← Back to issue list

CI: OSV-scanner security-scan check persistently failing on main

View original Github issue

Metadata

Project
debcraft
Number
#181
Type
issue
State
closed
Author
lengau
Labels
—
Created
Updated
Closed

Current evaluation

OSV-scanner CI failure on main fixed by merged PR #182 ("build: bump deps, fix security scan"), which corrected the security-scan workflow and bumped cryptography, httplib2 and setuptools; all checks passed and the issue was closed.

Resolution: closed resolved

Reason: PR canonical/debcraft#182 was merged with approval and green CI, explicitly fixing this issue by correcting the security-scan workflow and updating the vulnerable pinned dependencies (cryptography, httplib2, setuptools) flagged by OSV-scanner.

Evaluated by: mr-cal-bot

No scores available.

Issue body

## Summary The `Security scan / OSV-scanner` check has been failing persistently on `main` for weeks (confirmed on multiple recent runs, e.g. the [2026-08-09 run](https://github.com/canonical/debcraft/actions/runs/31331479811/job/93290370531)), due to known CVEs in pinned transitive dependencies rather than anything introduced by a specific PR. ## Details Latest failure on `main` reports: | Package | Installed | Fixed | Advisory | |---|---|---|---| | cryptography | 46.0.7 | 50.0.0 | PYSEC-2026-3552 | | cryptography | 46.0.7 | 49.0.0 | PYSEC-2026-3553 | | cryptography | 46.0.7 | 49.0.0 | PYSEC-2026-3554 | | cryptography | 46.0.7 | 48.0.1 | GHSA-537c-gmf6-5ccf | | httplib2 | 0.31.0 | 0.32.0 | PYSEC-2026-3444 | | setuptools | 80.9.0 | 83.0.0 | PYSEC-2026-3447 | | gitpython (docs/requirements.txt) | 3.1.9 | 3.1.35+ | multiple (PYSEC-2022-42992 and others) | ## Impact This blocks routine Starbase-merge PRs (e.g. #177) from going green, since the failure is pre-existing on `main` and unrelated to the merge content itself. Bumping `cryptography`, `httplib2`, `setuptools`, and `gitpython` (or adding scanner ignores if any are false positives/unfixable) should resolve it. --- 🤖 [BEEP BOOP, A BOT WROTE THIS COMMENT - Claude Sonnet 5, Copilot CLI] Filed while investigating why the Starbase-merge PR #177 couldn't go green — the OSV-scanner failure reproduces identically on `main` and is unrelated to that merge.

Evaluation history

Date Model Scores Action Summary
stealth/space-bunny-alpha — closed resolved OSV-scanner CI failure on main fixed by merged PR #182 ("build: bump deps, fix security scan"), which corrected the security-scan workflow and bumped cryptography, httplib2 and setuptools; all checks passed and the issue was closed.
stealth/space-bunny-alpha — closed resolved Fixed by merged PR #182, which bumped vulnerable dependencies and corrected the security-scan workflow, restoring green CI on main.
qwen/qwen3.6-35b-a3b — — Fixed by bumping vulnerable transitive dependencies to patch reported CVEs, resolving the persistent OSV-scanner CI failure on main.
qwen/qwen3.6-35b-a3b
Staleness: 5
Complexity: 15
Confidence: 90
Support Request: 5
needs triage CI security scan on main persistently fails due to known CVEs in transitive dependencies, blocking merge PRs. Awaiting triage to bump versions or configure scanner ignores.

Update history

Date Change
closed
created

Related work

  • Likely Fixed By: canonical/debcraft#182 (confidence 97%)

    Merged PR titled 'build: bump deps, fix security scan'; corrected the workflow and bumped cryptography, httplib2, setuptools, resolving the OSV findings.

  • Related To: canonical/debcraft#177 (confidence 90%)

    Starbase merge PR cited in the issue as blocked by the pre-existing main-branch OSV failure; it was closed unmerged and a fresh merge was expected after the fix.

  • Related To: canonical/imagecraft#407 (confidence 45%)

    Sibling Canonical project with the same class of OSV-scanner findings (cryptography, httplib2, setuptools) for comparable dependency bumps.

Related issues

Issue Project State Summary Similarity
#407 OSV-scanner findings: outdated transitive dependencies (cryptography, httplib2, python-apt, setuptools) imagecraft closed Resolved by merged PR canonical/imagecraft#421 (commit 71a1ee0), upgrading cryptography 49.0.0→50.0.0 and httplib2 0.31.2→0.32.0; the OSV-scanner check passed.
77%