STAC-25420 VEX process-agent OpenPGP module finding

[LouisLotter]

Summary

• add an image-scoped not_affected statement for GO-2026-5932 in stackstate-k8s-process-agent
• cover the bare OCI product plus Quay, Rancher, and SUSE distribution identities
• classify the OpenPGP finding as vulnerable_code_not_present
• add package-scoped not_affected statements for the three containerd v2 advisories that Grype incorrectly maps to github.com/containerd/containerd@v1.7.33

OpenPGP evidence

The advisory applies to the deprecated golang.org/x/crypto/openpgp and openpgp/clearsign packages. The process-agent links other packages from golang.org/x/crypto, so module-level binary scanners report the parent module at v0.53.0.

At process-agent commit 464045ac95f7f081804c10b7d5b9ea42437dc4b0:

• go mod why golang.org/x/crypto/openpgp can trace optional source through the Datadog/Trivy/Rekor module graph
• go list -deps ./cmd/agent contains neither golang.org/x/crypto/openpgp nor the Trivy/Rekor path
• the Linux command therefore does not link the affected OpenPGP implementation

Official advisory: https://pkg.go.dev/vuln/GO-2026-5932

containerd evidence

CVE-2026-50195, CVE-2026-53489, and CVE-2026-53492 affect the distinct github.com/containerd/containerd/v2 module. Grype 0.112.0 reports them against github.com/containerd/containerd@v1.7.33 after major-version module-path normalization. Go major versions two and later have distinct module paths, so the vulnerable /v2 code is not present in the package subject.

The existing image-scoped statements remain valid. The package-scoped statements express the stronger universal fact and make Grype suppression independent of whether the image was pulled from a registry or built locally before publication.

Upstream advisories:

• GHSA-cvxm-645q-p574
• GHSA-rgh6-rfwx-v388
• GHSA-33vj-92qq-66hc

Validation

• python3 tools/build_index.py --check
• jq empty for both OpenVEX documents and index.json
• git diff --check
• Grype 0.112.0 against a Docker-loaded quay.io/stackstate/stackstate-k8s-process-agent:39508fc7-amd64: 0 active and 3 VEX-suppressed containerd findings using only the package-scoped document

Jira: https://stackstate.atlassian.net/browse/STAC-25420

[dottorblaster]

Shouldn't we archive this repo and consume directly Rancher's vexhub?