akanealw/Charon
1
0
Fork 0
Code Issues Pull Requests Actions 15 Packages Projects Releases Wiki Activity

fix: update dependencies in go.work.sum for improved compatibility and performance

Browse Source
This commit is contained in:
GitHub Actions
2026-03-19 17:59:00 +00:00
parent 262a805317
commit 9f826f764c
2 changed files with 207 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

192
docs/reports/qa_report.md
View File

@@ -281,3 +281,195 @@ Clears the npm package cache between the global npm upgrade and the `npm ci` run
None.
---
# Supply Chain Security Scan Report — CVE Investigation
**Date**: 2026-03-19
**Scope**: Charon project at `/projects/Charon`
**Tools**: Grype 0.109.1, Syft 1.42.2
**Go Toolchain**: go1.26.1
---
## Executive Summary
The CVEs flagged for `goxmldsig`, `buger/jsonparser`, and `jackc/pgproto3/v2` are **false positives for the Charon project**. These packages are not in Charon's Go module dependency graph. They originate from Go build info embedded in third-party compiled binaries shipped inside the Docker image — specifically the CrowdSec and Caddy binaries.
`CVE-2026-33186` (`google.golang.org/grpc`) is **resolved in Charon's own source code** (bumped to v1.79.3), but the same CVE still appears in the SBOM because older grpc versions are embedded in the CrowdSec (`v1.74.2`) and Caddy (`v1.79.1`) binaries in the Docker image. Those are out-of-scope for Charon to patch directly.
The most actionable findings are stale compiled Charon binaries built with go1.25.4–go1.25.6 that carry Critical/High stdlib CVEs and should be rebuilt with the current go1.26.1 toolchain.
---
## 1. Root Cause: Why These Packages Appear in Scans
### Mechanism: go-module-binary-cataloger
When Syft generates the SBOM from the Docker image (not from source), it uses the **`go-module-binary-cataloger`** to read embedded Go build info from all compiled Go binaries in the image. Every Go binary compiled since Go 1.18 embeds a complete list of its upstream module dependencies via `debug/buildinfo`.
This means Syft finds packages from *any* Go binary on the image filesystem — including third-party tools like CrowdSec and Caddy — and reports them as if they were Charon dependencies.
### Confirmed Binary Sources
| Package | Version | Binary Path | Binary's Main Module |
|---|---|---|---|
| `github.com/buger/jsonparser` | v1.1.1 | `/usr/local/bin/crowdsec`, `/usr/local/bin/cscli` | `github.com/crowdsecurity/crowdsec` |
| `github.com/jackc/pgproto3/v2` | v2.3.3 | `/usr/local/bin/crowdsec`, `/usr/local/bin/cscli` | `github.com/crowdsecurity/crowdsec` |
| `github.com/russellhaering/goxmldsig` | v1.5.0 | `/usr/bin/caddy` | `caddy` |
| `google.golang.org/grpc` | v1.74.2 | `/usr/local/bin/crowdsec`, `/usr/local/bin/cscli` | `github.com/crowdsecurity/crowdsec` |
| `google.golang.org/grpc` | v1.79.1 | `/usr/bin/caddy` | `caddy` |
**Verification**: None of these packages appear in `backend/go.mod`, `backend/go.sum`, or the output of `go mod graph`.
### Why `grype dir:.` Flags Module Cache Artifacts
Running `grype dir:.` over the Charon workspace also scans `.cache/go/pkg/mod/` — the local Go module download cache. This directory contains the `go.mod` files of every transitively downloaded module. Grype reads those `go.mod` files and flags vulnerable version references within them, even though those versions are not compiled into the Charon binary. All module-cache findings have locations beginning with `/.cache/go/pkg/mod/` and are not exploitable in Charon.
### Stale SBOM: `sbom-generated.json`
`sbom-generated.json` (dated **2026-02-21**) was generated by an earlier workflow before the grpc bump and uses a format with no version or PURL data. Grype reading this file matches vulnerabilities against package names alone with no version filter, inflating findings. The authoritative SBOM is `sbom.cyclonedx.json` (dated **2026-03-18**, generated by Syft 1.42.2).
