Cve Fix

CVE Fix Workflow

Fix CVEs in Go dependencies. One commit per package, one PR total.

Usage:

• /cve-fix - current repo, current branch
• /cve-fix 0.23 - current repo, specified branch (short form)
• /cve-fix ../submariner-operator - specified repo, current branch
• /cve-fix release-0.23 ../submariner-operator - both specified (order doesn't matter)

Arguments (both optional, order-independent):

• branch: Branch name (anything that's not a path). Short versions like 0.23 auto-expand to release-0.23.
• repo: Path to repository (starts with /, ./, ../, ~/, or is existing directory)

Working with multiple repositories: Accepts repository and branch arguments to fix CVEs across different repositories:

/cve-fix release-0.23 ../submariner-operator
/cve-fix ../lighthouse release-0.23
/cve-fix release-0.23 ../admiral
/cve-fix devel ../subctl

Each invocation is independent (isolated execution context). Multiple invocations run sequentially - one completes before the next starts. Cannot work on the same repository directory simultaneously.

Step 0: Detect Repository Configuration

Run detection and display results before proceeding.

# Parse arguments: [repo] [branch] in any order
read -r ARG1 ARG2 REST <<<"$ARGUMENTS"

if [[ -n "$REST" ]]; then
  echo "ERROR: Too many arguments. Usage: /cve-fix [repo] [branch]"
  exit 1
fi

# Classify arguments: path (/, ./, ../, ~/) or existing dir = repo, otherwise = branch
REPO=""
BRANCH=""

for arg in "$ARG1" "$ARG2"; do
  [[ -z "$arg" ]] && continue

  # Expand tilde for home directory paths
  arg="${arg/#\~/$HOME}"

  if [[ "$arg" == /* ]] || [[ "$arg" == ./* ]] || [[ "$arg" == ../* ]] || [[ -d "$arg" ]]; then
    [[ -n "$REPO" ]] && { echo "ERROR: Multiple repositories specified"; exit 1; }
    REPO="$arg"
  else
    [[ -n "$BRANCH" ]] && { echo "ERROR: Multiple branches specified"; exit 1; }
    BRANCH="$arg"
  fi
done

# Apply defaults
REPO="${REPO:-.}"

# Validate repo exists and is git repo
if [[ ! -d "$REPO" ]]; then
  echo "ERROR: Repository not found: $REPO"
  exit 1
fi

if ! git -C "$REPO" rev-parse --git-dir &>/dev/null; then
  echo "ERROR: Not a git repository: $REPO"
  exit 1
fi

# Get current branch if not specified
if [[ -z "$BRANCH" ]]; then
  BRANCH=$(git -C "$REPO" branch --show-current 2>/dev/null)
  if [[ -z "$BRANCH" ]]; then
    echo "ERROR: Not on a branch (detached HEAD). Specify branch explicitly."
    exit 1
  fi
  echo "Using current branch: $BRANCH"
fi

# Normalize short version to full branch name (0.22 → release-0.22)
if [[ "$BRANCH" =~ ^[0-9]+\.[0-9]+$ ]]; then
  BRANCH="release-${BRANCH}"
  echo "Normalized to branch: $BRANCH"
fi

# Change to repository directory
if [[ "$REPO" != "." ]]; then
  cd "$REPO" || {
    echo "ERROR: Cannot change to directory: $REPO"
    exit 1
  }
  echo "Working in repository: $REPO"
fi

# tools/go.mod presence
HAS_TOOLS_GOMOD=false
test -f tools/go.mod && HAS_TOOLS_GOMOD=true

# Generated files with version comments
GENERATED_FILE=""
DIFF_IGNORE_ARGS=""

if grep -rql "controller-gen.kubebuilder.io/version" --include="*.go" . 2>/dev/null; then
  DIFF_IGNORE_ARGS="-Icontroller-gen.kubebuilder.io/version"
  GENERATED_FILE=$(grep -rl "controller-gen.kubebuilder.io/version" --include="*.go" . 2>/dev/null | head -1)
elif find . -name "*.pb.go" -type f 2>/dev/null | head -1 | grep -q .; then
  DIFF_IGNORE_ARGS="-I^//"
  GENERATED_FILE=$(find . -name "*.pb.go" -type f 2>/dev/null | head -1)
fi

