Skip to content

PPD-1612: Build vCluster FIPS 140-3 images - #18

Open
sadath-12 wants to merge 8 commits into
v0.27from
PPD-1612
Open

PPD-1612: Build vCluster FIPS 140-3 images#18
sadath-12 wants to merge 8 commits into
v0.27from
PPD-1612

Conversation

@sadath-12

@sadath-12 sadath-12 commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

What

Adds the FIPS 140-3 build recipes for the vCluster image set under fips/.

File Purpose
Dockerfile.syncfips Syncer built with the Go Cryptographic Module v1.0.0 (GOFIPS140=v1.0.0, NIST CMVP cert #4985)
Dockerfile.coredns CoreDNS built with GOFIPS140
Dockerfile.hpm vcluster-hostpath-mapper built with GOFIPS140
Dockerfile.upsync container-resource-upsync-plugin built with GOFIPS140 when CRYPTO_LIB is set
Dockerfile.etcd Rebases ghcr.io/loft-sh/etcd-fips onto a glibc base
vcluster.yaml Reference values wiring the FIPS image set together

Notes

  • FIPS mode is enforced at runtime via GODEBUG=fips140=on. The non-FIPS palette image continues to build from Dockerfile.release, so there is no CRYPTO_LIB dual-mode in the syncer recipe.
  • kine and helm come from the Spectro third-party carriers, which are also GOFIPS140 builds.
  • The syncer runtime base installs gcompat: the loft-sh kubernetes:*-fips distro binaries that the syncer exec's are dynamically linked against glibc.
  • Dockerfile.etcd exists because upstream loft-sh/etcd-fips ships a CGO-linked binary on scratch — no ELF loader and no libc, so it cannot exec (exec /bin/etcd: no such file or directory). This affects every published tag from v3.5.23 to v3.6.10, so a tag bump does not help. Verified working in-cluster after the rebase.
  • Dockerfile.upsync uses COPY . . rather than cloning its source, so unlike the coredns and hpm recipes it builds only from a vcluster-container-resource-upsync-plugin checkout as context. The copy here is the reference; the authoritative file still needs to land in spectrocloud-labs/vcluster-container-resource-upsync-plugin.

Testing

Deployed on sadath-aws-2 with backingStore.etcd.deploy.enabled=true. etcd reaches leader and serves TLS client traffic, the syncer comes up, hostpath-mapper and CoreDNS run, and a StatefulSet in the vCluster gets its /etc/hosts rewritten correctly.

Ticket: https://spectrocloud.atlassian.net/browse/PPD-1612
Epic: https://spectrocloud.atlassian.net/browse/PPD-1597

@sadath-12
PPD-1612: Build vCluster FIPS 140-3 images
f333b7b 
Add the FIPS 140-3 build recipes for the vcluster image set under fips/.

  Dockerfile.syncfips - syncer built with the Go Cryptographic Module
                        v1.0.0 (GOFIPS140=v1.0.0, NIST CMVP cert #4985),
                        FIPS mode enforced at runtime via
                        GODEBUG=fips140=on. kine and helm come from the
                        Spectro third-party carriers, which are also
                        GOFIPS140 builds. The runtime base installs
                        gcompat, since the loft-sh kubernetes -fips distro
                        binaries the syncer exec's are dynamically linked
                        against glibc.
  Dockerfile.coredns  - CoreDNS built with GOFIPS140
  Dockerfile.hpm      - vcluster-hostpath-mapper built with GOFIPS140
  Dockerfile.etcd     - rebases ghcr.io/loft-sh/etcd-fips onto a glibc
                        base; upstream ships a CGO-linked binary on
                        scratch, which has no ELF loader and cannot exec
  vcluster.yaml       - reference values wiring the FIPS image set together

