security(osv): preserve direct-tarball provenance instead of npm false positives

Exact downstream defect

The organization-required Security Scan produces false-positive OSV failures when a pnpm lock entry uses an official direct tarball that intentionally carries a package version newer than the last vulnerable npm registry release.

Current central owner: protected .github main@c47afc2dc68488292c1db7c9d6f82dcd5360f181, .github/workflows/security-scan.yml.

Concrete downstream reproduction: ContextualWisdomLab/inkspan#318 predecessor exact head 9f1c8b732e9b91f152cfff2e9277b758c0959c4a, Security Scan run 32013961603, OSV job/check 95339355813, debug artifact 9282795069 (osv-scan-debug). The Inkspan lock pins SheetJS from the official immutable CDN tarball https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz.

The captured new-results.json classifies that lock entry as:

{"name":"xlsx","version":"0.20.3","ecosystem":"npm"}

and reports both GHSA-4r6h-8v6p-xvw6 / CVE-2023-30533 and GHSA-5pgg-2g8v-p4x9 / CVE-2024-22363. The same evidence embeds database_specific.last_known_affected_version_range values < 0.19.3 and < 0.20.2 respectively. Therefore 0.20.3 is outside both affected ranges, but the npm advisory records expose an open-ended SEMVER range because the fixed SheetJS releases are not npm-registry releases. Treating the direct CDN tarball as ordinary npm ecosystem evidence makes a patched package look permanently vulnerable.

This is a central scanner/provenance classification defect, not an Inkspan product vulnerability. An Inkspan-local advisory ignore would hide the causal control-plane defect and is not acceptable.

First causal boundary

The central workflow delegates direct manifest/lock evidence to OSV Scanner with --no-resolve and then treats the resulting npm-ecosystem finding as authoritative without retaining/validating the pnpm resolution origin. For direct immutable tarballs, package name/version alone is insufficient provenance for npm advisory semantics.

Required test-first repair

Add a RED central contract fixture containing a pnpm lock entry for exact official SheetJS CDN tarball xlsx-0.20.3.tgz; prove the current gate incorrectly fails it against the two GHSA records above.
Add a vulnerable control fixture (for example an npm-registry xlsx@0.18.5) that must continue to fail.
Preserve package-source provenance when interpreting OSV results. A finding may be suppressed/normalized only when an exact immutable non-registry source can be proven, its package/version identity is exact, and authoritative advisory metadata proves that exact source version is outside the affected range. Unknown, mutable, malformed, redirected, or unverifiable source identity must fail closed.
Do not add blanket GHSA ignores, package-name ignores, severity downgrades, continue-on-error, or a generic xlsx exception.
Keep the existing base/head diff semantics, exact PR head checkout, hard fail-on-new-vulnerability behavior, Trivy/dependency-review independence, immutable action pins, and least-privilege permissions.
Add an explicit malformed-source fixture and an npm xlsx@0.18.5 fixture to prove source confusion cannot manufacture green evidence.
Run focused contract tests plus the complete central security/quality suite, then canary on an exact current Inkspan fix(review): put contract-reliable reasoning models first, flagships last #318 head that still pins the same official 0.20.3 CDN tarball.

GREEN acceptance

direct official CDN xlsx@0.20.3 is not classified as a vulnerable npm release merely because its lock entry has the same package name;
npm-registry vulnerable xlsx@0.18.5 still hard-fails;
unknown/unverifiable direct sources fail closed or remain findings;
the resulting OSV evidence records package source/provenance sufficiently to audit why a finding was retained or excluded;
Inkspan reruns Security Scan on the then-current exact PR head and obtains fresh evidence; predecessor success is not transferred.

Inkspan-side revalidation criterion

After the central repair reaches protected .github main, rerun the required Security Scan for the unchanged then-current ContextualWisdomLab/inkspan#318 head and require the OSV job to inspect the official xlsx-0.20.3 tarball without those two false-positive npm-ecosystem findings. All other required Inkspan checks remain independently required.