---
## 2. CVE-by-CVE Status
### CVE-2026-33186 — `google.golang.org/grpc`
| Aspect | Detail |
|---|---|
| **Charon source (backend/go.mod)** | v1.79.3 — **PATCHED** ✓ |
| **CrowdSec binary (`/usr/local/bin/crowdsec`)** | v1.74.2 — out of scope |
| **Caddy binary (`/usr/bin/caddy`)** | v1.79.1 — out of scope |
| **False positive for Charon?** | Partially — Charon's own code is patched. SBOM findings persist from Docker image binaries. |
**Remediation**: Upgrade the CrowdSec and Caddy Docker image versions. The fix in Charon's source is complete.
---
### GHSA-479m-364c-43vc — `github.com/russellhaering/goxmldsig` v1.5.0
| Aspect | Detail |
|---|---|
| **In Charon go.mod / go.sum** | No |
| **In go mod graph** | No |
| **Source** | `/usr/bin/caddy` binary in Docker image |
| **False positive for Charon?** | **Yes** |
**Remediation**: Requires upgrading the Caddy Docker image tag. Track upstream Caddy release notes for a patched `goxmldsig` dependency.
---
### GHSA-6g7g-w4f8-9c9x — `github.com/buger/jsonparser` v1.1.1
| Aspect | Detail |
|---|---|
| **In Charon go.mod / go.sum** | No |
| **In go mod graph** | No |
| **Source** | `/usr/local/bin/crowdsec` and `/usr/local/bin/cscli` in Docker image |
| **False positive for Charon?** | **Yes** |
**Remediation**: Requires upgrading the CrowdSec Docker image tag.
---
### GHSA-jqcq-xjh3-6g23 — `github.com/jackc/pgproto3/v2` v2.3.3
| Aspect | Detail |
|---|---|
| **In Charon go.mod / go.sum** | No |
| **In go mod graph** | No |
| **Source** | `/usr/local/bin/crowdsec` and `/usr/local/bin/cscli` in Docker image |
| **False positive for Charon?** | **Yes** |
**Remediation**: Requires upgrading the CrowdSec Docker image tag.
---
## 3. Actionable Findings
### 3.1 Stdlib CVEs in Stale Charon Binaries (Critical/High)
Grype found Charon binaries on-disk compiled with old Go versions. The current toolchain is **go1.26.1**, which patches all of the following.
| Binary | Go Version | Notable CVEs |
|---|---|---|
| `.trivy_logs/charon_binary` | go1.25.4 (Nov 2025 artifact) | CVE-2025-68121 (Critical), CVE-2025-61726/29/31/32 (High) |
| `backend/bin/charon`, `backend/bin/api`, `backend/bin/charon-debug` | go1.25.6 | CVE-2025-68121 (Critical), CVE-2025-61732 (High), CVE-2026-25679 (High) |
| `backend/api` (root-level) | go1.25.7 | CVE-2026-25679 (High), CVE-2026-27142 (Medium) |
**CVE-2025-68121** (Critical, Go stdlib) is the single highest-severity finding in this report.
**Remediation**: Rebuild all binaries with go1.26.1. Delete `.trivy_logs/charon_binary` (stale Nov 2025 artifact) or add `.trivy_logs/` to `.gitignore`.