Ticket: https://spectrocloud.atlassian.net/browse/PPD-1612
Epic:   https://spectrocloud.atlassian.net/browse/PPD-1597
bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 3, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      2. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls middleware.Insert
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
  2. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.Verify
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls copy.doCompression
      3. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      4. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  3. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  4. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls certs.generateCertificates
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      5. pkg/kubeadm/config.go:6:2: kubeadm.init calls config.init, which eventually calls config.init
  5. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      3. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      4. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls grpc.createTransport
      5. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
  7. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  8. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  9. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      3. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  10. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 3, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      3. pkg/snapshot/s3/store.go:192:36: s3.Init calls s3.NewPresignClient, which eventually calls v4.NewSigner
      4. pkg/cli/start/docker.go:397:30: start.Error calls types.Error, which eventually calls start.Error
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
  3. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      5. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
  4. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls v1beta4.Convert_kubeadm_InitConfiguration_To_v1beta4_InitConfiguration
      5. pkg/certs/ensure.go:459:39: certs.BuildKubeConfig calls kubeconfig.CreateWithCerts, which eventually calls certs.BuildKubeConfig
  5. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.reader
      2. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.newHTTP2Transport
      2. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls grpc.createTransport
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      5. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
  7. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      2. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      3. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
  8. GO-2026-4762
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.79.3
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  9. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  10. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-4945
  • Module: github.com/go-jose/go-jose/v4
  • Found in: v4.0.5
  • Fixed in: v4.1.4
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
    5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleFinalize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      3. pkg/cli/start/docker.go:397:30: start.Error calls types.Error, which eventually calls start.Error
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls checksum.HandleInitialize
      5. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.GetObject
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      3. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls certs.CreateTree
      4. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls certs.validateSignedCertWithCA
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  3. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      2. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
      5. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
  4. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls selfupdate.init
      2. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      5. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
  5. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls grpc.createTransport
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
  7. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  8. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
  9. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  10. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    2. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode

Please review these findings and fix the issues before merging.

@sadath-12 @cursoragent
PPD-1612: Remove obsolete etcd FIPS Dockerfile
8b74e17 
Co-authored-by: Cursor <cursoragent@cursor.com>
bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      2. pkg/snapshot/s3/config.go:81:39: s3.Build calls config.LoadDefaultConfig, which eventually calls retry.NewStandard
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls http.IdentityResolver
      4. pkg/snapshot/s3/config.go:14:2: s3.init calls s3.init, which eventually calls s3.init
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
      2. pkg/cli/start/docker.go:397:30: start.Error calls componentconfigs.Error, which eventually calls start.Error
      3. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls pkiutil.GetAPIServerAltNames
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/syncer/testing/testing.go:63:71: testing.Setup calls v1beta4.DeepCopyObject, which eventually calls testing.Setup
  3. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      3. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls lzma.init$1
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  4. GO-2026-5026
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.55.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  5. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      2. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
  7. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
  8. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  9. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  10. GO-2026-4550
  • Module: github.com/cloudflare/circl
  • Found in: v1.6.1
  • Fixed in: v1.6.3
  • Example Traces:
    1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
    3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
    5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/store.go:275:31: s3.PutObject calls manager.Upload, which eventually calls manager.send
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Insert
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
  3. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  4. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
      2. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      3. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  5. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  6. GO-2026-5026
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.55.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  7. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  8. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  9. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.newStream
      3. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.newHTTP2Transport
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
  10. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-4945
  • Module: github.com/go-jose/go-jose/v4
  • Found in: v4.0.5
  • Fixed in: v4.1.4
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls grpc.createTransport
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls config.DefaultedStaticInitConfiguration
      2. pkg/syncer/testing/testing.go:63:71: testing.Setup calls v1alpha3.DeepCopyObject, which eventually calls testing.Setup
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  3. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls customizations.GetIdentity
      2. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      3. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.GetObject
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
  4. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      3. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
      4. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
      5. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
  5. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  6. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  7. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      2. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.UnmarshalBinary
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      5. pkg/upgrade/upgrade.go:141:25: upgrade.Upgrade calls selfupdate.UpdateTo, which eventually calls selfupdate.UncompressCommand
  8. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
  9. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  10. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    4. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      5. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
  2. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
  3. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. cmd/vclusterctl/cmd/token/create.go:20:2: token.init calls v1beta4.init, which eventually calls token.init
      4. pkg/kubeadm/config.go:5:2: kubeadm.init calls kubeadm.init, which eventually calls kubeadm.init
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  4. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      2. pkg/cli/start/docker.go:397:30: start.Error calls types.Error, which eventually calls start.Error
      3. pkg/snapshot/s3/store.go:318:36: s3.List calls s3.NextPage, which eventually calls s3.List
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
  5. GO-2026-5880
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.2
    • Example Traces:
      1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  6. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      2. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  7. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  8. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  9. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      5. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
  10. GO-2025-3922
  • Module: github.com/ulikunitz/xz
  • Found in: v0.5.12
  • Fixed in: v0.5.15
  • Example Traces:
    1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.UnmarshalBinary
    2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.newStreamReader
    3. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
    4. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.readIndexBody
    5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  1. GO-2026-6061
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.82.1
  • Example Traces:
    1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
    2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
    3. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.addConn
    4. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
    5. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls checksum.HandleInitialize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
  2. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      2. pkg/snapshot/pod/pod.go:170:2: pod.RunSnapshotPod calls otelhttp.Close, which eventually calls otelhttp.Close
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.newTracer
  3. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls certs.CheckCertificatePeriodValidity
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/certs/ensure.go:32:2: certs.init calls certs.init, which eventually calls certs.init
  4. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      2. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      4. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      5. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.ReadAll
  5. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  6. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      3. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  7. GO-2026-5884
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  8. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  9. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
  10. GO-2026-6061
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.82.1
  • Example Traces:
    1. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
    2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
    3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
    4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
    5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  2. GO-2026-5885
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  3. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      3. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      4. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
  4. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      3. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.GetObject
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls checksum.HandleInitialize
      5. pkg/snapshot/s3/config.go:81:39: s3.Build calls config.LoadDefaultConfig, which eventually calls v4.NewSigner
  5. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  6. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  7. GO-2026-5880
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.2
    • Example Traces:
      1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  8. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
  9. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls compression.xzCompressor
      3. pkg/upgrade/upgrade.go:141:25: upgrade.Upgrade calls selfupdate.UpdateTo, which eventually calls selfupdate.UncompressCommand
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      5. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
  10. GO-2026-4394
  • Module: go.opentelemetry.io/otel/sdk
  • Found in: v1.34.0
  • Fixed in: v1.40.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.newTracer
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
    3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
    4. pkg/snapshot/pod/pod.go:170:2: pod.RunSnapshotPod calls otelhttp.Close, which eventually calls otelhttp.Close
    5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  1. GO-2026-4550
  • Module: github.com/cloudflare/circl
  • Found in: v1.6.1
  • Fixed in: v1.6.3
  • Example Traces:
    1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
    2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
    4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
    5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
  1. GO-2026-4945
  • Module: github.com/go-jose/go-jose/v4
  • Found in: v4.0.5
  • Fixed in: v4.1.4
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
    5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot previously requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/store.go:318:36: s3.List calls s3.NextPage, which eventually calls s3.List
      2. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.HandleFinalize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      4. pkg/snapshot/s3/store.go:275:31: s3.PutObject calls manager.Upload, which eventually calls manager.complete
      5. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls middleware.Insert
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls v1beta3.SetDefaults_BootstrapTokens
  3. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/upgrade/upgrade.go:141:25: upgrade.Upgrade calls selfupdate.UpdateTo, which eventually calls selfupdate.UncompressCommand
      2. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
      3. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls lzma.WriteByte
      5. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.newStreamReader
  4. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  5. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.newStream
  7. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
  8. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls tracing.init
      2. pkg/snapshot/pod/pod.go:170:2: pod.RunSnapshotPod calls otelhttp.Close, which eventually calls otelhttp.Close
      3. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
  9. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  10. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-4550
  • Module: github.com/cloudflare/circl
  • Found in: v1.6.1
  • Fixed in: v1.6.3
  • Example Traces:
    1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    3. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    4. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot previously requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.reader
      3. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      5. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      4. pkg/snapshot/s3/store.go:144:35: s3.Init calls s3.newS3Client, which eventually calls s3.newS3Client
      5. pkg/snapshot/s3/store.go:317:28: s3.List calls s3.HasMorePages, which eventually calls s3.List
  3. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  4. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  5. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
      4. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
      5. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
  6. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
  7. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      2. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.newHTTP2Transport
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      4. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.addConn
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
  8. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      2. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      4. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
  9. GO-2026-5885
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  10. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-4945
  • Module: github.com/go-jose/go-jose/v4
  • Found in: v4.0.5
  • Fixed in: v4.1.4
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr

Please review these findings and fix the issues before merging.

@bulwark-sc-ent
bulwark-sc-ent Bot dismissed stale reviews from themself August 6, 2026 18:03

Changes have been made to address the security findings.

shubhamrajvanshi
shubhamrajvanshi reviewed Aug 6, 2026
View reviewed changes

@shubhamrajvanshi shubhamrajvanshi left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inline comments cover the important items — most notably the malformed vcluster-oss image reference (embedded tag in repository), the upsync version + registry drift between Makefile and vcluster.yaml, the missing ENTRYPOINT in Dockerfile.upsync, the empty kube-proxy image:, the TELEMETRY_PRIVATE_KEY build arg, and shell-hardening on verify-all. Happy to pair on any of these.

Comment thread fips/vcluster.yaml
registry: "us-docker.pkg.dev"
# Configure the repository of the container image, e.g. my-repo/my-image.
# It defaults to the vCluster pro repository that includes the optional pro modules that are turned off by default.
# If you still want to use the pure OSS build, use 'loft-sh/vcluster-oss' instead.

@shubhamrajvanshi shubhamrajvanshi Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [important] Invalid image reference — repository has an embedded tag.

The chart concatenates registry/repository:tag, so this resolves to us-docker.pkg.dev/palette-images-fips/third-party/vcluster-oss:0.27.3:0.27.3 (double :0.27.3), which is a malformed image reference.

