vulngate

Overview ¶

Command vulngate reads one govulncheck JSON stream and decides what to do about it.

It is the per-repository half of a pair. cmd/vulnscan asks "which of these 1800 repositories reach a known vulnerability", cloning each one; this judges the scan a single repository's own CI job has just produced, in that job, against that checkout. Neither replaces the other and the judging rules are shared, so each rule below says which wrong answer it came from.

• ⛔ THE EXIT STATUS IS NOT THE GATE. Measured on 2026-10-04: govulncheck exits 0 over an advisory it has decided this module does not call -- GO-2026-6443, a gRPC server that panics on a request with no :authority or Host header, in a version the module required. A lane reading the status is silent about exactly the finding somebody has to decide about.

• ⛔ UNREAD IS NOT CLEAN. govulncheck that cannot load the packages still prints its config, with no finding, and exits non-zero. Read as JSON alone that is a clean repository. A run is believed only when it carried a config AND an SBOM, because the SBOM is written only once the packages loaded. Taken from vulnscan, which learned it on a fleet sweep.

• ⛔ AN EMPTY ADVISORY LIST IS NOT A FAILED SCAN. An earlier version of this gate refused a stream carrying no `osv` message at all, as a proxy for "it did not run". That is a false failure waiting for a module whose dependencies and toolchain genuinely have nothing open against them -- and it was the wrong proxy, since the SBOM says what it was trying to say. The count is printed as information now.

• ⛔ A SCAN IS ONLY AS FRESH AS ITS DATABASE, and nothing in the stream makes that visible unless somebody prints it. A frozen mirror answers "nothing found" forever. So the database's own timestamp and its age are printed on every run, and an age beyond -max-db-age is refused. Found on 2026-10-11 by reading this gate's output and noticing it had no idea.

• ⛔ THE STANDARD LIBRARY IS JUDGED BY ONE VERSION -- the toolchain the scan ran under. -go holds the scan to it, so a lane that silently resolved a different toolchain is refused rather than believed. Also from vulnscan.

What it does with what it believes:

reachable from this module                      error
in a required module, with a RELEASED fix       error -- upgrade rather than carry it
anything else                                   a notice, named in the log

Exit status: 0 when nothing needs a decision, 1 when something does or when the scan cannot be believed, 2 on a usage error.