Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Re-enable govulncheck after it supports ignoring a particular vulnerability #3530

Open
rootulp opened this issue Jun 4, 2024 · 0 comments
Open

Re-enable govulncheck after it supports ignoring a particular vulnerability #3530

rootulp opened this issue Jun 4, 2024 · 0 comments
Labels
warn:blocked item is not currently being worked on but is still blocked WS: Maintenance 🔧 includes bugs, refactors, flakes, and tech debt etc

Comments

@rootulp
Copy link
Collaborator

rootulp commented Jun 4, 2024

Context

#3529 removed govulncheck

Problem

govulncheck doesn't support ignoring a particular vulnerability

  1. x/vuln: add support for suppressing vulnerabilities by ID golang/go#59507
  2. x/vuln: add support for silencing vulnerability findings with govulncheck golang/go#61211

Proposal

After the above issues are resolved, re-enable govulncheck and ignore ibc-go v6.2.x vulnerability.
@rootulp rootulp added the WS: Maintenance 🔧 includes bugs, refactors, flakes, and tech debt etc label Jun 4, 2024
@rootulp rootulp mentioned this issue Jun 4, 2024
Merged
rootulp added a commit that referenced this issue Jun 5, 2024
@rootulp
ci: remove govulncheck (#3529)
fd4b75b 
Closes #3516
Opens #3530

This PR removes govulncheck from CI because govulncheck does not support
ignoring a particular vulnerability. Since we're on ibc-go v6.2.x which
has a vulnerability, CI will report a red X on all future PRs because
govulncheck fails. We can re-enable govulncheck when it adds support for
ignoring a particular vulnerability.
@evan-forbes evan-forbes added the warn:blocked item is not currently being worked on but is still blocked label Jun 10, 2024
0xchainlover pushed a commit to celestia-org/celestia-app that referenced this issue Aug 1, 2024
@rootulp
ci: remove govulncheck (#3529)
8451e3a 
Closes celestiaorg/celestia-app#3516
Opens celestiaorg/celestia-app#3530

This PR removes govulncheck from CI because govulncheck does not support
ignoring a particular vulnerability. Since we're on ibc-go v6.2.x which
has a vulnerability, CI will report a red X on all future PRs because
govulncheck fails. We can re-enable govulncheck when it adds support for
ignoring a particular vulnerability.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
warn:blocked item is not currently being worked on but is still blocked WS: Maintenance 🔧 includes bugs, refactors, flakes, and tech debt etc
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@rootulp @evan-forbes