---
### 3.2 Python Virtual Environment Packages (Dev Tooling Only)
Local `.venv` directories contain outdated packages. These are not shipped in the Docker image.
| Severity | ID | Package | Fix |
|---|---|---|---|
| High | GHSA-8rrh-rw8j-w5fx | wheel 0.45.1 | `pip install --upgrade wheel` |
| High | GHSA-58pv-8j8x-9vj2 | jaraco-context 5.3.0 | `pip install --upgrade setuptools` |
| Medium | GHSA-597g-3phw-6986 | virtualenv 20.35.4 | `pip install --upgrade virtualenv` |
| Medium | GHSA-qmgc-5h2g-mvrw / GHSA-w853-jp5j-5j7f | filelock 3.20.0 | `pip install --upgrade filelock` |
| Low | GHSA-6vgw-5pg2-w6jp | pip 24.0 / 25.3 | `pip install --upgrade pip` |
---
### 3.3 Module Cache False Positives (All Confirmed Non-Exploitable)
Flagged solely because they appear in `go.mod` files inside `.cache/go/pkg/mod/`, not in any compiled Charon binary:
| ID | Package | Flagged Version | Cache Source | Actual Charon Version |
|---|---|---|---|---|
| GHSA-p77j-4mvh-x3m3 (Critical) | google.golang.org/grpc | v1.67.0 | `containerd/errdefs/go.mod` | v1.79.3 |
| GHSA-9h8m-3fm2-qjrq (High) | go.opentelemetry.io/otel/sdk | v1.38.0 | `otelhttp@v0.63.0/go.mod` | v1.42.0 |
| GHSA-47m2-4cr7-mhcw (High) | github.com/quic-go/quic-go | v0.54.0 | `gin-gonic/gin@v1.11.0/go.mod` | not a direct dep |
| GHSA-hcg3-q754-cr77 (High) | golang.org/x/crypto | v0.26.0 | `quic-go@v0.54.1/go.mod` | v0.46.0 |
| GHSA-cxww-7g56-2vh6 (High) | actions/download-artifact | v4 | `docker/docker` GH workflows in cache | N/A |
---
## 4. Scan Configuration Recommendations
### Exclude Go Module Cache from `grype dir:.`
Create `.grype.yaml` at project root:
```yaml
ignore:
- package:
location: "**/.cache/**"
- package:
location: "**/node_modules/**"
```
Alternatively, scan the SBOM directly rather than the filesystem: `grype sbom:sbom.cyclonedx.json`.
### Regenerate or Remove `sbom-generated.json`
`sbom-generated.json` (Feb 21 2026) contains packages with no version or PURL data, causing name-only vulnerability matching. Delete it or regenerate with: `syft scan dir:. -o cyclonedx-json > sbom-generated.json`.
### Delete or Gitignore `.trivy_logs/charon_binary`
The 23MB stale binary `.trivy_logs/charon_binary` (go1.25.4, Nov 2025) is a Trivy scan artifact causing several Critical/High CVE findings. Add `.trivy_logs/*.binary` or the whole `.trivy_logs/` directory to `.gitignore`.
---
## 5. Summary
| # | Finding | Severity | False Positive? | Action Required |
|---|---|---|---|---|
| 1 | CVE-2025-68121 in `.trivy_logs/charon_binary` + `backend/bin/*` | **Critical** | No | Rebuild binaries with go1.26.1; delete stale `.trivy_logs/charon_binary` |
| 2 | CVE-2026-33186 in Charon source | — | N/A | **Already fixed** (v1.79.3) |
| 3 | CVE-2026-33186 in CrowdSec/Caddy binaries | High | Yes (for Charon) | Upgrade CrowdSec and Caddy Docker image tags |
| 4 | GHSA-479m-364c-43vc (`goxmldsig`) | Medium | **Yes** | Upgrade Caddy Docker image |
| 5 | GHSA-6g7g-w4f8-9c9x (`jsonparser`) | Medium | **Yes** | Upgrade CrowdSec Docker image |
| 6 | GHSA-jqcq-xjh3-6g23 (`pgproto3/v2`) | Medium | **Yes** | Upgrade CrowdSec Docker image |
| 7 | High stdlib CVEs in `backend/bin/` binaries | High | No | Rebuild with go1.26.1 |
| 8 | Python venv packages | Medium | No (dev only) | `pip upgrade` in local envs |
| 9 | Module cache false positives | Critical–High | **Yes** | Exclude `.cache/` from `grype dir:.` |
| 10 | Stale `sbom-generated.json` | — | Yes | Delete or regenerate |