Repository navigation
feat(nix): govulncheck check, live-database app and SBOMs (FP-4) - #296
Merged
Merged
Conversation
- checks.govulncheck: govulncheck against a pinned offline snapshot of golang/vulndb (nix/lib/govulndb.nix), with no tags and with every destination and enrichment tag. A reachable finding not in the check's accepted list fails; GO-2026-6859 (net/http, fixed in go1.27.4) is accepted until the toolchain bump. - nix run .#govulncheck-fresh: the same scans against the live database, plus go mod verify. - sbom-<binary> packages: a CycloneDX SBOM per binary from the linked module list (cyclonedx-gomod bin). Co-Authored-By: Claude Opus 5.5 <[email protected]>
[[ ]] for the go.mod test and a braced ${rc}; shellcheck -o all is clean.
Co-Authored-By: Claude Opus 5.5 <[email protected]>
Owner
Author
|
# Conflicts: # CHANGELOG.md
randomizedcoder
added a commit
that referenced
this pull request
Nov 12, 2026
Co-Authored-By: Claude Opus 5.5 <[email protected]>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Phase F1, FP-4 of the focused container hardening plan (#291). Independent of FP-1 to FP-3.
checks.govulncheck: govulncheck against a pinned offline snapshot ofgolang/vulndb(nix/lib/govulndb.nix), with no tags and with every destination and enrichment tag. Pure, so it runs innix flake check.acceptedlist fails the build. One is accepted: GO-2026-6859 (net/http, fixed in go1.27.4; the pinned nixpkgs has go1.27.3), to be dropped with the toolchain bump. Checked: with the list empty, the check fails on it.nix run .#govulncheck-fresh: the same scans against the live database, plusgo mod verify. Reports the same single finding today.nix build .#sbom-<binary>: a CycloneDX SBOM per binary package, from the module list the linker embeds (cyclonedx-gomod bin).🤖 Generated with Claude Code