damccorm opened a new pull request, #41175:
URL: https://github.com/apache/beam/pull/41175
## Summary
Adds automated VEX (Vulnerability Exploitability eXchange) statement
generation, Artifact Registry + Trivy + `govulncheck` reachability triage, and
container VEX attachment for Apache Beam SDK containers:
1. **Canonical VEX Configuration
(`sdks/containers/vex/beam_containers_vex.yaml`)**: Captures CISA VEX
justifications (`vulnerable_code_not_in_execute_path`, `component_not_present`)
for non-exploitable OS build-time toolchains (`gcc-12`, `binutils`, `elfutils`,
`m4`), unused desktop libraries in Debian base layers, Go build-time `cmd/go`
`toolchain` metadata findings, and unimported transitive modules.
2. **Multi-Format VEX & Triage Manager (`sdks/containers/vex/vex_manager.py`
+ `vex_manager_test.py`)**:
- `generate`: Emits OpenVEX v0.2.0
(`sdks/containers/vex/openvex/*.openvex.json`), CSAF 2.0 VEX
(`sdks/containers/vex/csaf/*.vex.json`, compatible with `gcloud artifacts
vulnerabilities load-vex`), and Lichene triage snippets
(`sdks/containers/vex/lichene/beam_vex_rules.pi`).
- `scan`: Queries vulnerabilities reported in Google Artifact Registry
(`gcloud artifacts vulnerabilities list`), Trivy (`trivy image --format json`),
and `govulncheck`, diffs against covered CVEs, and runs automated + optional
LLM reachability triage.
- `attach`: Attaches OpenVEX OCI attestations via `cosign attest --type
https://openvex.dev/ns` and loads CSAF 2.0 VEX assessments via `gcloud
artifacts vulnerabilities load-vex`.
3. **CI Workflows (`.github/workflows/beam_VEX_Triage_and_Publish.yml` and
`.github/workflows/republish_released_docker_containers.yml`)**: Scheduled and
on-demand VEX triage/attachment plus automatic VEX attachment when released
Docker containers are republished.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
