Publish release binaries govulncheck can assess - #37
Merged
Conversation
GoReleaser built with `-s`, which strips the symbol table, so `govulncheck -mode=binary` on a published asset cannot see which packages are actually linked and falls back to reporting every symbol an advisory names. The v0.8.4 assets therefore report GO-2026-5932 (the unmaintained `x/crypto/openpgp` packages) as affected, while the same check on an unstripped build of the same commit reports 0 affected — `golang.org/x/crypto/sha3`, pulled in by go-playground/validator, is the only x/crypto package in the graph. `-w` still drops DWARF, so the cost is ~16% on the raw binary and ~7% on the archive. In exchange the artifact carries its own reachability evidence, which is what our release-asset scan lane and Rancher's govulncheck-derived VEX automation both read. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
The source-mode govulncheck run says nothing about the artifacts we ship: it reads packages, not the linked binary, so it stays green whether or not the build strips its symbol table. Running it in binary mode over each prepared release binary closes that gap — it fails if `-s` returns to the ldflags, and it fails if a vulnerable package ever does become reachable from the shipped binary, including one reached only through the embedded toolchain. Both govulncheck invocations now share one pinned version. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
LouisLotter
reviewed
Aug 28, 2026
CVE-2026-56854 (GO-2026-6303) has no fix below v0.55.0, and Grype matches Go advisories against the binary's embedded module list regardless of which packages are linked, so the published assets report it even though golang.org/x/crypto/ssh is absent from the build graph. The coupled golang.org/x sibling bumps are what the module graph requires to resolve v0.55.0; no direct dependency or Go version changes. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Binary-mode govulncheck exiting non-zero on a stripped artifact depends on the current database matching one of its modules, so it proved nothing durable about assessability: once no advisory matches, a stripped binary passes and the release ships an artifact whose reachability cannot be judged. assert-go-symbols.sh requires runtime.main in each artifact's table, checked before govulncheck runs. Checking whether `go tool nm` merely succeeds is not enough — a stripped Mach-O still yields a readable table, so both darwin targets would pass on exit status alone. The test covers every target in .goreleaser.yml and uses a fixture no advisory matches, so a stripped binary is rejected for missing symbols rather than for being vulnerable. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
Dropping -s makes the release binaries assessable, but the Grype gate reports CVE-2026-56854 against golang.org/x/crypto v0.53.0 on the windows artifact regardless of stripping, so this branch cannot be green until the bump lands. Merged rather than waiting so the guard can be reviewed against a green run; the go.mod change is #38 and disappears from this diff once that merges. Co-authored-by: Cve Ticket Reconciler <cve-ticket-reconciler@stackstate.invalid>
LouisLotter
approved these changes
Aug 30, 2026
4 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
.goreleaser.ymlbuilt with-s, so the published binaries carry no symbol table andgovulncheck -mode=binarycannot tell which packages are linked. It therefore reports GO-2026-5932 (x/crypto/openpgp) as affected against every v0.8.4 asset, verified on the downloaded release archive. Dropping-s(keeping-w) turns that into 0 affected on an otherwise identical build of the same commit; the onlyx/cryptopackage in the graph issha3. Cost is ~7% archive size.The second commit adds the binary-mode run to the
securityjob, so a future-s, or a package that genuinely does become reachable, fails the release instead of shipping an artifact nobody can assess.scripts/assert-go-symbols.shthen asserts the symbol table directly, addressing review feedback that a non-zerogovulncheckexit only proves assessability while some advisory still matches one of the artifact's modules. It requiresruntime.mainper artifact, because a stripped Mach-O still yields a readable table — checking only whethergo tool nmsucceeds would pass both darwin targets.scripts/assert-go-symbols-test.shcovers all five.goreleaser.ymltargets in both directions against a fixture no advisory matches, and runs in thesecurityjob in about five seconds.Contains #38. The Grype gate reports
CVE-2026-56854(HIGH) againstgolang.org/x/cryptov0.53.0, whichmainalso carries, so this branch could not go green on its own. #38 is merged in rather than waiting for review; itsgo.mod/go.sumchange drops out of this diff once #38 lands.Tracking: https://github.com/StackVista/cve-reporter/issues/57
Finding revision:
sha256:e926258a2ef22a892e629f2143d9fc788f191bc85c96d214073d0c5891bd6170Validated locally:
go test ./...green, source and binary-mode govulncheck as described, cross-built all five targets, and the guard verified in both directions against the real five-target CLI matrix rather than only the fixture. Trivy vulnerability + separate secret scan and Grype over the packaged rootfs.