Fresh Inkspan consumer evidence for the existing central-owner repair path (updated in place; this snapshot supersedes predecessor consumer and owner-PR metadata):

affected consumer: ContextualWisdomLab/inkspan#318, exact unchanged head fce8fe72ebf4d438c17a7c889dd37c92118c6204, Draft/mergeable against protected inkspan/main@3b38ead2d00f44eb578d0689087b9293b3dabe1e;
consumer CI 32144783586 and SAST 32144783644 are terminal success; required Security Scan 32144783558 remains terminal failure at exact OSV job 95735816267 after both base/head scans, specifically at Report PR-introduced OSV findings;
exact debug artifact 9328396543, digest sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d, remains bound to that run/head; Trivy 95735816261, Scorecard 95735816309, and dependency-review wrapper 95735816431 succeeded;
protected central owner baseline is now signed .github/main@6479989bbff475404cc2cccc468d5fb1d6c632e5;
contrary to this comment's predecessor snapshot, the existing implementation owner now exists as Ready/open/mergeable .github#1158 (fix/osv): preserve immutable direct-source provenance) at exact head f285fd790ba12161ad6385a46d9e3e60371103b4, base 6479989bbff475404cc2cccc468d5fb1d6c632e5. Do not create a competing writer;
all current-head fix(osv): preserve immutable direct-source provenance #1158 hosted workflows are terminal success: OSV Direct Source Quality CI 32378887519, OSV-Scanner PR 32378888535, SBOM 32378887599, Secret 32378887719, SAST 32378887415, Scorecard 32378887778, Security 32378887899, CodeQL 32378887551, and Python Security 32378887965;
formal submitted reviews on fix(osv): preserve immutable direct-source provenance #1158 remain 0. The single exact-head OpenCode request is issue-comment 5360429583; its current direct reaction set is empty. This is non-passing review evidence, but the request is already present, so do not duplicate it.

RCA is now source-repaired on the existing owner branch rather than merely diagnosed: the reusable Security Scan previously discarded direct-tarball URL/integrity provenance before OSV verdict interpretation, allowing npm-registry advisory ranges to be attributed to the official immutable SheetJS CE 0.20.3 tarball. #1158 preserves immutable direct-source provenance, retains genuine affected releases and malformed/unknown/conflicting metadata fail-closed, and does not suppress advisory IDs or severities.

Owner-path GREEN before consumer replay: unchanged exact #1158 head must satisfy every live protected central workflow/review gate and integrate to protected .github/main; predecessor or status-only evidence does not transfer. Consumer GREEN after that protected integration: rerun required Security Scan on the then-unchanged #318 head. OSV must stop attributing the two npm-registry advisories to the proven official xlsx@0.20.3 artifact while genuine affected dependencies and unrelated advisories remain fail-closed. Do not rerun #318 before protected owner integration, and do not add an Inkspan-local ignore, dependency rename, severity downgrade, or gate bypass.

Fresh downstream revalidation on the existing owner path, without any Inkspan advisory suppression or dependency rewrite:

consumer: ContextualWisdomLab/inkspan#318
exact current head: fce8fe72ebf4d438c17a7c889dd37c92118c6204
live protected Inkspan base: 3b38ead2d00f44eb578d0689087b9293b3dabe1e
live protected central baseline: .github/main@bbedc1a51ec1a2421f129955c629b3cd0507a4ec
fresh open-PR search for repo:ContextualWisdomLab/.github is:pr is:open 1096: no active implementation PR; security(osv): preserve direct-tarball provenance instead of npm false positives #1096 remains the existing owner path
repository CI 32144783586: success
SAST Semgrep 32144783644: success
Security Scan 32144783558: failure
exact failing job 95735816267 (osv-scan): base scan success, head scan success, required output success, then Report PR-introduced OSV findings fails; SARIF upload and debug-artifact upload succeed
parallel same-run Trivy 95735816261: success; Scorecard 95735816309: success; dependency-review 95735816431: support check success, action step skipped
exact osv-scan-debug artifact 9328396543, digest sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d, explicitly bound by GitHub to head fce8fe72ebf4d438c17a7c889dd37c92118c6204 and run 32144783558.