# Pre-scan build requirement (UPX compression)
NEEDS_BUILD_FOR_SCAN=false
grep -q "BUILD_UPX" Makefile 2>/dev/null && NEEDS_BUILD_FOR_SCAN=true

# Container runtime (docker or podman)
CONTAINER_CMD=""
if command -v docker &>/dev/null && docker info &>/dev/null; then
  CONTAINER_CMD="docker"
elif command -v podman &>/dev/null && podman info &>/dev/null; then
  CONTAINER_CMD="podman"
fi

# Local grype
HAS_LOCAL_GRYPE=false
command -v grype &>/dev/null && HAS_LOCAL_GRYPE=true

# Shipyard build image (legacy artifact name: shipyard-dapper-base)
SHIPYARD_IMAGE=""
SHIPYARD_GO_VERSION=""

# Detect base branch to determine image tag
if [[ "$BRANCH" == "devel" ]]; then
  SHIPYARD_TAG="devel"
elif [[ "$BRANCH" =~ ^release- ]]; then
  SHIPYARD_TAG="$BRANCH"
else
  echo "WARNING: Unknown branch pattern, assuming devel build image"
  SHIPYARD_TAG="devel"
fi

SHIPYARD_IMAGE="quay.io/submariner/shipyard-dapper-base:${SHIPYARD_TAG}"

# Pull latest image and check Go version
if [[ -n "$CONTAINER_CMD" ]]; then
  echo "Checking Shipyard build image: $SHIPYARD_IMAGE"
  $CONTAINER_CMD pull "$SHIPYARD_IMAGE" 2>&1 | tail -2
  SHIPYARD_GO_VERSION=$($CONTAINER_CMD run --rm "$SHIPYARD_IMAGE" go version 2>/dev/null || echo "unknown")
  echo "Shipyard Go version: $SHIPYARD_GO_VERSION"
fi

Display configuration: tools/go.mod presence, generated file handling, build requirements, available scanners, Shipyard build image, and Go version.

Step 1: Branch Setup

# Save original branch/commit to restore on early exit
ORIGINAL_REF=$(git rev-parse --abbrev-ref HEAD 2>/dev/null)
if [[ "$ORIGINAL_REF" == "HEAD" ]]; then
  # Detached HEAD - save the commit hash instead
  ORIGINAL_REF=$(git rev-parse HEAD)
fi

# Track fetch status for summary
FETCH_FAILED=false

if ! git fetch 2>/dev/null; then
  echo "WARNING: git fetch failed. Continuing with cached remote state. Run 'git fetch' manually and re-run if it fetches updates."
  FETCH_FAILED=true
fi

# Create fix branch directly from origin (bypasses local branch state)
DATE=$(date +%Y-%m-%d)
VERSION=$(echo "$BRANCH" | sed 's/release-//')
FIX_BRANCH="fix-${VERSION}-cves-${DATE}"

# Add suffix if branch exists (-v2, -v3, etc.)
SUFFIX=""
while git show-ref --verify --quiet refs/heads/"${FIX_BRANCH}${SUFFIX}"; do
  if [[ -z "$SUFFIX" ]]; then SUFFIX="-v2"; else NUM=${SUFFIX#-v}; SUFFIX="-v$((NUM+1))"; fi
done

if ! git checkout -b "${FIX_BRANCH}${SUFFIX}" origin/"$BRANCH" 2>/dev/null; then
  echo "ERROR: Could not create fix branch from origin/$BRANCH. Branch may not exist remotely."
  exit 1
fi

Step 2: Clean Build State

Remove all build artifacts to ensure clean scan:

# Remove binary artifacts and build cache
rm -rf ./bin ./dist ./output

# Run make clean to remove all generated/ignored files
# This runs in Shipyard build container and cleans comprehensively
make clean 2>&1 | grep -v "Error.*ignored" || true

# Verify critical directories are clean
if [ -d "./bin" ] && [ "$(ls -A ./bin 2>/dev/null)" ]; then
  echo "WARNING: ./bin still contains files after cleanup"
  ls -la ./bin
fi

This ensures grype scans only source code and go.mod files, not stale binaries.

