Skip to content

PPD-1612: Build vCluster FIPS 140-3 images - #18

Open
sadath-12 wants to merge 12 commits into
v0.27from
PPD-1612
Open

PPD-1612: Build vCluster FIPS 140-3 images#18
sadath-12 wants to merge 12 commits into
v0.27from
PPD-1612

Conversation

@sadath-12

@sadath-12 sadath-12 commented Aug 3, 2026 •
edited
Loading

Copy link
Copy Markdown

What

Adds the FIPS 140-3 build recipes for the vCluster image set under fips/.

File Purpose
Dockerfile.syncfips Syncer built with the Go Cryptographic Module v1.0.0 (GOFIPS140=v1.0.0, NIST CMVP cert #4985)
Dockerfile.coredns CoreDNS built with GOFIPS140
Dockerfile.hpm vcluster-hostpath-mapper built with GOFIPS140
Dockerfile.upsync container-resource-upsync-plugin built with GOFIPS140 when CRYPTO_LIB is set
vcluster.yaml Reference values wiring the FIPS image set together

Notes

  • FIPS mode is enforced at runtime via GODEBUG=fips140=on. The non-FIPS palette image continues to build from Dockerfile.release, so there is no CRYPTO_LIB dual-mode in the syncer recipe.
  • kine and helm come from the Spectro third-party carriers, which are also GOFIPS140 builds.
  • The syncer runtime base installs gcompat: the loft-sh kubernetes:*-fips distro binaries that the syncer exec's are dynamically linked against glibc.
  • Dockerfile.etcd exists because upstream loft-sh/etcd-fips ships a CGO-linked binary on scratch — no ELF loader and no libc, so it cannot exec (exec /bin/etcd: no such file or directory). This affects every published tag from v3.5.23 to v3.6.10, so a tag bump does not help. Verified working in-cluster after the rebase.
  • Dockerfile.upsync uses COPY . . rather than cloning its source, so unlike the coredns and hpm recipes it builds only from a vcluster-container-resource-upsync-plugin checkout as context. The copy here is the reference; the authoritative file still needs to land in spectrocloud-labs/vcluster-container-resource-upsync-plugin.

Testing

Deployed on sadath-aws-2 with backingStore.etcd.deploy.enabled=true. etcd reaches leader and serves TLS client traffic, the syncer comes up, hostpath-mapper and CoreDNS run, and a StatefulSet in the vCluster gets its /etc/hosts rewritten correctly.

Ticket: https://spectrocloud.atlassian.net/browse/PPD-1612
Epic: https://spectrocloud.atlassian.net/browse/PPD-1597

@sadath-12
PPD-1612: Build vCluster FIPS 140-3 images
f333b7b 
Add the FIPS 140-3 build recipes for the vcluster image set under fips/.

  Dockerfile.syncfips - syncer built with the Go Cryptographic Module
                        v1.0.0 (GOFIPS140=v1.0.0, NIST CMVP cert #4985),
                        FIPS mode enforced at runtime via
                        GODEBUG=fips140=on. kine and helm come from the
                        Spectro third-party carriers, which are also
                        GOFIPS140 builds. The runtime base installs
                        gcompat, since the loft-sh kubernetes -fips distro
                        binaries the syncer exec's are dynamically linked
                        against glibc.
  Dockerfile.coredns  - CoreDNS built with GOFIPS140
  Dockerfile.hpm      - vcluster-hostpath-mapper built with GOFIPS140
  Dockerfile.etcd     - rebases ghcr.io/loft-sh/etcd-fips onto a glibc
                        base; upstream ships a CGO-linked binary on
                        scratch, which has no ELF loader and cannot exec
  vcluster.yaml       - reference values wiring the FIPS image set together

