Waive 3 Go code scanning vulnerability alerts. (#18007)

Waiving 3 Go code scanning alerts flagged by osv-scanner.
2024-04-03 16:04:01 -05:00
parent 1d80aa7668
commit 746309ca47
3 changed files with 22 additions and 0 deletions
@@ -0,0 +1,10 @@
+# Configure OSV-Scanner
+# https://google.github.io/osv-scanner/configuration/
+
+[[IgnoredVulns]]
+id = "GO-2022-0646"
+reason = "2024/04/02 - This project does not use github.com/aws/aws-sdk-go/service/s3/s3crypto. Reference: https://osv.dev/vulnerability/GO-2022-0646"
+
+[[IgnoredVulns]]
+id = "GO-2023-1788"
+reason = "2024/04/02 - When packaging linux files, we do not use global permissions. Manually verified that packed fleet-osquery files do not have group/global write permissions. Reference: https://osv.dev/vulnerability/GO-2023-1788"
@@ -0,0 +1,6 @@
+# Configure OSV-Scanner
+# https://google.github.io/osv-scanner/configuration/
+
+[[IgnoredVulns]]
+id = "GO-2022-0646"
+reason = "2024/04/02 - This project does not use github.com/aws/aws-sdk-go/service/s3/s3crypto. Reference: https://osv.dev/vulnerability/GO-2022-0646"
@@ -0,0 +1,6 @@
+# Configure OSV-Scanner
+# https://google.github.io/osv-scanner/configuration/
+
+[[IgnoredVulns]]
+id = "GO-2023-2402"
+reason = "2024/04/02 - This is not production code."