Step 3: Scan for CVEs

# Build if needed (submariner with UPX compression)
if [[ "$NEEDS_BUILD_FOR_SCAN" == "true" ]]; then
  make BUILD_UPX=false build
fi

# Scan with container runtime or local grype
if [[ -n "$CONTAINER_CMD" ]]; then
  $CONTAINER_CMD volume create grype-db && \
  $CONTAINER_CMD run --pull=always --rm -v grype-db:/root/.cache/grype anchore/grype:latest db update && \
  $CONTAINER_CMD run --rm -v grype-db:/root/.cache/grype -v "$(pwd)":/src anchore/grype:latest /src --config /src/.grype.yaml -o table
elif [[ "$HAS_LOCAL_GRYPE" == "true" ]]; then
  grype db update && grype . --config .grype.yaml -o table
else
  echo "ERROR: No scanner available. Either:"
  echo "  1. Install docker or podman (grype runs in container, no local install needed)"
  echo "  2. Install grype locally: curl -sSfL https://get.anchore.io/grype | sudo sh -s -- -b /usr/local/bin"
fi

Ignore warning: [0000] WARN no explicit name and version provided for directory source, deriving artifact ID from the given path (which is not ideal)

Check scan results:

If output shows "No vulnerabilities found", clean up and exit:

# If no CVEs found, delete the fix branch and exit
FIX_BRANCH_FULL=$(git rev-parse --abbrev-ref HEAD)
git checkout "$ORIGINAL_REF"
git branch -D "$FIX_BRANCH_FULL"
echo "No CVEs found in $BRANCH - branch is clean"
exit 0

For each CVE found, note NAME (package), FIXED-IN (version), and VULNERABILITY (CVE ID). Same package may appear multiple times with different versions (e.g., v1.2.3 in tools, v1.3.0 in main); treat each as separate fix.

Stdlib CVEs (NAME=stdlib): Can often be fixed by updating the go directive in go.mod to require a minimum Go version with the fix. If go.mod update doesn't resolve the CVE (because the Shipyard build container has an older Go), then a Fedora version update in Shipyard is needed.

Step 4: Locate Package

PACKAGE="[package-from-scan]"

# Find in go.mod files
if [[ "$HAS_TOOLS_GOMOD" == "true" ]]; then
  grep -Fl "$PACKAGE" go.mod tools/go.mod 2>/dev/null
else
  grep -Fl "$PACKAGE" go.mod 2>/dev/null
fi

# Check for replace directives
grep "replace.*$(basename "$PACKAGE")" go.mod tools/go.mod 2>/dev/null

If replace directive found, check git history to understand why it was added:

git log -p --all -G "replace.*$(basename "$PACKAGE")" -- go.mod tools/go.mod | head -50

If obsolete (no longer needed based on git history), remove it:

go mod edit -dropreplace="$PACKAGE"
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && go -C tools mod edit -dropreplace="$PACKAGE"

Otherwise (still needed), the replace directive will be updated to a safe version in Step 5.

Check parent-child dependencies (fix parent first if both have CVEs):

go mod graph | grep "$PACKAGE"
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && go -C tools mod graph | grep "$PACKAGE"

Step 5: Update Package

PACKAGE="[package]"
VERSION="[fixed-version]"  # Use highest if multiple CVEs

# Update in tools/go.mod if present there
if grep -q "$PACKAGE" tools/go.mod 2>/dev/null; then
  go -C tools get "${PACKAGE}@v${VERSION}" && go -C tools mod tidy
fi

# Update in go.mod if present there
if grep -q "$PACKAGE" go.mod 2>/dev/null; then
  go get "${PACKAGE}@v${VERSION}" && go mod tidy
fi

# Clean up go.mod artifacts (portable sed -i for GNU/BSD)
sed -i.bak '/^toolchain/d' go.mod && rm -f go.mod.bak
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && sed -i.bak '/^toolchain/d' tools/go.mod && rm -f tools/go.mod.bak
sed -i.bak '/^$/{N;/^\n$/s/\n//;}' go.mod && rm -f go.mod.bak
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && sed -i.bak '/^$/{N;/^\n$/s/\n//;}' tools/go.mod && rm -f tools/go.mod.bak

# Verify changes
git diff $DIFF_IGNORE_ARGS

Expected: Dependency file updates only.