Ticket: https://spectrocloud.atlassian.net/browse/PPD-1612
Epic:   https://spectrocloud.atlassian.net/browse/PPD-1597
bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 3, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      2. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls middleware.Insert
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
  2. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.Verify
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls copy.doCompression
      3. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      4. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  3. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  4. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls certs.generateCertificates
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      5. pkg/kubeadm/config.go:6:2: kubeadm.init calls config.init, which eventually calls config.init
  5. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      3. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      4. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls grpc.createTransport
      5. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
  7. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  8. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  9. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      3. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  10. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 3, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      3. pkg/snapshot/s3/store.go:192:36: s3.Init calls s3.NewPresignClient, which eventually calls v4.NewSigner
      4. pkg/cli/start/docker.go:397:30: start.Error calls types.Error, which eventually calls start.Error
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
  3. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      5. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
  4. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls v1beta4.Convert_kubeadm_InitConfiguration_To_v1beta4_InitConfiguration
      5. pkg/certs/ensure.go:459:39: certs.BuildKubeConfig calls kubeconfig.CreateWithCerts, which eventually calls certs.BuildKubeConfig
  5. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.reader
      2. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.newHTTP2Transport
      2. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls grpc.createTransport
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      5. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
  7. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      2. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      3. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
  8. GO-2026-4762
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.79.3
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  9. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  10. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-4945
  • Module: github.com/go-jose/go-jose/v4
  • Found in: v4.0.5
  • Fixed in: v4.1.4
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
    5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleFinalize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      3. pkg/cli/start/docker.go:397:30: start.Error calls types.Error, which eventually calls start.Error
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls checksum.HandleInitialize
      5. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.GetObject
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      3. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls certs.CreateTree
      4. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls certs.validateSignedCertWithCA
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  3. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      2. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
      5. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
  4. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls selfupdate.init
      2. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      5. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
  5. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls grpc.createTransport
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
  7. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  8. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
  9. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  10. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    2. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode

Please review these findings and fix the issues before merging.

