ci: ignore GHSA-2mjx-qc3c-rqvc in the Trivy lockfile scan, matching the cargo-audit waiver

[lym953]

Problem

The "Bottlecap (Rust) / Lockfile Scan" check fails on every branch, for example #1412 and an automated dd-trace-go upgrade branch. Trivy finds advisory GHSA-2mjx-qc3c-rqvc in rustls 0.23.43 and exits 1. main will fail the same way on its next run.

Why this PR ignores the advisory

The fix is in rustls 0.23.45, and we cannot use that version yet:

• rustls 0.23.45 requires aws-lc-rs 1.18 or later. aws-lc-rs 1.18 uses AWS-LC-FIPS 4.x, which has no FIPS 140-3 certification yet. Our FIPS builds must use a certified crypto module. So the team reverted the bump to 0.23.45 in Revert "chore(deps): bump rustls to 0.23.45" (#1376) #1389, and chore(deps): pin aws-lc-rs <1.18 to retain AWS-LC-FIPS 3.x backend #1390 pinned aws-lc-rs below 1.18.
• The non-FIPS builds do not use aws-lc-rs, but both builds use the same Cargo.lock, so they get the same rustls version.
• datadog-fips from serverless-components also requires rustls below 0.23.45. In a copy of main without our own cap, cargo update -p rustls --precise 0.23.45 fails on that requirement.

#1389 accepted this risk for cargo-audit, where the advisory has its RustSec ID, RUSTSEC-2026-0285. The GitHub advisory links to that RustSec page. The advisory says that the handshake transcript stays authenticated, so an attacker cannot change or complete a handshake. The effect is that a peer can send in plaintext some handshake messages that must be encrypted.

Change

Trivy uses its own ignore list, .trivyignore.yaml, and that list did not have the advisory. This PR adds GHSA-2mjx-qc3c-rqvc to it, with the same reason. It also adds a line to bottlecap/.cargo/audit.toml that names the Trivy entry. Then the person who removes one ignore after the certification also removes the other.

.github/workflows/vulnerability-scan.yml reads the same file for its daily Cargo.lock scan, so that scan also skips the advisory. The daily image scans in that workflow do not read the file, and this PR does not change them.

Testing

Steps

1. Copy bottlecap/Cargo.lock, bottlecap/Cargo.toml and .trivyignore.yaml into an empty directory.
2. Run Trivy with the options of the CI step: trivy fs --scanners vuln --ignorefile .trivyignore.yaml --ignore-unfixed --exit-code 1 --format table bottlecap.
3. Do steps 1 and 2 for main and for this branch.

Result

Check	Before (main, 469decc8)	After (this branch)
Trivy findings	1, GHSA-2mjx-qc3c-rqvc in rustls 0.23.43	0
Trivy exit code	1	0

I used the local Trivy installation, not the version and database that CI uses. The CI run on this PR is the real check.

🤖 Generated with Claude Code

[datadog-datadog-prod-us1]

_{This comment will be updated automatically if new data arrives.
🔗 Commit SHA: ef93606 | Docs | View more details | Give us feedback!}

[Copilot]

🟢 Approval recommended

The narrowly scoped waiver is consistent across both scanners and clearly documents its temporary constraint and removal condition.

0 open findings

What changed in this PR

Aligns Trivy’s Rust lockfile scan waiver with the existing cargo-audit waiver for the temporarily unavoidable rustls advisory.

Changes:

• Ignores GHSA-2mjx-qc3c-rqvc in Trivy lockfile scans.
• Cross-references both waiver locations and documents removal criteria.

File	Description
.trivyignore.yaml	Adds the Trivy advisory waiver and rationale.
bottlecap/​.cargo/​audit.toml	Links the existing RustSec waiver to Trivy’s waiver.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.