[Eandalf-Bigstack]

What type of PR is this?

/kind feature

What this PR does / why we need it

Two changes for cubecos's fifth 3.2.0 scan-review round, stacked on #205:

commit	change
9691e35	recheckvulns.py: Go modules linked at a pseudo-version are re-judged by their own history. A module whose path has no major-version suffix while the project releases v2 or later (github.com/grafana/tempo, github.com/rancher/rancher) can be linked only at a pseudo-version, which names a commit. grype compares it with the releases the advisories give as fixed, and it sorts below every one of them, whatever the commit holds. grafana's tempo commit already contains both fix commits and is still reported for both. The new --gomodules pass keeps commits-only clones of those modules' GitHub repositories (GOMODULE_GIT for a mirror), updated between scans like the CNA and OSSA checkouts. It reads each advisory's ranges and fix commits from grype's own database (grype db search). A match moves to ignoredMatches when a fix commit the advisory names is an ancestor of the linked commit. It also moves when the newest release that commit descends from is outside every affected range, at or above every fixed release, and was released after all of them, the fixed releases being tags of the repository. projsbom.mk passes --gomodules go-module-repos.
7302fb2	rootfs: Intel's out-of-tree ixgbe goes. The kernel's own ixgbe has known the E610 since Linux 6.14, and cubecos moves to the 7.2 kernel. The download, the build and the dca line base.modules gained for it are dropped. The check stays, against the kernel's module tree, where every image with NIC drivers takes ixgbe from: the build fails on a kernel whose ixgbe lacks the E610 10GBASE-T id.

Which issue(s) this PR fixes

Refs bigstack-oss/cubecos#578

Special notes for your reviewer

Note

Stacked: the base is jim.lin/fix/vuln-handling-4 (#205), and this PR is in the same GitHub stack. Merge #205 first.

Pairs with the cubecos PR for jim.lin/fix/vuln-handling-5. Its two hex bumps point at 9691e35 and 7302fb2. Both repos merge fast-forward, so the SHAs stay valid.

7302fb2 needs a kernel of 6.14 or later. On cubecos's current 6.12 jail its check stops the build; cubecos moves the jail to 7.2 in the same commit that bumps hex to it.

Conservative by design. The release rule needs the fixed versions to be tags of the repository and the release to have come after them all. That date condition keeps a renumbered project's old commits: prometheus's 2021 commit descends from v2.26.0, which sorts above its 3.x module versions (v0.311.3) but came years before them. A fixed pseudo-version whose commit the linked one does not contain keeps the match. So do an unknown commit, a module not on GitHub, and a version that is not a pseudo-version. A repository that cannot be fetched, or grype's database that cannot be read, stops the scan, as for the other sources.

Verification:

• Unit tests: scripts/tests/test_recheckvulns.sh passes 120 checks, 16 of them new. They use a local repository with dated commits and tags and a stand-in grype, and cover:

  • a named fix commit, a fixed pseudo-version that is an ancestor, and the release rule;
  • a fixed pseudo-version that is not an ancestor, a release inside a range, a fix that is not a tag, an advisory with no fix, and the renumbered line;
  • an unknown commit, a non-pseudo version, a module not on GitHub, and a second scan fetching new tags;
  • an unreachable repository, an unreadable database, and no fetch without a pseudo-version.

  test_projsbom.sh passes its 12 checks.

• On real reports: run in the jim build jail on grype 0.119.0's reports for grafana 12.4.12, kapacitord 1.8.8 and terraform-provider-rancher2 v7.0.0, with clones from GitHub (5 to 15 MB each, 16 seconds in all):

  • both tempo matches are ignored by their fix commits;
  • five rancher matches, two of them High, are ignored, by a fix commit or by v2.9.0;
  • three rancher matches, fixed only in later pseudo-versions, are kept;
  • kapacitor's prometheus match is kept.

• The ixgbe change:

  • 7.2.11's ixgbe lists all five E610 ids, and its dependencies (mdio, libie_fwlog, dca) are in its module tree;
  • the install, PXE and PXE-server ramdisks take every module from that tree;
  • all 44 module-list patterns of hex and cubecos still match on 7.2.11.

  A full build on 7.2 needs cubecos's rebuilt jail.

Additional documentation

NONE

🤖 Generated with Claude Code