Meeting started at 2026-08-24 18:00:59 UTC

The Meeting name is 'Go SIG meeting'

Hi everyone! As always we'll wait ~5 minutes for everyone to join.

!hi

Brad Smith: Brad Smith (buckaroogeek)

Thanks for the review!

my pleasure 🙂

I needed to update/reinstall/migrate (long story) to a new Fedora installation and I have everything who knows where... hence the huge delay in the review.

I usually reinstall Fedora from scratch every 3 or so versions

I don't have a consistent process (I usually stay in a version until it is more or less EOL and then jump). But in this case I needed to do some cleaning in the data and the tools I was using for reasons. A spring/summer cleaning is always nice.

5 minutes out. Right now we don't have anything tagged for the meeting. So we can move to the open floor.

FYI: Rawhide has 1.27.0 right now (I still need to move that into f45)

and I will do a mass prebuild on COPR

Ok. And retire go 1.25 in f43?

Yes, I need to open the ticket to move it to 1.26

let me write that down...

That will be helpful. Kubernetes uses 1.26 for all supported releases

no more 1.25?

No - the releases last week all moved to 1.26

I will open the ticket after this meeting then

Any other topics?

Just a comment and question. The upstream cri-o project uses govulncheck output in openvex format. I have found that useful

eg:

```

==> (lesspipe 2.27) append : to filename to view the original json file

{

"@context": "https://openvex.dev/ns/v0.2.0",

"@id": "govulncheck/vex:c4453f6cf6f7c79cfaa3e35f9e2a5a40d5fed6430606c3975b1866206e7f8f53",

"author": "Unknown Author",

"timestamp": "2026-08-24T17:47:12.566052929Z",

"version": 1,

"tooling": "https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck",

"statements": [

{

"vulnerability": {

"@id": "https://pkg.go.dev/vuln/GO-2025-4096",

"name": "GO-2025-4096",

"description": "Container escape via \"masked path\" abuse due to mount race conditions in githu

b.com/opencontainers/runc",

"aliases": [

"CVE-2025-31133",

"GHSA-9493-h29p-rfm2"

]

},

"products": [

{

"@id": "Unknown Product",

"subcomponents": [

{

"@id": "pkg:golang/github.com%2Fopencontainers%2Frunc@v1.3.1"

}

]

}

],

"status": "not_affected",

"justification": "vulnerable_code_not_present",

"impact_statement": "Govulncheck determined that the vulnerable code isn't called"

},

```

So i modified the cri-o shell script to generate this output on a local source repository. Can share if any interest. Useful to me at least checking CVEs

I will copy and paste the output into a cve BZ

I'm not familiar with this openvex format (if I was, I don't recall it)...

how are you using it?

https://openssf.org/projects/openvex/

Just to check BZ cves for a package. If the cve is not in the report I can close as not found. Otherwise if found I can annotate the BZ as confirmed

The CRI-O team actually provides a copy of the vex report with each release documenting any known vulnerabilities

oh

I like this

I have a bunch of packages with a lot of old CVEs that I need to verify if they are still there. It's a slow manually process.

Yes. the script i have generates 1 report which i can search with less or whatever. Quicker that running govulncheck on each cve

if i was more talented i could write a script to go through each open BZ :)

but maybe after BZ is retired and the new system put in place ...

Just for background - here is the CRI-O write up: https://github.com/cri-o/cri-o?tab=security-ov-file#openvex

I'm not talented but I will waste hours in trying to not go over that list 😄 I like the idea a lot. Until now I was doing the checking manually (can explain why I have a lengthy list)

I will share the script on Forgejo or somewhere like that. Unless you have another suggestion?

Or github

no suggestions, thanks a lot!!

Anything else? we can call it if not 🙂

Nothing else from me

in that case...

thanks a lot of the govulncheck idea! and see you around!

¡Hasta luego!