Lead with the VEX divergence — local scans show three findings the gate does not - #20
Merged
Conversation
…gate does not This is the only image in the fleet that suppresses anything, and the README described neither the suppressions nor the blocking gate. It still documented python:3.14-slim with 30 blocking findings and a warn-only gate, two base images out of date. The section now opens with the discrepancy a reader will actually hit: a plain `grype` run reports three high-severity CVEs while the gate reports zero and passes. It gives the exact command that reproduces the gate (--vex .vex/openvex.json), names all three CVEs and why the vulnerable code is unreachable, and states that they are superseded by CPython 3.15 so the document is temporary by construction. Measured against the published image while writing this: 12 findings total, 3 at high, 0 unsuppressed. Refs gitops PLAN.md item 11c, YouTrack GH-2.
Uh oh!
There was an error while loading. Please reload this page.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for freeto join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Documentation only — no workflow change. Tracked in YouTrack GH-2; governed by
gitopsPLAN.md item 11c.
This repo is not in scope for item 11a: the image is single-platform (
linux/amd64),so there is no second architecture to scan.
The problem
This is the only image in the fleet that suppresses anything, and the README documented
neither the suppressions nor the blocking gate. It still described
python:3.14-slimwith 30 blocking findings and a warn-only gate — two base images out of date.
The practical consequence: anyone scanning this image locally sees three high-severity
CVEs while the gate reports zero and passes. Nothing told them that was expected, or
how to reproduce what the gate actually sees. That reads like the gate is broken or the
image is unpatched, and neither is true.
The fix
The supply-chain section now opens with that discrepancy rather than burying it:
It names all three CVEs, states why the vulnerable code is unreachable, and records that
each is superseded by a named CPython release — so the document is temporary by
construction and there is a clear trigger to delete it (base reaches 3.15 stable).
Measured while writing this
Scanned the published image at
ghcr.io/kevinpinscoe/python-docker-fun:latestratherthan trusting the numbers already in PLAN.md:
--vex .vex/openvex.jsonAll three suppressions appear in grype's
ignoredMatchesunder rule namespacevex, sothey are genuinely VEX-driven and not simply absent.
This also confirmed something 11a depended on: the bare
pkg:oci/<name>productidentifier still matches when the scan target is a per-platform digest rather than a
manifest-list digest. Had it not, these three suppressions would have silently stopped
applying the moment per-platform scanning was introduced in the sibling repos.