On stable branches: If go get upgrades Go (1.X→1.Y) or K8s (v0.A→v0.B) minor version:

• Low CVEs: revert changes, add to ignore list (Step 10), and commit. Note in summary for user awareness.
• Medium/High/Critical CVEs: revert changes, do NOT ignore automatically. Note in summary and flag for team review.

Stdlib CVE Variant

For stdlib CVEs, update the go directive instead of a package:

# Determine required Go version from CVE scan FIXED-IN column
# Example: "1.24.12" from "*1.24.12, 1.25.6"
GO_VERSION="[version-from-FIXED-IN]"

# Update go directive in go.mod
go mod edit -go="${GO_VERSION}"
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && go -C tools mod edit -go="${GO_VERSION}"

# Run go mod tidy to update dependencies
go mod tidy
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && go -C tools mod tidy

# Clean up toolchain directive and extra blank lines (portable sed -i for GNU/BSD)
sed -i.bak '/^toolchain/d' go.mod && rm -f go.mod.bak
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && sed -i.bak '/^toolchain/d' tools/go.mod && rm -f tools/go.mod.bak
sed -i.bak '/^$/{N;/^\n$/s/\n//;}' go.mod && rm -f go.mod.bak
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && sed -i.bak '/^$/{N;/^\n$/s/\n//;}' tools/go.mod && rm -f tools/go.mod.bak

# Verify changes
git diff $DIFF_IGNORE_ARGS

Expected: go.mod shows go 1.24.0 → go 1.24.12 (example).

If CVE persists after go.mod update: The Shipyard build container's Go version (from Step 0) is older than required. This means:

• Local scans after rm -rf ./bin will pass (no binaries to scan)
• CI builds will still fail because Shipyard build container compiles with old Go
• A Shipyard Fedora update is needed to bring newer Go to the build image

For commit message format:

Bump Go to [version] for stdlib CVEs

Updates Go requirement from [old-version] to [new-version] to address
stdlib vulnerabilities.

Fixes: [CVE-ID-1], [CVE-ID-2], ...

Step 6: Clean Build Artifacts

make clean

Removes build artifacts to avoid false positives in rescan. Network errors: see Common Issues.

Step 7: Verify Fix

if [[ "$NEEDS_BUILD_FOR_SCAN" == "true" ]]; then
  make BUILD_UPX=false build
fi

if [[ -n "$CONTAINER_CMD" ]]; then
  $CONTAINER_CMD run --rm -v grype-db:/root/.cache/grype -v "$(pwd)":/src anchore/grype:latest /src --config /src/.grype.yaml -o table
elif [[ "$HAS_LOCAL_GRYPE" == "true" ]]; then
  grype . --config .grype.yaml -o table
fi

CVE for this package should no longer appear.

If CVE persists: Double-check you used the correct version from Step 3 FIXED-IN column. If version is correct but CVE persists, recheck Step 4 for replace directives.

Step 8: Verify Build

make unit

This runs unit tests in the Shipyard build container (unless LOCAL_BUILD=1 is set). The Shipyard Go version was displayed in Step 0. Skip this step during multi-package fixes; run once at end. Build errors may indicate incompatible dependency versions for this branch.

