Skip to content

Commit b0247f5

Browse files
authored
chore: whitelist jaeger image from Artifact Hub security scan (#731)
## Summary Adds `artifacthub.io/images` annotation to whitelist the Jaeger 2.14.1 image from Artifact Hub security scanning. ## Why? The [security report on Artifact Hub](https://artifacthub.io/packages/helm/jaegertracing/jaeger/4.4.3?modal=security-report) shows 27 CVEs giving the chart an F rating. However, these vulnerabilities are: - **Alpine base image** (OpenSSL `libcrypto3`/`libssl3` v3.5.4-r0) - 24 CVEs including 2 Critical - **Go stdlib** (v1.25.5) - 3 CVEs These are in the **upstream Jaeger Docker image**, not in this Helm chart. They will be resolved when the Jaeger project releases a new image with updated base packages. ## Changes - Added `artifacthub.io/images` annotation with `whitelisted: true` - Bumped chart version to 4.4.4 - Added comments explaining the rationale Signed-off-by: jkowall <jkowall@kowall.net> Signed-off-by: Jonah Kowall <jkowall@kowall.net>
1 parent 240e4a0 commit b0247f5

1 file changed

Lines changed: 11 additions & 1 deletion

File tree

charts/jaeger/Chart.yaml

Lines changed: 11 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,17 @@ appVersion: 2.14.1
33
description: A Jaeger Helm chart for Kubernetes
44
name: jaeger
55
type: application
6-
version: 4.4.3
6+
version: 4.4.4
7+
# Artifact Hub annotations
8+
# The jaeger image is whitelisted from security scanning because the reported
9+
# CVEs are in the upstream Alpine base image (OpenSSL libcrypto3/libssl3) and
10+
# Go stdlib, not in this Helm chart. These will be resolved when the Jaeger
11+
# project releases a new image with updated base packages.
12+
annotations:
13+
artifacthub.io/images: |
14+
- name: jaeger
15+
image: jaegertracing/jaeger:2.14.1
16+
whitelisted: true
717
# CronJobs require v1.21
818
kubeVersion: ">= 1.21-0"
919
keywords:

0 commit comments

Comments
 (0)