test: validate trivy workflow on fixed rclone (throwaway, will be closed) - #58
Closed
DeepDiver1975 wants to merge 3 commits into
Closed
test: validate trivy workflow on fixed rclone (throwaway, will be closed)#58DeepDiver1975 wants to merge 3 commits into
DeepDiver1975 wants to merge 3 commits into
Conversation
The bundled bin/rclone_linux_amd64 was a custom fork build (v1.67.0-beta.8042.483c2feed.kiteworks-backend, Go 1.22.4, built 2024-07-01). Trivy reports 23 HIGH/CRITICAL vulnerabilities against it, 16 of them Go stdlib CVEs, including CVE-2025-68121 (CRITICAL, crypto/tls), CVE-2024-45337 (CRITICAL, x/crypto) and CVE-2026-33186 (CRITICAL, gRPC). Nothing required the fork. The app runs only `rclone sync` and `rclone obscure` against type=webdav,vendor=owncloud remotes, and the fork's kiteworks-backend is never referenced. Upstream v1.75.0 accepts every flag StateMigrateFiles passes, including --webdav-owncloud-exclude-shares and --webdav-owncloud-exclude-mounts (backend/webdav/webdav.go:158,163). The replacement is the official rclone-v1.75.0-linux-amd64.zip artifact, sha256 aa2804e08f48250e71009c727124b6341cd0288465804a9a09d14663cabafbaa, built with Go 1.26.5. It scans clean: no HIGH/CRITICAL findings. Also document why appinfo/install.php still chmods the binary: the exec bit is correct in git and in the app tarball, but the complete tarball normalized it away, which additionally hid the binary from Trivy - its gobinary analyzer only inspects files that have an exec bit. Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
Upstream rclone v1.75.0 (the newest release, 2026-07-31) is built with go1.26.5. Trivy reports eight HIGH stdlib findings against it that are fixed in go 1.25.13 / 1.26.6 - no rclone release has been built with those yet, so no available binary is free of them. All are DoS/XSS class, none CRITICAL, and none is reachable from how the app drives rclone (`rclone sync` and `rclone obscure` against one trusted ownCloud WebDAV endpoint). Each entry carries expired_at: 2026-11-01 and is scoped to the binary's path, so the acceptance expires by itself and cannot spread to other components. Verified that Trivy stops suppressing an expired entry. Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
Signed-off-by: Thomas Müller <1005065+DeepDiver1975@users.noreply.github.com>
DeepDiver1975
force-pushed
the
test/trivy-validation-new
branch
from
August 17, 2026 20:23
c3a2d9a to
c44a15c
Compare
Contributor
Author
|
Throwaway validation PR — purpose served: proved the scan passes on upstream rclone v1.75.0 with the expiring ignorefile. Evidence recorded in #56 and owncloud/reusable-workflows#92. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Throwaway: same reusable Trivy workflow as #57, but on top of the upstream rclone v1.75.0 swap (#56). Expected: green. Will be closed and the branch deleted.