@sadath-12 @cursoragent
PPD-1612: Remove obsolete etcd FIPS Dockerfile
8b74e17 
Co-authored-by: Cursor <cursoragent@cursor.com>
bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      2. pkg/snapshot/s3/config.go:81:39: s3.Build calls config.LoadDefaultConfig, which eventually calls retry.NewStandard
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls http.IdentityResolver
      4. pkg/snapshot/s3/config.go:14:2: s3.init calls s3.init, which eventually calls s3.init
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
      2. pkg/cli/start/docker.go:397:30: start.Error calls componentconfigs.Error, which eventually calls start.Error
      3. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls pkiutil.GetAPIServerAltNames
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/syncer/testing/testing.go:63:71: testing.Setup calls v1beta4.DeepCopyObject, which eventually calls testing.Setup
  3. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      3. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls lzma.init$1
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  4. GO-2026-5026
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.55.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  5. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      2. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
  7. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
  8. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  9. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  10. GO-2026-4550
  • Module: github.com/cloudflare/circl
  • Found in: v1.6.1
  • Fixed in: v1.6.3
  • Example Traces:
    1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
    3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
    5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/store.go:275:31: s3.PutObject calls manager.Upload, which eventually calls manager.send
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Insert
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
  3. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  4. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
      2. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      3. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  5. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  6. GO-2026-5026
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.55.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  7. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  8. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  9. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.newStream
      3. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.newHTTP2Transport
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
  10. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-4945
  • Module: github.com/go-jose/go-jose/v4
  • Found in: v4.0.5
  • Fixed in: v4.1.4
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls grpc.createTransport
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls config.DefaultedStaticInitConfiguration
      2. pkg/syncer/testing/testing.go:63:71: testing.Setup calls v1alpha3.DeepCopyObject, which eventually calls testing.Setup
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  3. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls customizations.GetIdentity
      2. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      3. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.GetObject
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
  4. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      3. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
      4. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
      5. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
  5. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  6. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  7. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      2. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.UnmarshalBinary
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      5. pkg/upgrade/upgrade.go:141:25: upgrade.Upgrade calls selfupdate.UpdateTo, which eventually calls selfupdate.UncompressCommand
  8. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
  9. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  10. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    4. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 5, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      5. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
  2. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
  3. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. cmd/vclusterctl/cmd/token/create.go:20:2: token.init calls v1beta4.init, which eventually calls token.init
      4. pkg/kubeadm/config.go:5:2: kubeadm.init calls kubeadm.init, which eventually calls kubeadm.init
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  4. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      2. pkg/cli/start/docker.go:397:30: start.Error calls types.Error, which eventually calls start.Error
      3. pkg/snapshot/s3/store.go:318:36: s3.List calls s3.NextPage, which eventually calls s3.List
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
  5. GO-2026-5880
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.2
    • Example Traces:
      1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  6. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      2. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  7. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  8. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  9. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      5. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
  10. GO-2025-3922
  • Module: github.com/ulikunitz/xz
  • Found in: v0.5.12
  • Fixed in: v0.5.15
  • Example Traces:
    1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.UnmarshalBinary
    2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.newStreamReader
    3. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
    4. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.readIndexBody
    5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  1. GO-2026-6061
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.82.1
  • Example Traces:
    1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
    2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
    3. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.addConn
    4. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
    5. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls checksum.HandleInitialize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
  2. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      2. pkg/snapshot/pod/pod.go:170:2: pod.RunSnapshotPod calls otelhttp.Close, which eventually calls otelhttp.Close
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.newTracer
  3. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/certs/ensure.go:124:30: certs.EnsureCerts calls certs.generateCertificates, which eventually calls certs.CheckCertificatePeriodValidity
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/certs/ensure.go:32:2: certs.init calls certs.init, which eventually calls certs.init
  4. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      2. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      4. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      5. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.ReadAll
  5. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  6. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      3. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  7. GO-2026-5884
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  8. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  9. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
  10. GO-2026-6061
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.82.1
  • Example Traces:
    1. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
    2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
    3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
    4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
    5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  2. GO-2026-5885
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  3. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      3. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      4. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
  4. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      3. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.GetObject
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls checksum.HandleInitialize
      5. pkg/snapshot/s3/config.go:81:39: s3.Build calls config.LoadDefaultConfig, which eventually calls v4.NewSigner
  5. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  6. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  7. GO-2026-5880
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.2
    • Example Traces:
      1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  8. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
  9. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls compression.xzCompressor
      3. pkg/upgrade/upgrade.go:141:25: upgrade.Upgrade calls selfupdate.UpdateTo, which eventually calls selfupdate.UncompressCommand
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      5. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
  10. GO-2026-4394
  • Module: go.opentelemetry.io/otel/sdk
  • Found in: v1.34.0
  • Fixed in: v1.40.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.newTracer
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
    3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
    4. pkg/snapshot/pod/pod.go:170:2: pod.RunSnapshotPod calls otelhttp.Close, which eventually calls otelhttp.Close
    5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  1. GO-2026-4550
  • Module: github.com/cloudflare/circl
  • Found in: v1.6.1
  • Fixed in: v1.6.3
  • Example Traces:
    1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
    2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
    4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
    5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
  1. GO-2026-4945
  • Module: github.com/go-jose/go-jose/v4
  • Found in: v4.0.5
  • Fixed in: v4.1.4
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
    5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot previously requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/store.go:318:36: s3.List calls s3.NextPage, which eventually calls s3.List
      2. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.HandleFinalize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      4. pkg/snapshot/s3/store.go:275:31: s3.PutObject calls manager.Upload, which eventually calls manager.complete
      5. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls middleware.Insert
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls v1beta3.SetDefaults_BootstrapTokens
  3. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/upgrade/upgrade.go:141:25: upgrade.Upgrade calls selfupdate.UpdateTo, which eventually calls selfupdate.UncompressCommand
      2. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
      3. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls lzma.WriteByte
      5. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.newStreamReader
  4. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  5. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  6. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.newStream
  7. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
  8. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls tracing.init
      2. pkg/snapshot/pod/pod.go:170:2: pod.RunSnapshotPod calls otelhttp.Close, which eventually calls otelhttp.Close
      3. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
  9. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  10. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-4550
  • Module: github.com/cloudflare/circl
  • Found in: v1.6.1
  • Fixed in: v1.6.3
  • Example Traces:
    1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    3. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    4. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot previously requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 6, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.reader
      3. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      5. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      4. pkg/snapshot/s3/store.go:144:35: s3.Init calls s3.newS3Client, which eventually calls s3.newS3Client
      5. pkg/snapshot/s3/store.go:317:28: s3.List calls s3.HasMorePages, which eventually calls s3.List
  3. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  4. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  5. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls trace.init
      4. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
      5. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
  6. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
  7. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      2. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.newHTTP2Transport
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      4. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.addConn
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
  8. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
      2. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      4. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
  9. GO-2026-5885
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  10. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-4945
  • Module: github.com/go-jose/go-jose/v4
  • Found in: v4.0.5
  • Fixed in: v4.1.4
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
    4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
    5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr

Please review these findings and fix the issues before merging.

