fix(security): bind Trivy IaC mitigations to source occurrences #15

Merged

gitchegumi merged 1 commit from kiyi/fix-trivy-occurrence-fingerprints into main

2026-09-04 22:25:33 -05:00

kiyi commented

2026-09-04 21:43:09 -05:00

Member

Validation: all 41 unit tests pass in Linux, including separate same-rule occurrences, one-occurrence-only mitigation, rejection of old coarse fingerprints, and malformed occurrence metadata. git diff --check passes.

Addresses the upstream blocker in Homelab/platform#20. After review and merge, publish the next patch release, update platform uses and library_ref together, regenerate/adjudicate each mitigation, and rerun hosted security. Platform adoption remains pending that reviewed release.

Trivy 0.74 omits CauseMetadata.Resource for these IaC findings, causing separate same-rule defects in one file to share a mitigation fingerprint. Include the positive source StartLine and optional resource identity so each occurrence requires its own mitigation; reject missing or invalid lines and retain no coarse compatibility fallback. Document that source-line changes invalidate mitigations. Validation: all 41 unit tests pass in Linux, including separate same-rule occurrences, one-occurrence-only mitigation, rejection of old coarse fingerprints, and malformed occurrence metadata. git diff --check passes. Addresses the upstream blocker in Homelab/platform#20. After review and merge, publish the next patch release, update platform uses and library_ref together, regenerate/adjudicate each mitigation, and rerun hosted security. Platform adoption remains pending that reviewed release.

kiyi added 1 commit

2026-09-04 21:43:09 -05:00

fix(security): bind Trivy IaC mitigations to source occurrences

Repository security / security-1 (pull_request) Successful in 1m24s

Details

Repository security / security (pull_request) Successful in 0s

Details

Library checks / tests (pull_request) Successful in 1m48s

Details

a2d7a4b450

Include the positive source line and optional resource in IaC fingerprints. Reject missing occurrence metadata and retain no coarse fingerprint fallback. Add regression coverage and migration guidance. Validation: 41 Linux unit tests pass. Addresses Homelab/platform#20.

portegumi approved these changes

2026-09-04 22:24:45 -05:00

portegumi left a comment

The Trivy IaC normalizer now fails closed without a positive integer StartLine, includes that occurrence identity (plus an optional resource) in the fingerprint, and retains no coarse compatibility fallback. The regression proves two same-rule findings in one file receive distinct fingerprints and that mitigating one leaves the other blocking; mutation-testing the location hook makes that regression fail. Against the exact Trivy 0.74 platform report, all 166 IaC findings normalized to 166 unique fingerprints, including the previously colliding KSV-0014 occurrences. All 41 Python 3.12 tests and 16 scaffold cases pass; the exact-head hosted artifact reports passed: true, zero blockers, five mitigated findings, and zero scanner errors. The branch is current, mergeable, and git diff --check is clean. No blocking findings.

The Trivy IaC normalizer now fails closed without a positive integer `StartLine`, includes that occurrence identity (plus an optional resource) in the fingerprint, and retains no coarse compatibility fallback. The regression proves two same-rule findings in one file receive distinct fingerprints and that mitigating one leaves the other blocking; mutation-testing the location hook makes that regression fail. Against the exact Trivy 0.74 platform report, all 166 IaC findings normalized to 166 unique fingerprints, including the previously colliding KSV-0014 occurrences. All 41 Python 3.12 tests and 16 scaffold cases pass; the exact-head hosted artifact reports `passed: true`, zero blockers, five mitigated findings, and zero scanner errors. The branch is current, mergeable, and `git diff --check` is clean. No blocking findings.