feat(gate): scan every lockfile with osv-scanner #622

Merged

hexajon merged 1 commit from issue-587-osv-scanner-leg into main 2026-09-24 16:03:54 +00:00

Conversation 0 Commits 1 Files changed 12 +205 -13

hexajon commented 2026-09-24 16:03:52 +00:00

Owner

Copy link

Summary

The gate's heavy block now runs osv-scanner scan source -r --no-call-analysis=all ., pinned at v2.6.0 in scripts/setup-dev.sh and the ci.yml install step. It covers go.mod and the npm harness lockfile, and it reports a vulnerable version whether or not the code reaches it. govulncheck stays as the reachability check. The v2 flag takes a value, so it is --no-call-analysis=all; the bare --no-call-analysis . form would read . as that value.

This mode already found 6 real vulnerable Go versions that govulncheck missed; #620 upgraded them. The seventh, GO-2026-5932, flags golang.org/x/crypto/openpgp, a package madtea never builds. x/crypto is in go.mod only because the update signature check's ProtonMail library uses other packages from it. osv-scanner.toml ignores that one advisory with its reason. TestNoXCryptoOpenPGPInBuild fails if madtea ever builds x/crypto/openpgp, and #621 tracks removing the exception. ADR 0044 records the scan mode and the rule that every exception gets a record.

Checks:

• The local gate is green with the new leg.
• The CI install step and the leg ran in the job's pinned image: exit 0, "No issues found".
• The leg fails on the harness lockfile from before #581 (19 vulnerabilities) and without the ignore entry.
• The import test fails with a probe import of x/crypto/openpgp.

The docs that list the gate's analyzers now name osv-scanner.

Closes #587

Closes #587

## Summary The gate's heavy block now runs `osv-scanner scan source -r --no-call-analysis=all .`, pinned at v2.6.0 in `scripts/setup-dev.sh` and the `ci.yml` install step. It covers `go.mod` and the npm harness lockfile, and it reports a vulnerable version whether or not the code reaches it. govulncheck stays as the reachability check. The v2 flag takes a value, so it is `--no-call-analysis=all`; the bare `--no-call-analysis .` form would read `.` as that value. This mode already found 6 real vulnerable Go versions that govulncheck missed; #620 upgraded them. The seventh, GO-2026-5932, flags `golang.org/x/crypto/openpgp`, a package madtea never builds. `x/crypto` is in `go.mod` only because the update signature check's ProtonMail library uses other packages from it. `osv-scanner.toml` ignores that one advisory with its reason. `TestNoXCryptoOpenPGPInBuild` fails if madtea ever builds `x/crypto/openpgp`, and #621 tracks removing the exception. ADR 0044 records the scan mode and the rule that every exception gets a record. Checks: - The local gate is green with the new leg. - The CI install step and the leg ran in the job's pinned image: exit 0, "No issues found". - The leg fails on the harness lockfile from before #581 (19 vulnerabilities) and without the ignore entry. - The import test fails with a probe import of `x/crypto/openpgp`. The docs that list the gate's analyzers now name osv-scanner. Closes #587 Closes #587

hexajon added 1 commit 2026-09-24 16:03:52 +00:00

feat(gate): scan every lockfile with osv-scanner ... 1c9eea63ca

Closes #587

hexajon merged commit 1c9eea63ca into main 2026-09-24 16:03:54 +00:00

Sign in to join this conversation.

Reviewers

No reviewers

Labels

Clear labels   

breaking

Breaking change - flag for release notes

  

bug

Something is not working

  

documentation

Documentation only

  

enhancement

New feature

  

epic

Tracking epic with dependency children

  

good first issue

Interested in contributing? Get started here.

  

help wanted

Maintainer would welcome outside help

  

refactoring

Code restructuring without behavior changes

  

resolution/duplicate

Closed as duplicate of another issue

  

resolution/invalid

Closed as invalid or not reproducible

  

resolution/wontfix

Closed as won't fix

  

security

Security issue or hardening

  

severity/critical

Security severity: critical

  

severity/high

Security severity: high

  

severity/low

Security severity: low

  

severity/medium

Security severity: medium

  

status/abandoned

Someone started, then walked away - up for grabs

  

status/blocked

Blocked by another issue or an external dependency

  

status/needs-decision

Waiting on a maintainer decision; workable once decided

  

status/needs-info

Waiting on reporter / more information before work can start

  

status/needs-verification

Done except verification in a live interactive session

  

testing

Test suite / CI infrastructure work

  

upstream

Related to an upstream repository, already reported there

No labels

breaking

bug

documentation

enhancement

epic

good first issue

help wanted

refactoring

resolution/duplicate

resolution/invalid

resolution/wontfix

security

severity/critical

severity/high

severity/low

severity/medium

status/abandoned

status/blocked

status/needs-decision

status/needs-info

status/needs-verification

testing

upstream

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

sixfold-space/madtea!622

No description provided.