@bulwark-sc-ent
bulwark-sc-ent Bot dismissed stale reviews from themself August 6, 2026 18:03

Changes have been made to address the security findings.

shubhamrajvanshi
shubhamrajvanshi reviewed Aug 6, 2026
View reviewed changes

@shubhamrajvanshi shubhamrajvanshi left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Inline comments cover the important items — most notably the malformed vcluster-oss image reference (embedded tag in repository), the upsync version + registry drift between Makefile and vcluster.yaml, the missing ENTRYPOINT in Dockerfile.upsync, the empty kube-proxy image:, the TELEMETRY_PRIVATE_KEY build arg, and shell-hardening on verify-all. Happy to pair on any of these.

Comment thread fips/vcluster.yaml
Comment thread fips/Makefile Outdated
Comment thread fips/Makefile Outdated
Comment thread fips/Dockerfile.upsync
Comment thread fips/vcluster.yaml
Comment thread fips/Dockerfile.syncfips Outdated
Comment thread fips/Makefile Outdated
bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/certs/ensure.go:436:38: certs.BuildKubeConfig calls util.StartTimeUTC, which eventually calls certs.BuildKubeConfig
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/syncer/testing/testing.go:63:71: testing.Setup calls v1beta3.DeepCopyObject, which eventually calls testing.Setup
      5. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:61:99: s3.WithTLSSettings calls http.WithTransportOptions, which eventually calls http.WithTransportOptions
      2. pkg/snapshot/s3/store.go:35:2: s3.init calls types.init, which eventually calls s3.init
      3. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
  3. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.newTracer
      4. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls tracing.init
      5. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
  4. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
  5. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.newHTTP2Transport
      2. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
  6. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  7. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  8. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls lzma.init$1
      2. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
      3. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      4. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  9. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  10. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/syncer/testing/testing.go:63:71: testing.Setup calls kubeadm.DeepCopyObject, which eventually calls kubeadm.DeepCopyInto
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      4. pkg/snapshot/s3/store.go:275:31: s3.PutObject calls manager.Upload, which eventually calls manager.send
      5. pkg/snapshot/s3/store.go:197:23: s3.Init calls s3.validChecksumAlg, which eventually calls s3.validChecksumAlg
  3. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.Verify
      3. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      4. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.readUvarint
      5. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls xz.writeCloser
  4. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  5. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.addConn
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      3. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      5. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
  6. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.newTracer
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  7. GO-2026-5879
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.1
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  8. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  9. GO-2026-4762
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.79.3
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  10. GO-2026-4550
  • Module: github.com/cloudflare/circl
  • Found in: v1.6.1
  • Fixed in: v1.6.3
  • Example Traces:
    1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
    2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
    3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
    4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
    5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr

Please review these findings and fix the issues before merging.

@sadath-12
address FIPS build review comments
6a79935 
- vcluster.yaml: drop the embedded tag from the syncer `repository` (it was
  concatenating to `vcluster-oss:0.27.3:0.27.3`)
- vcluster.yaml: disable deploy.kubeProxy — no palette-images-fips kube-proxy
  build exists, so an empty `image` would fall back to a non-FIPS upstream
  default. Documented the whole `deploy` block as private-nodes-only and
  requiring FIPS-pinned images before anything in it is enabled.
- Makefile: default REGISTRY/repository paths/TAG_SUFFIX now reproduce exactly
  the references fips/vcluster.yaml consumes; the personal dev namespace is a
  documented IMAGE_PREFIX override instead of the shipped default
- Makefile: bump UPSYNC_VERSION to v0.0.9 to match vcluster.yaml
- Makefile: harden scan-all/verify-all recipe bodies with `set -euo pipefail`
  while preserving per-target failure accounting
- Dockerfile.upsync: add ENTRYPOINT ["/plugin/plugin"]
- Dockerfile.syncfips + Makefile: drop the TELEMETRY_PRIVATE_KEY build arg.
  The `telemetry.telemetryPrivateKey` symbol no longer exists in this branch,
  so the ldflag was a no-op that could only ever have leaked a secret into the
  image layers and `docker history`.
@sadath-12
fips: drop hardcoded push service account, tidy Dockerfile.upsync
831767d 
- fips/Makefile: the push-auth comment named a specific service account,
  which trips the Gitleaks review (gcp-service-account, fips/Makefile:15)
  and was stale anyway now that the registry default is palette-images-fips
  rather than spectro-images. Point at DevOps instead of hardcoding one.
- fips/Dockerfile.upsync: 'as builder' -> 'AS builder', matching the three
  sibling recipes and clearing the FromAsCasing buildx warning.
- fips/Dockerfile.upsync: the non-FIPS branch built main.go while the FIPS
  branch built '.'; both build '.' now.
bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls customizations.GetIdentity
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleFinalize
      5. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.GetObject
  3. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.newStreamReader
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls copy.doCompression
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.readIndexBody
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      5. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls lzma.init
  4. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls runtime.Default
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  5. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.newStream
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
  6. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  7. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
  8. GO-2026-5880
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.2
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  9. GO-2025-3830
    • Module: github.com/docker/docker
    • Found in: v28.2.2+incompatible
    • Fixed in: v28.3.3+incompatible
    • Example Traces:
      1. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
      3. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
      4. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
  10. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

