Retire the VEX-superseded agent CVE exceptions and repair the rest

exceptions/stackstate-k8s-agent/GO-2026-5932.yaml

@@ -10,18 +10,32 @@ component:
   paths:
   - opt/stackstate-agent/bin/agent/agent
   - opt/stackstate-agent/bin/installer/installer
-status: accepted_with_compensating_control
-reason: unpublished_image_vex_identity_bridge
-expires: '2026-09-04'
+status: not_affected
+reason: vulnerable_package_absent_from_command_dependency_graph
+expires: '2026-09-23'
 owner: "@StackVista/observability-team"
 upstream_owner: golang
 upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932
 statement: |
-  The affected openpgp and openpgp/clearsign packages are absent from this
-  binary's command dependency graph. StackVista/vexhub carries the reviewed
-  image-scoped not_affected statement, but Grype and Trivy match VEX products
-  by exact image digest or tag, and this gate scans a freshly built commit
-  image whose identity cannot exist in the VEX hub in advance. The same
-  bridge is already in place for stackstate-process-agent. Keep it only until
-  the scan pipeline can apply reviewed statements to unpublished images
-  without broadening them to every consumer of golang.org/x/crypto.
+  GO-2026-5932 declares golang.org/x/crypto/openpgp unmaintained and unsafe by
+  design. The advisory range is "introduced: 0" with no fixed event, so no
+  version of x/crypto clears it and there is no bump to wait for. The only
+  disposition available is reachability.
+
+  Re-verified 2026-09-09 on 158e1098 with the release build tag set: neither
+  `go list -deps ./cmd/agent` nor `./cmd/installer` contains any
+  golang.org/x/crypto/openpgp package. The scanners flag it anyway because a Go
+  binary SBOM records modules, not the packages actually linked.
+
+  The previous statement here claimed StackVista/vexhub carries a reviewed
+  image-scoped not_affected statement for this image and that the exception only
+  bridges a scan-time identity gap. That is wrong: vexhub carries GO-2026-5932
+  only for stackstate-k8s-process-agent and sts-opentelemetry-collector, and has
+  no statement for either agent image. Until a reviewed vexhub statement exists
+  this file is the only record of the disposition, which is why it is
+  not_affected rather than a bridge.
+
+  The gating chart scan in StackVista/cve-reporter does not surface this row --
+  its dev profile filters severity UNKNOWN -- so this exception is read only by
+  the in-repo report-only scan of the freshly built CI image. Tracked in
+  StackVista/stackstate-agent#509.

exceptions/stackstate-k8s-cluster-agent/GO-2026-5932.yaml

@@ -9,18 +9,31 @@ component:
   purl: pkg:golang/golang.org/x/crypto@v0.56.0
   paths:
   - opt/stackstate-agent/bin/stackstate-cluster-agent/stackstate-cluster-agent
-status: accepted_with_compensating_control
-reason: unpublished_image_vex_identity_bridge
-expires: '2026-09-04'
+status: not_affected
+reason: vulnerable_package_absent_from_command_dependency_graph
+expires: '2026-09-23'
 owner: "@StackVista/observability-team"
 upstream_owner: golang
 upstream_reference: https://pkg.go.dev/vuln/GO-2026-5932
 statement: |
-  The affected openpgp and openpgp/clearsign packages are absent from this
-  binary's command dependency graph. StackVista/vexhub carries the reviewed
-  image-scoped not_affected statement, but Grype and Trivy match VEX products
-  by exact image digest or tag, and this gate scans a freshly built commit
-  image whose identity cannot exist in the VEX hub in advance. The same
-  bridge is already in place for stackstate-process-agent. Keep it only until
-  the scan pipeline can apply reviewed statements to unpublished images
-  without broadening them to every consumer of golang.org/x/crypto.
+  GO-2026-5932 declares golang.org/x/crypto/openpgp unmaintained and unsafe by
+  design. The advisory range is "introduced: 0" with no fixed event, so no
+  version of x/crypto clears it and there is no bump to wait for. The only
+  disposition available is reachability.
+
+  Re-verified 2026-09-09 on 158e1098 with the release build tag set:
+  `go list -deps ./cmd/cluster-agent` contains no golang.org/x/crypto/openpgp
+  package. The scanners flag it anyway because a Go binary SBOM records modules,
+  not the packages actually linked.
+
+  The previous statement here claimed StackVista/vexhub carries a reviewed
+  image-scoped not_affected statement for this image. That is wrong: vexhub has
+  no document for stackstate-k8s-cluster-agent at all, and the 158e1098 Grype
+  report for this image contains no ignoredMatches, so no VEX applies to it.
+  Until a reviewed vexhub statement exists this file is the only record of the
+  disposition, which is why it is not_affected rather than an identity bridge.
+
+  The gating chart scan in StackVista/cve-reporter does not surface this row --
+  its dev profile filters severity UNKNOWN -- so this exception is read only by
+  the in-repo report-only scan of the freshly built CI image. Tracked in
+  StackVista/stackstate-agent#509.