Either drop :0.27.3 from repository (palette-images-fips/third-party/vcluster-oss) or drop the tag: line below.

Comment thread fips/Makefile
COREDNS_VERSION ?= 1.14.6
# hostpath-mapper: upstream's latest tag; v0.2.7 == main HEAD.
HPM_VERSION ?= 0.2.7
UPSYNC_VERSION ?= v0.0.7

@shubhamrajvanshi shubhamrajvanshi Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [important] Version drift with reference values.

vcluster.yaml references vcluster-upsync-plugin:v0.0.9-fips140-3, but UPSYNC_VERSION ?= v0.0.7 here. make build-upsync will not produce the tag the reference values file consumes. Please bump this default (to v0.0.9 if that's the shipping tag) so the Makefile and vcluster.yaml stay in sync.

Comment thread fips/Makefile
Comment on lines +22 to +23
REGISTRY ?= us-east1-docker.pkg.dev
IMAGE_PREFIX ?= spectro-images/dev/syedsadathulla

@shubhamrajvanshi shubhamrajvanshi Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [important] Registry / prefix defaults don't match vcluster.yaml.

vcluster.yaml everywhere points at us-docker.pkg.dev/palette-images-fips/... (prod), but the Makefile default publishes to us-east1-docker.pkg.dev/spectro-images/dev/syedsadathulla — a personal dev namespace in a different region. That means running make build-all && make push-all with defaults does not produce the images vcluster.yaml references.

Also, shipping a personal username (syedsadathulla) as the repo-level default isn't great — teammates copy defaults. Suggest defaulting REGISTRY/IMAGE_PREFIX to the team/product path used in vcluster.yaml, and documenting the personal-dev override in a comment.

Comment thread fips/Dockerfile.upsync

RUN mkdir -p /plugin

COPY --from=builder /plugin /plugin/plugin

@shubhamrajvanshi shubhamrajvanshi Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [important] No ENTRYPOINT / CMD.

Unlike Dockerfile.hpm and Dockerfile.syncfips, this recipe never declares how the container starts. The vcluster plugin loader may exec /plugin/plugin by convention (the yaml has no command: override), so this can happen to work — but running the image directly (or under any non-vcluster runtime) will fail, and it diverges from the sibling recipes.

Suggest adding ENTRYPOINT ["/plugin/plugin"] to make the container self-describing.

Comment thread fips/vcluster.yaml
# Enabled defines if the kube proxy should be enabled.
enabled: true
# Image is the image for the kube-proxy.
image: ""

@shubhamrajvanshi shubhamrajvanshi Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [important] kubeProxy.enabled: true with an empty image: may pull a non-FIPS binary.

An empty image falls back to the chart default, which is not guaranteed to be a palette-images-fips build. For a FIPS reference values file this leaks a non-FIPS kube-proxy into the control plane and breaks the CMVP posture the rest of this PR is going after.

Either pin to the FIPS-hardened kube-proxy tag, or disable kube-proxy here and document why.

Comment thread fips/Dockerfile.syncfips
ARG TARGETOS
ARG TARGETARCH
ARG BUILD_VERSION=0.0.1
ARG TELEMETRY_PRIVATE_KEY=""

@shubhamrajvanshi shubhamrajvanshi Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [important] TELEMETRY_PRIVATE_KEY is baked into the image via -ldflags.

If this ARG is ever populated in a CI job that publishes the image, the key ends up in a build layer, in the compiled binary (via -X ...telemetryPrivateKey=), and in docker history. Please confirm the release pipeline never sets it on public builds, and consider a comment near this ARG documenting that it must remain empty for anything pushed to a shared registry — a subtle mis-wire in a Jenkins job would exfiltrate the secret irreversibly.

Comment thread fips/Makefile

.PHONY: verify-all
verify-all: ## Assert each shipped binary is a GOFIPS140 build (works on distroless)
@rc=0; tmp=$$(mktemp -d); trap 'rm -rf "$$tmp"' EXIT; \

@shubhamrajvanshi shubhamrajvanshi Aug 6, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟡 [important] verify-all recipe body should use set -euo pipefail.

The loop already tracks rc manually, but without set -euo pipefail at the top of the recipe body, a mid-loop shell failure (e.g. a broken $(mktemp), a trap that fires unexpectedly, an unset var expansion) can silently return success. For a target whose entire purpose is asserting FIPS compliance, a silent green is the worst failure mode — please harden the shell so unexpected errors surface loudly.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shubhamrajvanshi shubhamrajvanshi shubhamrajvanshi left review comments
@bulwark-sc-ent bulwark-sc-ent[bot] bulwark-sc-ent[bot] requested changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sadath-12 @shubhamrajvanshi