@sadath-12
fips: re-enable kubeProxy, document that the chart resolves the image
81dc828 
Reverts the settings change - kubeProxy stays at the chart defaults
(enabled: true, image: ""). The kube-proxy image is resolved by the chart,
so it is not pinned in this reference values file; only the comments say so.
bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
      3. pkg/kubeadm/config.go:6:2: kubeadm.init calls config.init, which eventually calls kubeadm.init
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/syncer/testing/testing.go:63:71: testing.Setup calls v1beta4.DeepCopyObject, which eventually calls testing.Setup
  2. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
  3. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
      2. pkg/cli/start/docker.go:397:30: start.Error calls types.Error, which eventually calls start.Error
      3. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
  4. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls resource.init
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      3. pkg/snapshot/pod/pod.go:170:2: pod.RunSnapshotPod calls otelhttp.Close, which eventually calls otelhttp.Close
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
  5. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.reader
      2. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      3. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      4. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.readIndexBody
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls copy.doCompression
  6. GO-2026-4762
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.79.3
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  7. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
  8. GO-2026-5880
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.2
    • Example Traces:
      1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  9. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  10. GO-2026-6061
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.82.1
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
    2. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
    3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
    4. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
    5. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    2. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-4958
  • Module: github.com/moby/spdystream
  • Found in: v0.5.0
  • Fixed in: v0.5.1
  • Example Traces:
    1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
    2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
    3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
    4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleFinalize
      4. pkg/snapshot/s3/store.go:144:35: s3.Init calls s3.newS3Client, which eventually calls s3.resolveDisableExpressAuth
      5. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls middleware.HandleSerialize
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:6:2: kubeadm.init calls config.init, which eventually calls config.init
      2. pkg/controllers/resources/pods/translate/translator.go:663:13: translate.TranslateContainerEnv calls sort.Slice, which eventually calls sort.pdqsort_func
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  3. GO-2026-4918
    • Module: golang.org/x/net
    • Found in: v0.40.0
    • Fixed in: v0.53.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  4. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      3. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls xz.init
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls compression.xzCompressor
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  5. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  6. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
  7. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  8. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls noop.Start
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  9. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      2. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      5. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
  10. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    3. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      4. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      5. pkg/syncer/testing/testing.go:63:71: testing.Setup calls output.DeepCopyObject, which eventually calls testing.Setup
  2. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls checksum.HandleInitialize
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls customizations.GetIdentity
      4. pkg/snapshot/s3/store.go:275:31: s3.PutObject calls manager.Upload, which eventually calls manager.complete
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleInitialize
  3. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      3. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls jwe.init
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
  4. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  5. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      2. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.addConn
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      5. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.CloseSend$1
  6. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.Verify
      3. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls lzma.WriteByte
      4. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      5. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
  7. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  8. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  9. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/snapshot/pod/pod.go:170:2: pod.RunSnapshotPod calls otelhttp.Close, which eventually calls otelhttp.Close
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      4. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      5. pkg/platform/client.go:85:13: platform.InitClientFromConfig calls sync.Do, which eventually calls sync.doSlow
  10. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    2. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

@sadath-12
fips: revert all kubeProxy/deploy changes
37a189b 
The chart renders no kube-proxy, so there was nothing to configure here.
Verified with 'helm template ./chart -f fips/vcluster.yaml': zero kube-proxy
in the output, with and without privateNodes.enabled=true. The whole deploy
block (kubeProxy, flannel, localPathProvisioner, metallb, ingressNginx) has
no template and no Go reader in this repo.

