Summary
.github/workflows/security-scan.yml excludes GO-2026-5932 — golang.org/x/crypto/openpgp is deprecated by design, has no fixed version, and never will. The exclusion is currently correct, but it should not be permanent, and a suppression with no expiry tends to become one.
Why it exists
Nothing in ToolHive imports openpgp. It arrives four levels up:
pkg/skills/signer → sigstore-go/pkg/sign → rekor/pkg/pki → rekor/pkg/pki/pgp → golang.org/x/crypto/openpgp
rekor/pkg/pki is a pluggable signature-format registry, so importing it links every format, PGP included. There is no local call site to rewrite.
Every govulncheck trace is package-init reachability (signer.init calls sign.init, which eventually calls armor.init), not a call — the package is linked but never parses PGP data on any ToolHive path. The advisory is "unmaintained, unsafe by design" rather than a specific exploitable bug, and that risk only materialises when parsing untrusted PGP input.
What unblocks removal
Rekor already migrated to ProtonMail/go-crypto/openpgp in sigstore/rekor#2883, merged 2026-07-15. The latest release, v1.5.3, is from 2026-07-02 and predates it, so the fix is on main but unreleased.
Steps once a rekor release past v1.5.3 exists
- Bump
github.com/sigstore/rekor (indirect, currently v1.5.3) — likely via a sigstore-go bump rather than directly.
- Confirm the advisory is gone:
govulncheck ./... should no longer report GO-2026-5932.
- Remove
GO-2026-5932 from IGNORED_VULNS in .github/workflows/security-scan.yml, along with its justification block.
stacklok/toolhive-core carries the same exclusion for the same reason and needs the same treatment — it has its own go.mod, so it is a separate bump.
Context: #6286.
Summary
.github/workflows/security-scan.ymlexcludesGO-2026-5932—golang.org/x/crypto/openpgpis deprecated by design, has no fixed version, and never will. The exclusion is currently correct, but it should not be permanent, and a suppression with no expiry tends to become one.Why it exists
Nothing in ToolHive imports openpgp. It arrives four levels up:
rekor/pkg/pkiis a pluggable signature-format registry, so importing it links every format, PGP included. There is no local call site to rewrite.Every govulncheck trace is package-init reachability (
signer.init calls sign.init, which eventually calls armor.init), not a call — the package is linked but never parses PGP data on any ToolHive path. The advisory is "unmaintained, unsafe by design" rather than a specific exploitable bug, and that risk only materialises when parsing untrusted PGP input.What unblocks removal
Rekor already migrated to
ProtonMail/go-crypto/openpgpin sigstore/rekor#2883, merged 2026-07-15. The latest release, v1.5.3, is from 2026-07-02 and predates it, so the fix is onmainbut unreleased.Steps once a rekor release past v1.5.3 exists
github.com/sigstore/rekor(indirect, currently v1.5.3) — likely via asigstore-gobump rather than directly.govulncheck ./...should no longer reportGO-2026-5932.GO-2026-5932fromIGNORED_VULNSin.github/workflows/security-scan.yml, along with its justification block.stacklok/toolhive-corecarries the same exclusion for the same reason and needs the same treatment — it has its owngo.mod, so it is a separate bump.Context: #6286.