From ef9360685ddeae1b51a96998d1f34cdcfb8cbd1c Mon Sep 17 00:00:00 2001 From: lym953 <10097700+lym953@users.noreply.github.com> Date: Wed, 7 Oct 2026 13:53:31 -0400 Subject: [PATCH] ci: ignore GHSA-2mjx-qc3c-rqvc in the Trivy lockfile scan Trivy reports RUSTSEC-2026-0285 by its GitHub ID, GHSA-2mjx-qc3c-rqvc, so the cargo-audit waiver does not apply to it, and the Lockfile Scan fails on every branch. Add the same waiver to .trivyignore.yaml, and point each ignore list at the other so both are removed together. Co-Authored-By: Claude Opus 5.5 --- .trivyignore.yaml | 6 ++++++ bottlecap/.cargo/audit.toml | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/.trivyignore.yaml b/.trivyignore.yaml index c73c70e39..0d1dde4a9 100644 --- a/.trivyignore.yaml +++ b/.trivyignore.yaml @@ -11,3 +11,9 @@ vulnerabilities: `tar` is a build dependency of `libddwaf-sys`, used by its build script. It is not linked into the extension binary: `cargo tree -i tar -e normal` reports nothing, while `-e build,normal` reports the build-script edge. + - id: GHSA-2mjx-qc3c-rqvc + statement: | + Same advisory as RUSTSEC-2026-0285, ignored for cargo-audit in + `bottlecap/.cargo/audit.toml`. The fix is in rustls >= 0.23.45, which + requires aws-lc-rs >= 1.18 and so AWS-LC-FIPS 4.x, pending FIPS 140-3 + certification. Remove this entry together with that ignore. diff --git a/bottlecap/.cargo/audit.toml b/bottlecap/.cargo/audit.toml index 8e88df8d7..016965b0f 100644 --- a/bottlecap/.cargo/audit.toml +++ b/bottlecap/.cargo/audit.toml @@ -1,6 +1,7 @@ # RUSTSEC-2026-0285 is fixed in rustls >= 0.23.45, but that version requires # aws-lc-rs >= 1.18, which pulls in AWS-LC-FIPS 4.x, pending FIPS 140-3 # certification. Remove this ignore once a FIPS-certified aws-lc-rs is -# available. +# available. Trivy reports the same advisory as GHSA-2mjx-qc3c-rqvc, ignored in +# .trivyignore.yaml. [advisories] ignore = ["RUSTSEC-2026-0285"]