The deploy block is now byte-identical to the pre-review version; the only
remaining change in this file is the syncer repository/tag fix.
bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Gitleaks scan found potential secrets or sensitive information:

    • File: fips/Makefile
    • Fingerprint: 6814b2baa4e45775e32e4b0653defc15fd2e833f:fips/Makefile:gcp-service-account:15

Please review these findings and remove any sensitive information before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls checksum.HandleInitialize
      2. pkg/snapshot/s3/config.go:14:2: s3.init calls s3.init, which eventually calls customizations.init
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleDeserialize
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls http.IdentityResolver
  2. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/cli/start/start.go:31:32: start.init calls runtime.AddToScheme, which eventually calls runtime.AddToScheme
      3. pkg/certs/ensure.go:463:24: certs.BuildKubeConfig calls pkiutil.EncodeCertPEM, which eventually calls certs.BuildKubeConfig
      4. pkg/syncer/testing/testing.go:63:71: testing.Setup calls v1beta4.DeepCopyObject, which eventually calls testing.Setup
      5. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
  3. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.newHTTP2Transport
      2. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
      3. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.Header$1
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.finish
      5. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
  4. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      3. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls tracing.init
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
  5. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed448.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls x448.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  6. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.Verify
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls copy.doCompression
      3. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls io.Read
      4. pkg/upgrade/upgrade.go:16:2: upgrade.init calls selfupdate.init, which eventually calls selfupdate.init
      5. pkg/upgrade/upgrade.go:141:25: upgrade.Upgrade calls selfupdate.UpdateTo, which eventually calls selfupdate.UncompressCommand
  7. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
  8. GO-2026-5880
    • Module: oras.land/oras-go/v2
    • Found in: v2.5.0
    • Fixed in: v2.6.2
    • Example Traces:
      1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
      2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  9. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
  10. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
    2. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    4. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-5970
  • Module: golang.org/x/text
  • Found in: v0.26.0
  • Fixed in: v0.39.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek

Please review these findings and fix the issues before merging.

bulwark-sc-ent[bot]
bulwark-sc-ent Bot requested changes Aug 7, 2026
View reviewed changes

