58.0) release dependency graphs and source-mode/symbol govulncheck evidence contain no OpenPGP package import or reachable function, including both docker-machine and docker-machine-driver-packet. The compose-executor 0.14.41 v0.56.0 original binary has a qualified source package-graph gate and an inspected Go function/inline-name table with no OpenPGP code; maintained bcrypt/scrypt symbols provide positive controls. The host-provisioner v0.56.0 path is unchanged. Before applying this VEX, the publisher requires exact reviewed executable paths, module versions and binary SHA256 values; it rejects any new consumer or changed bytes. This is a code-absence decision, not a claim that the full crypto module is fixed. The updated Compose payload is independently requalified in server/security/reviews/compose-0.14.41-openpgp.json; no consumer, module-version or executable-path scope is added."
     },
     {
       "vulnerability": {

server/security/reviews/compose-0.14.41-openpgp.json

@@ -0,0 +1,78 @@
+{
+  "format": "pasturestack-qualified-go-code-absence-v1",
+  "scope": {
+    "executable": "usr/bin/compose-executor.real",
+    "module": "pkg:golang/golang.org/x/crypto@v0.56.0",
+    "advisory": "GO-2026-5932",
+    "decision": "not_affected",
+    "justification": "vulnerable_code_not_present",
+    "moduleDeclaredFixed": false,
+    "newConsumerOrScopeAllowed": false
+  },
+  "artifact": {
+    "releaseVersion": "0.14.41",
+    "releaseGzipSha256": "a9f489651e1457beaf0e27e04d578ca4d0f66dd60998faa539a20f4da55b19d0",
+    "binarySha256": "56536af89e4c95865550c9debd4926249fd5926da5468130bddd46c1b51867fa",
+    "binaryBytes": 21729404,
+    "source": "ed3dbddda8a04522e6969fef12672bfb30f3d180",
+    "tree": "d6279b05f6e3ccc8f9ff28b1300979502f5079c8",
+    "officialCiArtifactZipSha256": "33b85bb0dfdd8dcf5225289dca817710d3de645c58e9acb3a224f133cab9b142",
+    "releaseGzipAndOfficialTestedProductBytesIdentical": true,
+    "compiler": "go1.27.3",
+    "binaryVcsRevisionEmbedded": false
+  },
+  "sourceGraph": {
+    "packages": 390,
+    "openpgp": 0,
+    "bcrypt": 1,
+    "scrypt": 1,
+    "inspectorGo": "go1.26.5 windows/amd64",
+    "GOOS": "linux",
+    "GOARCH": "amd64",
+    "vendorMode": true,
+    "officialGo127SourceGatePassed": true,
+    "dependencyAndVendorGraphChangedFrom01440": false,
+    "cryptoModule": "v0.56.0",
+    "vendoredCryptoPackages": [
+      "# golang.org/x/crypto v0.56.0",
+      "golang.org/x/crypto/bcrypt",
+      "golang.org/x/crypto/blowfish",
+      "golang.org/x/crypto/pbkdf2",
+      "golang.org/x/crypto/scrypt"
+    ],
+    "changedGoFiles": [
+      "cataloglaunch/prepare.go",
+      "cataloglaunch/wire.go",
+      "cataloglaunch/wire_test.go"
+    ],
+    "wireHasOnlyStandardLibraryAndExistingNativeSdkImports": true,
+    "packageGraphSha256": "3557ce5497c33d06a6bad6dabd5eb08221efbde33d68140630aa2bde518522ce"
+  },
+  "symbolEvidence": {
+    "emittedFunctions": 21993,
+    "functionAndInlineNameEntries": 26700,
+    "uniqueFunctionAndInlineNames": 26657,
+    "nonEmittedUniqueNames": 4706,
+    "openpgpEmitted": 0,
+    "openpgpFunctionInlineNames": 0,
+    "bcryptEmitted": 10,
+    "bcryptFunctionInlineNames": 11,
+    "bcryptNonEmittedNames": 1,
+    "scryptEmitted": 4,
+    "scryptFunctionInlineNames": 7,
+    "scryptNonEmittedNames": 3,
+    "tableDialect": "Linker funcnametab includes every emitted and inlined function name. Non-emitted names are not asserted to equal inline call-site count.",
+    "parserSha256": "ac4950908c4bbeeac05f390fae6139b83f6b4e6378eec7bb6d4bf677d734cced",
+    "fullCountProofSha256": "eff61dcf31d0c0dd2b44958c9f2470ce2cf71cfa7bcc22277a3e6e99d11c21d0"
+  },
+  "linkerLayout": {
+    "sha256": "6562c101bb8555579af885b2ea016007d76db7fccf00de993ac0398e25cb0e99",
+    "goVersion": "go1.27.3",
+    "description": "generateFuncnametab includes every function and inlined function; genInlTreeSym stores nameOff from that same nameOffsets map.",
+    "officialSource": "Go1.27.3/src/cmd/link/internal/ld/pcln.go"
+  },
+  "qualificationReceiptSha256": "a4674e7d593ffb9184bd04d8987e49b44455f4ea40ff8f2787ee4904244c5fd4",
+  "functionalTestsRun": 0,
+  "artifactRebuilt": false,
+  "moduleClaimedFixed": false
+}

server/security/test_scan_coverage.py

@@ -1,5 +1,6 @@
 import copy
 import hashlib
+import json
 import re
 from pathlib import Path
 import tempfile
@@ -128,6 +129,30 @@ def test_clean_null_vulnerabilities_need_no_exception(self):
         with tempfile.TemporaryDirectory() as folder:
             self.assertEqual(validate_vex_payloads(report, Path(folder)), 0)
 
+    def test_compose_openpgp_review_binds_exact_new_payload_and_positive_controls(self):
+        review = json.loads((Path(__file__).parent / 'reviews/compose-0.14.41-openpgp.json').read_bytes())
+        scope, artifact = review['scope'], review['artifact']
+        self.assertIn((scope['executable'], scope['module']), OPENPGP_VEX_SCOPE)
+        self.assertEqual(scope['advisory'], 'GO-2026-5932')
+        self.assertEqual(scope['decision'], 'not_affected')
+        self.assertEqual(scope['justification'], 'vulnerable_code_not_present')
+        self.assertFalse(scope['moduleDeclaredFixed'])
+        self.assertFalse(scope['newConsumerOrScopeAllowed'])
+        self.assertEqual(OPENPGP_VEX_BINARY_SHA256[scope['executable']], artifact['binarySha256'])
+        self.assertEqual(artifact['releaseVersion'], '0.14.41')
+        self.assertEqual(artifact['compiler'], 'go1.27.3')
+        self.assertTrue(artifact['releaseGzipAndOfficialTestedProductBytesIdentical'])
+        graph, symbols = review['sourceGraph'], review['symbolEvidence']
+        self.assertTrue(graph['officialGo127SourceGatePassed'])
+        self.assertFalse(graph['dependencyAndVendorGraphChangedFrom01440'])
+        self.assertEqual(graph['openpgp'], 0)
+        self.assertEqual(symbols['openpgpEmitted'], 0)
+        self.assertEqual(symbols['openpgpFunctionInlineNames'], 0)
+        for prefix in ('bcrypt', 'scrypt'):
+            self.assertGreater(graph[prefix], 0)
+            self.assertGreater(symbols[prefix + 'Emitted'], 0)
+            self.assertGreater(symbols[prefix + 'FunctionInlineNames'], 0)
+
 
 if __name__ == '__main__':
     unittest.main()