Description
Publish run37995961549 at712e493 failed both capture-image Trivy gates. Code scanning alert341 identifies usr/local/bin/kubectl, not the main module: its separately vendored Kubernetes1.37.1 source carries golang.org/x/net0.57.0 affected by CVE-2026-78669, fixed0.60.0. The main module already resolves0.60.0. A separate main-image amd64 Docker Hub500 is infrastructure, not this finding.
Acceptance Criteria
- #1 Capture-image kubectl build information resolves golang.org/x/net at least0.60.0 without weakening scanner policy or altering Kubernetes source logic
- #2 Local capture-image validation and exact-SHA security scans and publication succeed; existing main-module x/net fix remains intact
Definition of Done
- #1 just check (fmt-check, lint, gen-check, env-check, docs-check, test, race, hygiene, ui-check, compose-check, helm-test, lab-check, signal-fidelity)
- #2 just gen (only if a blueprint field, construct/workload config struct, or a skill under plugins/synthkit/skills/ changed)
- #3 just dump — inventory diffed against signals/
Implementation Plan
Minimal x/net fixed-version upgrade and graph-required dependencies only; focused consumers and full gate; guarded review and root landing, exact-SHA CI and capture publication scan evidence.
Cause correction: inspect a patched official kubectl source release and checksum; change only capture-image official source version/checksum or stop if upstream release is not available. Do not patch vendored Kubernetes dependencies or weaken image scans.
Evidence-backed repair: retain checksum-pinned Kubernetes1.37.1 source and untouched vendor/source logic. Dockerfile only creates alternate root module/sum, uses GOWORK=off to resolve exact x/net0.60 plus graph-required companions, then readonly-modfile build. Verify module checksum provenance, both architecture build compatibility and embedded dependency version; guarded review and exact-SHA capture image scan/publication.
Implementation Notes
loop10: attempts1 Dockerfile-only change-and-verify after read-only cause correction. Main x/net already0.60; vulnerable component was separately built kubectl. Same checksum-pinned Kubernetes1.37.1 and Go1.27.2, untouched source/vendor tree, alternate authenticated module graph fixes x/net0.60 and graph-required companions. Both local architecture binaries and amd64 image passed, embedded metadata/clientversion verified, guarded review PASS and CodeRabbit complete0 onefile. Candidate full gate failed only known control-dash timeout; goal exception permitted land1a581df432b7dfc142a1b67cce4a850018fd25e7. Final pinned composed just check0 at exactland913.153s; exactCI38001424312 success. Main publication38001424172 success: both capture scanners configuredHIGH/CRITICAL exitcode1 passed, failure-handler enforcement skipped intentionally, both capture digests and manifest published. Alert341 fixed/notdismissed; capture manifest sha256:e7a4b1dfad90df20d9b74ce941262bfac4d398c165f6c93ad12dd070196b1400. No cluster proof or byte-identical APK-layer reproducibility claim.
DoD generator and inventory items are N/A for this Dockerfile-only kubectl build-graph change: no blueprint/config/skill/renderer or emitted engine output changed; no fresh just gen/dump run is claimed. Required just check and exact capture build/scan/publication evidence recorded above.
Final Summary
Capture kubectl now resolves patched x/net0.60 without altering Kubernetes logic or scanner policy. Exact-SHA CI/composed checks and both architecture security scans/publication passed; HIGH alert fixed. No manual release or registry mutation.