@bulwark-sc-ent bulwark-sc-ent Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2025-4240
    • Module: k8s.io/kubernetes
    • Found in: v1.33.4
    • Fixed in: v1.33.6
    • Example Traces:
      1. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      2. pkg/kubeadm/config.go:11:70: kubeadm.InitKubeadmConfig calls config.DefaultedStaticInitConfiguration, which eventually calls conversion.Convert
      3. pkg/certs/ensure.go:31:2: certs.init calls constants.init, which eventually calls certs.init
      4. pkg/syncer/testing/testing.go:63:71: testing.Setup calls v1alpha3.DeepCopyObject, which eventually calls testing.Setup
      5. pkg/cli/start/docker.go:397:30: start.Error calls componentconfigs.Error, which eventually calls start.Error
  2. GO-2026-4550
    • Module: github.com/cloudflare/circl
    • Found in: v1.6.1
    • Fixed in: v1.6.3
    • Example Traces:
      1. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      2. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ed25519.init
      3. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
      4. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls goldilocks.init
      5. pkg/platform/version.go:11:2: platform.init calls github.init, which eventually calls ecc.init
  3. GO-2026-6061
    • Module: google.golang.org/grpc
    • Found in: v1.71.1
    • Fixed in: v1.82.1
    • Example Traces:
      1. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.recvMsg
      2. pkg/etcd/client.go:258:18: etcd.Close calls v3.Close, which eventually calls grpc.tearDown
      3. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.serveStreams
      4. pkg/plugin/v1/remote/plugin_grpc.pb.go:235:20: remote.Mutate calls grpc.Invoke, which eventually calls grpc.shouldRetry
      5. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls grpc.addConn
  4. GO-2026-5764
    • Module: github.com/aws/aws-sdk-go-v2/service/s3
    • Found in: v1.75.3
    • Fixed in: v1.97.3
    • Example Traces:
      1. pkg/snapshot/s3/store.go:291:31: s3.GetObject calls s3.GetObject, which eventually calls s3.HandleFinalize
      2. pkg/snapshot/s3/config.go:86:41: s3.Build calls endpointcreds.Retrieve, which eventually calls middleware.Add
      3. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls sts.invokeOperation
      4. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls s3shared.HandleInitialize
      5. pkg/snapshot/s3/config.go:86:41: s3.Build calls stscreds.Retrieve, which eventually calls middleware.HandleSerialize
  5. GO-2026-4945
    • Module: github.com/go-jose/go-jose/v4
    • Found in: v4.0.5
    • Fixed in: v4.1.4
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.UnwrapKey
      2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      3. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
      4. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls utils.parseJWKPrivateKey
      5. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls jwe.WrapKeys
  6. GO-2026-4394
    • Module: go.opentelemetry.io/otel/sdk
    • Found in: v1.34.0
    • Fixed in: v1.40.0
    • Example Traces:
      1. pkg/server/server.go:54:2: server.init calls apiserver.init, which eventually calls tracing.init
      2. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls otelhttp.serveHTTP$2
      3. pkg/server/server.go:46:2: server.init calls options.init, which eventually calls options.init
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
      5. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls otelhttp.RoundTrip, which eventually calls otelhttp.RoundTrip
  7. GO-2025-3922
    • Module: github.com/ulikunitz/xz
    • Found in: v0.5.12
    • Fixed in: v0.5.15
    • Example Traces:
      1. pkg/platform/clihelper/clihelper.go:864:29: clihelper.EnsureAdminPassword calls fmt.Sprintf, which eventually calls fmt.handleMethods
      2. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls lzma.init$1
      3. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls io.copyBuffer
      4. pkg/server/filters/metrics.go:395:34: filters.ExecuteRequest calls io.ReadAll, which eventually calls xz.readUvarint
      5. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls lzma.WriteByte
  8. GO-2026-5970
    • Module: golang.org/x/text
    • Found in: v0.26.0
    • Fixed in: v0.39.0
    • Example Traces:
      1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateRegistration
      3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
      4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls idna.validateAndMap
  9. GO-2026-4958
    • Module: github.com/moby/spdystream
    • Found in: v0.5.0
    • Fixed in: v0.5.1
    • Example Traces:
      1. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.NewClientConnectionWithPings
      2. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.ReadFrame
      3. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdystream.NewConnection
      4. pkg/util/portforward/portforward.go:233:47: portforward.ForwardPorts calls spdy.Dial, which eventually calls spdy.newConnection
  10. GO-2026-5026
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.55.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.authorityAddr
  1. GO-2026-5884
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4918
  • Module: golang.org/x/net
  • Found in: v0.40.0
  • Fixed in: v0.53.0
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    2. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    3. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http.roundTrip
    4. cmd/vclusterctl/cmd/registry/proxy.go:186:39: registry.RoundTrip calls http.RoundTrip, which eventually calls http2.run
  1. GO-2025-3830
  • Module: github.com/docker/docker
  • Found in: v28.2.2+incompatible
  • Fixed in: v28.3.3+incompatible
  • Example Traces:
    1. cmd/vclusterctl/cmd/registry/pull.go:11:2: registry.init calls copy.init, which eventually calls manifest.init
    2. cmd/vclusterctl/cmd/registry/pull.go:53:24: registry.Run calls registry.pullImage, which eventually calls manifest.ToSchema2Config
    3. pkg/snapshot/oci/auth.go:11:2: oci.init calls homedir.init, which eventually calls oci.init
    4. pkg/docker/config.go:28:37: docker.NewDockerConfig calls docker.loadDockerConfig, which eventually calls docker.loadDockerConfig
  1. GO-2026-5885
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/pod/pod.go:174:18: pod.RunSnapshotPod calls io.Copy, which eventually calls httputil.Seek
  1. GO-2026-4762
  • Module: google.golang.org/grpc
  • Found in: v1.71.1
  • Fixed in: v1.79.3
  • Example Traces:
    1. pkg/plugin/v1/plugin.go:233:2: v1.Start calls v1.Start$1, which eventually calls v1.Start$1
  1. GO-2026-5880
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.2
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5879
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/snapshot/oci/store.go:100:21: oci.PutObject calls file.New, which eventually calls oci.PutObject
    2. pkg/snapshot/oci/store.go:110:31: oci.PutObject calls file.Add, which eventually calls oci.PutObject
  1. GO-2026-5882
  • Module: oras.land/oras-go/v2
  • Found in: v2.5.0
  • Fixed in: v2.6.1
  • Example Traces:
    1. pkg/util/applier/direct.go:53:28: applier.Apply calls resource.Infos, which eventually calls v2.doCopyNode

Please review these findings and fix the issues before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@shubhamrajvanshi shubhamrajvanshi shubhamrajvanshi left review comments
@bulwark-sc-ent bulwark-sc-ent[bot] bulwark-sc-ent[bot] requested changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@sadath-12 @shubhamrajvanshi