From c54e7e5b81adf556ecdaa0aa6b6ddbd49228fb81 Mon Sep 17 00:00:00 2001
From: Sebastian Wagner <sebastian@platform9.com>
Date: Fri, 21 Aug 2026 08:42:17 +0200
Subject: [PATCH] fix(lint): ignore gosec on untrusted path

---
 agent/reconciler/host_reconciler.go | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/agent/reconciler/host_reconciler.go b/agent/reconciler/host_reconciler.go
index afab64e02..b68773c86 100644
--- a/agent/reconciler/host_reconciler.go
+++ b/agent/reconciler/host_reconciler.go
@@ -349,7 +349,7 @@ func findPackageArtifact(dir, family string) (string, error) {
 // verifyChecksum checks path's sha256 against expected, formatted
 // "sha256:<hex>".
 func verifyChecksum(path, expected string) error {
-	data, err := os.ReadFile(path)
+	data, err := os.ReadFile(path) // #nosec G304 -- path comes from findPackageArtifact's filepath.Glob() with validated single match
 	if err != nil {
 		return err
 	}