Note: If tests fail with "go.mod requires go >= X.Y.Z (running go A.B.C)":

• The error shows the Shipyard build container's Go version (A.B.C), not your local Go version
• This is a version requirement mismatch, not an actual test failure
• Compare A.B.C with the Shipyard Go version from Step 0 to confirm
• If Shipyard Go is insufficient (A.B.C < X.Y.Z), Shipyard needs updating with newer Fedora

Step 9: Commit

# Stage dependency files
git add go.mod go.sum
[[ "$HAS_TOOLS_GOMOD" == "true" ]] && git add tools/go.mod tools/go.sum

# Handle generated files (stage only if substantive changes)
if [[ -n "$GENERATED_FILE" ]] && [[ -n "$DIFF_IGNORE_ARGS" ]]; then
  if git diff $DIFF_IGNORE_ARGS "$GENERATED_FILE" 2>/dev/null | grep -q .; then
    git add "$GENERATED_FILE"
  else
    git checkout "$GENERATED_FILE"
  fi
fi

git diff --staged --stat

Expected: go.mod, go.sum (and tools versions if applicable, generated file only if substantive changes).

Commit Message Format

Single CVE:

Bump <abbreviated-package> for <CVE-ID>

Full package: <full-package-path>

Multiple CVEs (same package):

Bump <abbreviated-package> for CVEs

Full package: <full-package-path>
Fixes: <CVE-ID-1>, <CVE-ID-2>

Abbreviations:

• github.com/docker/docker → docker/docker
• golang.org/x/oauth2 → x/oauth2
• helm.sh/helm/v3 → helm/v3
• Keep k8s.io/ prefix

If only tools files changed: add "in /tools" to subject.

For stdlib CVE fixes:

Bump Go to <version> for stdlib CVEs

Updates Go requirement from <old-version> to <new-version> to address
stdlib vulnerabilities.

Fixes: <CVE-ID-1>, <CVE-ID-2>, <CVE-ID-3>

Example:

Bump Go to 1.24.12 for stdlib CVEs

Updates Go requirement from 1.24.0 to 1.24.12 to address
stdlib vulnerabilities.

Fixes: CVE-2025-61726, CVE-2025-61727, CVE-2025-61728, CVE-2025-61729, CVE-2025-61730, CVE-2025-61731

git commit -s -m "$(cat <<'EOF'
Bump [abbreviated-package] for [CVE-ID]

Full package: [full-package-path]
EOF
)"

After each commit, rebuild (if NEEDS_BUILD_FOR_SCAN) and rescan to catch newly introduced CVEs, then repeat Steps 4-9.

Step 10: Ignore Unfixable CVEs

Skip if no CVEs remain.

Always prefer fixing over ignoring. Even low-severity CVEs appear in user security scanners. Only ignore when fixing is not possible for this branch.

Stdlib CVEs: Do not ignore. First attempt to fix by updating go.mod (see Step 5 stdlib variant above). If Shipyard's Go version is too old (check Step 0), flag for Shipyard Fedora update. Note in summary.

Autonomous decision criteria:

• Attempt fix first
• Low CVEs requiring breaking changes: ignore and commit, note in summary
• Medium/High/Critical requiring breaking changes: flag for review, do NOT ignore

Add to existing ignore: list in .grype.yaml:

  # Update requires [incompatibility]. [Severity] doesn't justify breaking changes.
  - vulnerability: GHSA-xxxx-xxxx-xxxx
    package:
      name: package.name/path

git add .grype.yaml
git commit -s -m "$(cat <<'EOF'
Ignore [package] CVEs incompatible with release-X.Y

[Package] CVEs require versions with [incompatible dependency]
incompatible with this branch's [current dependency].
EOF
)"

Step 11: Final Verification

# Check if any commits were made
COMMIT_COUNT=$(git log origin/"$BRANCH"..HEAD --oneline 2>/dev/null | wc -l)

if [[ "$COMMIT_COUNT" -eq 0 ]]; then
  echo "No commits made - no CVEs were fixed."
  FIX_BRANCH_FULL=$(git rev-parse --abbrev-ref HEAD)
  git checkout "$ORIGINAL_REF"
  git branch -D "$FIX_BRANCH_FULL"
  echo "Deleted empty fix branch: $FIX_BRANCH_FULL"
  exit 0
fi

