Commit b0247f5
authored
chore: whitelist jaeger image from Artifact Hub security scan (#731)
## Summary
Adds `artifacthub.io/images` annotation to whitelist the Jaeger 2.14.1
image from Artifact Hub security scanning.
## Why?
The [security report on Artifact
Hub](https://artifacthub.io/packages/helm/jaegertracing/jaeger/4.4.3?modal=security-report)
shows 27 CVEs giving the chart an F rating. However, these
vulnerabilities are:
- **Alpine base image** (OpenSSL `libcrypto3`/`libssl3` v3.5.4-r0) - 24
CVEs including 2 Critical
- **Go stdlib** (v1.25.5) - 3 CVEs
These are in the **upstream Jaeger Docker image**, not in this Helm
chart. They will be resolved when the Jaeger project releases a new
image with updated base packages.
## Changes
- Added `artifacthub.io/images` annotation with `whitelisted: true`
- Bumped chart version to 4.4.4
- Added comments explaining the rationale
Signed-off-by: jkowall <jkowall@kowall.net>
Signed-off-by: Jonah Kowall <jkowall@kowall.net>1 parent 240e4a0 commit b0247f5
1 file changed
Lines changed: 11 additions & 1 deletion
| Original file line number | Diff line number | Diff line change | |
|---|---|---|---|
| |||
3 | 3 | | |
4 | 4 | | |
5 | 5 | | |
6 | | - | |
| 6 | + | |
| 7 | + | |
| 8 | + | |
| 9 | + | |
| 10 | + | |
| 11 | + | |
| 12 | + | |
| 13 | + | |
| 14 | + | |
| 15 | + | |
| 16 | + | |
7 | 17 | | |
8 | 18 | | |
9 | 19 | | |
| |||
0 commit comments