.grype.yaml

# Grype vulnerability scanner configuration for gh-aw-firewall container images.
#
# This file is mounted into the grype container by the supply-chain-scan workflow
# so that known-accepted / unresolvable findings do not block every PR.
#
# Each entry must include a justification comment explaining:
#   1. Why the finding cannot be fixed in the image layer we control.
#   2. What the risk acceptance decision is and who should revisit it.
#
# Format reference: https://github.com/anchore/grype?tab=readme-ov-file#configuration

ignore:
  # ── grpc v1.81.1 embedded in gh CLI binary ───────────────────────────────────
  #
  # GHSA-hrxh-6v49-42gf (google.golang.org/grpc v1.81.1 -> 1.82.1, CRITICAL,
  # CVSS 9.1):
  #   Three server-side grpc-go issues: an xDS RBAC authorization bypass
  #   (fail-open on unsupported matchers), an HTTP/2 rapid-reset mitigation
  #   bypass (DoS), and a panic on crafted xDS RBAC policies.
  #
  #   Risk acceptance — NOT REACHABLE in our usage:
  #     grpc v1.81.1 is a transitive dependency compiled into the `gh` CLI
  #     binary. `gh` is a client: it does not run a gRPC server, use xDS RBAC,
  #     or accept HTTP/2 from untrusted peers, so none of the vulnerable code
  #     paths are exercised. The finding is present but not exploitable here.
  #   Present in the agent image (gh via the GitHub CLI apt repo) and the
  #   cli-proxy image (gh from the official release tarball).
  #
  #   No fix is shippable today: gh 2.96.0 (latest release as of 2026-07-23)
  #   still pins grpc v1.81.1, and building gh from unreleased trunk would ship
  #   an untagged, non-official binary (worse supply-chain risk than a
  #   non-reachable finding). The fix (grpc v1.82.1) is already merged on gh
  #   trunk, so the next tagged gh release will carry it.
  #   Revisit: once gh CLI >= v2.97.0 (grpc >= 1.82.1) is released, bump the
  #   `gh=` pin in agent/Dockerfile and cli-proxy/Dockerfile and DELETE this
  #   entry. Tracked in github/gh-aw-firewall.
  - vulnerability: GHSA-hrxh-6v49-42gf
    package:
      name: google.golang.org/grpc
      version: "v1.81.1"
      type: go-module

  # ── golang.org/x/text v0.38.0 embedded in gh CLI binary (agent image) ────────
  #
  # GO-2026-5970 / CVE-2026-56852 (golang.org/x/text v0.38.0 -> 0.39.0, HIGH):
  #   A norm.Iter can enter an infinite loop when handling input containing
  #   invalid UTF-8 bytes (denial of service).
  #
  #   Risk acceptance — BOUNDED DoS only, no other impact:
  #     x/text v0.38.0 is compiled into the `gh` CLI binary. In the agent image,
  #     `gh` is a client tool invoked by the agent; the worst-case outcome if
  #     invalid UTF-8 reaches gh's text-normalization path is a hang of that gh
  #     process — no privilege escalation, data exfiltration, or RCE vector.
  #   Scoped to /usr/bin/gh (agent image, installed via apt repo, gh=2.96.0).
  #
  #   No fix is shippable today: gh 2.96.0 (latest release as of 2026-07-24)
  #   still bundles x/text v0.38.0, and building gh from unreleased trunk would
  #   ship an untagged, non-official binary (worse supply-chain risk).
  #   Revisit: once a gh CLI release bundling x/text >= v0.39.0 is available,
  #   bump the `gh=` pin in agent/Dockerfile and DELETE this entry. Tracked in
  #   github/gh-aw-firewall.
  - vulnerability: GO-2026-5970
    package:
      name: golang.org/x/text
      version: "v0.38.0"
      type: go-module
      location: "/usr/bin/gh"

