Add authentik ldap outpost - #1147
Conversation
c690e88 to
8ba69f0
Compare
|
Updated ignore file |
Fixes the two HIGH CVEs reported by the OCI Factory vulnerability scan of the `ldap` binary: | CVE | Package | Was | Now | | --- | --- | --- | --- | | CVE-2026-46600 | `golang.org/x/net` | v0.55.0 | v0.56.0 | | CVE-2026-56852 | `golang.org/x/text` | v0.37.0 | v0.39.0 | Verified by building `./cmd/ldap` from upstream `version/2026.5.3` with these pins (`CGO_ENABLED=1 GOFIPS140=latest`): - build succeeds, no `go.mod` conflicts - `go version -m` shows `x/net v0.56.0`, `x/text v0.39.0`, `x/crypto v0.53.0` - `trivy rootfs --severity HIGH,CRITICAL --ignore-unfixed` on the resulting binary: 0 findings (was 11) Follow-up: repoint `oci/authentik-ldap-outpost/image.yaml` in canonical/oci-factory#1147 at the merge commit; it currently pins a9502f5, which predates this fix.
03f5713 to
ac48943
Compare
|
@alesancor1 the vulns have been fixed, can we unblock the PR? |
|
Hey, thanks for the fix. The blocker currently comes from the unreplied email for the security monitoring. From the email record on 6th July, the email was never pinged back. Possibly due to sending to a wrong email (security (at) ubuntu.com v.s. security (at) canonical.com). Nonetheless, I've raised the PR in the security monitoring repo at https://github.com/canonical/seceng-notifications/pull/83. |
This comment was marked as duplicate.
This comment was marked as duplicate.
Sorry, something went wrong.
zhijie-yang
left a comment
zhijie-yang
left a comment
There was a problem hiding this comment.
The following inline comments are generated using the AGENTS.md in the feature branch in OpenCode with claude-opus-4.8. I affirm all the comments are legit. These anchor the three blockers from my earlier review to their exact lines.
| @@ -0,0 +1,5 @@ | |||
| # CVE-2024-42490: False positive/unfixable because main module uses git pseudo-version, but we are building 2026.5.3 which is newer than fixed version 2024.6.4 | |||
There was a problem hiding this comment.
[blocker] New .trivyignore files are not accepted — the file is deprecated (§2). Move both rules into an ignored-vulnerabilities: block on the upload[] item in image.yaml, keeping the existing "newer than fixed version…" justifications (and link an upstream advisory where available, since these are Go language-package CVEs). Once migrated, this build no longer uses .trivyignore.
| @@ -0,0 +1,13 @@ | |||
| version: 1 | |||
There was a problem hiding this comment.
[blocker] ignored-vulnerabilities requires a version: 2 trigger (§2). Bump this as part of migrating the .trivyignore rules.
| version: 1 | |
| version: 2 |
| @@ -0,0 +1,13 @@ | |||
| version: 1 | |||
| upload: | |||
| - source: "canonical/authentik-ldap-outpost-rock" | |||
There was a problem hiding this comment.
[blocker] Source-recipe security manifest is wired non-standardly (§4). The pinned recipe (canonical/authentik-ldap-outpost-rock@bc0be6fc478afa164c85dcafcc367d1c7855915e) declares stage-packages (chisel slices libc6_libs, ca-certificates_data, …), so it MUST include the standardized security-manifest part sourced from https://github.com/canonical/rocks-security-manifest. Instead it hand-rolls a deb-security-manifest part with plugin: nil and a custom dpkg-query override-prime. Please switch to the exact part from that repo's README and re-pin commit:
deb-security-manifest:
plugin: make
source: https://github.com/canonical/rocks-security-manifest
source-type: git
source-branch: main
override-prime: gen_manifest
3 participants
Description
Add Authentik LDAP outpost
Related issues
Closes #1146