# Rebuild if needed
if [[ "$NEEDS_BUILD_FOR_SCAN" == "true" ]]; then
  make BUILD_UPX=false build
fi

# Final scan
if [[ -n "$CONTAINER_CMD" ]]; then
  $CONTAINER_CMD run --rm -v grype-db:/root/.cache/grype -v "$(pwd)":/src anchore/grype:latest /src --config /src/.grype.yaml -o table
elif [[ "$HAS_LOCAL_GRYPE" == "true" ]]; then
  grype . --config .grype.yaml -o table
fi

# Only run tests if we have commits to verify
make unit  # Runs in Shipyard build container
git log origin/"$BRANCH"..HEAD
git diff $DIFF_IGNORE_ARGS

Expected: No vulnerabilities, tests pass, clean diff.

Step 12: Create Pull Request

Note: Git push and PR creation require SSH authentication, which may fail if keys are on external devices (YubiKey, hardware tokens).

Extract variables:

CURRENT_BRANCH=$(git rev-parse --abbrev-ref HEAD)
BASE_BRANCH=$(echo "$CURRENT_BRANCH" | sed 's/fix-\([0-9.]*\)-.*/release-\1/; s/fix-devel-.*/devel/')
COMMIT_COUNT=$(git log "origin/${BASE_BRANCH}"..HEAD --oneline | wc -l)
PLURAL=$([[ "$COMMIT_COUNT" -eq 1 ]] && echo "" || echo "s")
FORK_REMOTE=$(git remote -v | awk '!/submariner-io/ && /\(push\)/ { print $1; exit }')
FORK_USER=$(git remote get-url "${FORK_REMOTE}" 2>/dev/null | sed -E 's#.*github.com[:/]+([^/]+)/.*#\1#')

Substitute into template and provide in response (not bash output):

git push <FORK_REMOTE> <CURRENT_BRANCH> && \
gh pr create \
  --title "Fix CVE<PLURAL> in <BASE_BRANCH>" \
  --body "See commit message<PLURAL> for details." \
  --base "<BASE_BRANCH>" \
  --head "<FORK_USER>:<CURRENT_BRANCH>" \
  --assignee "@me"

Summary (Return Value)

When complete, provide a summary including:

1. Repository: Path to repository (if not current directory, omit if ".")
2. Branch: Target branch (and fix branch name if created)
3. CVEs Fixed: List of CVE IDs with package names (or "None - branch is clean" if no CVEs found)
4. CVEs Ignored: List with reasons (if any)
5. CVEs Needing Review: Medium/High/Critical that couldn't be fixed (if any)
6. Stdlib CVEs: Note if fixed via go.mod update; flag if Shipyard update needed
7. PR Command: The substituted command from Step 12 (only if commits were made)
8. Status: Success, partial success, or blocked
9. Warnings: If FETCH_FAILED=true, warn that branch was created from cached remote state and advise running git fetch and re-running if updates are fetched

Note: Skill exits early in Step 3 if no CVEs found, or in Step 11 if all CVEs were handled without commits.

Example:

## CVE Fix Complete: release-0.23

**Repository:** ../submariner-operator
**Branch:** fix-0.23-cves-2026-02-09
**Status:** Success

### Fixed (3 packages + stdlib)
- CVE-2025-61726, CVE-2025-61729, CVE-2025-61731: stdlib (go.mod updated to 1.24.12)
- GHSA-xxxx-xxxx-xxxx: golang.org/x/net
- GHSA-yyyy-yyyy-yyyy: github.com/docker/docker

### Requires Shipyard Update
- Stdlib CVEs fixed in go.mod, but Shipyard build image has Go 1.24.11. Recommend updating Shipyard to Fedora 42+ for Go 1.24.12
  to ensure CI passes.

### PR Command
git push origin fix-0.23-cves-2026-02-09 && gh pr create ...

### Warnings
⚠️  git fetch failed. Branch created from cached remote state. Run 'git fetch' and re-run if it fetches new commits.

Common Issues

Converted and distributed by TomeVault — claim your Tome and manage your conversions.