  # ── golang.org/x/text v0.38.0 embedded in gh CLI binary (cli-proxy image) ────
  #
  # GO-2026-5970 / CVE-2026-56852 (golang.org/x/text v0.38.0 -> 0.39.0, HIGH):
  #   A norm.Iter can enter an infinite loop when handling input containing
  #   invalid UTF-8 bytes (denial of service).
  #
  #   Risk acceptance — BOUNDED DoS only, mitigated by process timeout:
  #     x/text v0.38.0 is compiled into the `gh` CLI binary in the cli-proxy
  #     image. The cli-proxy server forwards agent-supplied args and
  #     base64-decoded stdin directly to `gh` (containers/cli-proxy/server.js,
  #     gh-runner.js). Any norm.Iter loop triggered by invalid UTF-8 in those
  #     inputs would be killed by the COMMAND_TIMEOUT_MS guard (default 30 s,
  #     gh-runner.js:5), bounding the impact to a single timed-out request.
  #     There is no privilege escalation, data exfiltration, or RCE vector —
  #     the vulnerability is DoS only.
  #   Scoped to /usr/local/bin/gh (cli-proxy image, installed from release
  #   tarball, gh=2.96.0).
  #
  #   No fix is shippable today: gh 2.96.0 (latest release as of 2026-07-24)
  #   still bundles x/text v0.38.0, and building gh from unreleased trunk would
  #   ship an untagged, non-official binary (worse supply-chain risk).
  #   Revisit: once a gh CLI release bundling x/text >= v0.39.0 is available,
  #   bump the GH_VERSION in cli-proxy/Dockerfile and DELETE this entry.
  #   Tracked in github/gh-aw-firewall.
  - vulnerability: GO-2026-5970
    package:
      name: golang.org/x/text
      version: "v0.38.0"
      type: go-module
      location: "/usr/local/bin/gh"

  # ── stdlib@go1.24.6 embedded in gosu binary ──────────────────────────────────
  #
  # GO-2026-4337 (stdlib go1.24.6 -> 1.24.13 / 1.25.7 / 1.26.0-rc.3, CRITICAL):
  #   During TLS session resumption, changes to ClientCAs or RootCAs between
  #   the original and resumed handshakes may be ignored, allowing a peer
  #   whose certificate is no longer trusted to resume the session.
  #
  #   Risk acceptance — NOT REACHABLE in gosu:
  #     gosu is a minimal setuid/exec privilege-drop binary (github.com/tianon/gosu
  #     v1.19.0). It accepts a user specification and a command, sets up credentials
  #     via setuid(2)/setgid(2), and calls execve(2). It contains no network code,
  #     opens no TLS connections, and never calls any crypto/tls function. The
  #     affected TLS resumption path is entirely unreachable in this binary.
  #     govulncheck analysis confirms: gosu does not import or exercise any
  #     crypto/tls code paths (upstream tracking: tianon/gosu#176).
  #
  #   No fix is shippable today:
  #     gosu 1.19.0 is the latest upstream release; no newer official release
  #     rebuilt with Go >= 1.24.13 exists as of 2026-07-27. Building gosu from
  #     unreleased source would ship an untagged, unofficial binary (worse
  #     supply-chain posture than accepting a non-reachable CVE finding).
  #
  #   Revisit: once a new official gosu release (> 1.19.0) built with Go >= 1.24.13
  #   is published, update the GOSU_VERSION pin and per-architecture SHA256
  #   checksums in containers/agent/Dockerfile and DELETE this entry.
  #   Tracked in github/gh-aw-firewall#6640.
  - vulnerability: GO-2026-4337
    package:
      name: stdlib
      version: "go1.24.6"
      type: go-module
      location: "/usr/local/bin/gosu"

  # ── brace-expansion bundled inside the vendored npm CLI ──────────────────────
  #
  # GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7 -> 5.0.8, HIGH):
  #   DoS via unbounded brace expansion length causing an out-of-memory crash.
  #
  #   Risk acceptance — BOUNDED DoS in a build-time CLI tool, no other impact:
  #     This brace-expansion is NOT an application dependency. The agent,
  #     api-proxy, and cli-proxy images all vendor the npm CLI (pinned
  #     npm@11.18.0, extracted into /usr/local/lib/node_modules/npm), and npm
  #     bundles brace-expansion inside its own node_modules. The sidecars build
  #     with `npm ci --omit=dev`, which prunes their app-level dev copies, so the
  #     only brace-expansion left in the runtime images is npm's bundled one.
  #     The worst case is that an `npm` invocation over a hostile brace pattern
  #     hangs/OOMs that npm process — no privilege escalation, data exfiltration,
  #     or RCE. npm is a trusted build tool here, not exposed to untrusted input.
  #
  #   No fix is shippable today: npm 11.18.0 is the latest npm release and still
  #   bundles brace-expansion <=5.0.7. brace-expansion 5.0.8 (the patched
  #   version) exists on the registry but no npm release ships it yet, and
  #   hand-patching npm's internal bundle would produce a non-official npm.
  #   Revisit: once an npm release bundling brace-expansion >= 5.0.8 is
  #   available, bump the npm pin (NPM_TGZ_URL / sha256) in agent/Dockerfile,
  #   api-proxy/Dockerfile, and cli-proxy/Dockerfile and DELETE this entry.
  #   Tracked in github/gh-aw-firewall.
  - vulnerability: GHSA-mh99-v99m-4gvg
    package:
      name: brace-expansion
      type: npm