The first causal boundary remains central provenance classification: the official immutable SheetJS CDN resolution is reduced to npm ecosystem name/version evidence before OSV findings are interpreted. Protected central movement through bbedc1a... does not itself satisfy #1096 because no source/test repair for this contract is present on protected main and no active owner PR exists.

Keep the owner repair test-first and fail-closed: official immutable SheetJS CDN xlsx@0.20.3 as the false-positive RED fixture, npm-registry xlsx@0.18.5 as the vulnerable positive control, and malformed/mutable/unverifiable direct source as fail-closed controls. Do not add package/GHSA ignores, continue-on-error, severity downgrades, or an Inkspan-local exception.

GREEN acceptance remains a fresh required Security Scan on the then-unchanged #318 head after the central repair reaches protected .github/main; OSV must stop attributing those two npm-registry advisories to the proven direct xlsx@0.20.3 artifact while genuine affected dependencies and unrelated advisories remain fail-closed.

Fresh owner-boundary verification against the current protected central source supersedes every older owner-baseline SHA in this issue without changing the Inkspan consumer or adding a local workaround.

protected central owner baseline: .github/main@9e9f59f3ac1e96a960c021b131d768c238f4c21a;
exact current central .github/workflows/security-scan.yml (blob c3b8fa5dbbb21a684209683a3d4b6d29c8e0d536) still feeds base/head --no-resolve OSV JSON directly to google/osv-scanner-action/osv-reporter-action with --fail-on-vuln=true; it prints the OSV source.path/name but does not preserve or validate pnpm direct-tarball origin before npm-ecosystem advisory interpretation;
affected consumer remains ContextualWisdomLab/inkspan#318@fce8fe72ebf4d438c17a7c889dd37c92118c6204 against inkspan/main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; the PR is still Draft and mechanically mergeable;
exact consumer CI 32144783586 and SAST 32144783644 remain success; Security Scan 32144783558 remains failure at OSV job 95735816267, first hard failure Report PR-introduced OSV findings, with debug artifact 9328396543 / sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d;
current fix(review): put contract-reliable reasoning models first, flagships last #318 still pins the official immutable SheetJS CE tarball https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz; no advisory ignore, package rename, severity downgrade, continue-on-error, or Inkspan-local suppression has been introduced.

The falsifiable RCA therefore still lands at the central provenance-classification boundary on current protected source: direct pnpm artifact provenance is discarded before the reporter compares the resulting npm package/version advisory records. Movement of central main through 9e9f59f... (including the unrelated trusted-uv repair from #1136) does not satisfy #1096's RED/GREEN acceptance.

Keep the owner repair test-first and fail-closed: official immutable CDN xlsx@0.20.3 as the false-positive RED fixture; npm-registry xlsx@0.18.5 as the vulnerable positive control; malformed/mutable/unverifiable source as negative controls. Only authenticated immutable direct-source provenance plus authoritative affected-range evidence may normalize a finding. Do not add blanket GHSA/package ignores, continue-on-error, severity downgrades, or an Inkspan-local exception.

GREEN consumer criterion remains a genuinely fresh Security Scan on the then-unchanged exact #318 head after the central repair reaches protected .github/main; OSV must cease attributing the two npm-registry advisories to the proven official xlsx@0.20.3 direct artifact while genuine applicable findings remain fail-closed. Any later #318 head movement invalidates this canary and requires exact evidence refresh.

Fresh exact-boundary refresh for the existing Inkspan consumer canary; no competing source writer created.

protected central owner baseline is now .github/main@bbedc1a51ec1a2421f129955c629b3cd0507a4ec (protected);
a fresh central open-PR search for 1096 still returns no implementation PR;
affected consumer remains ContextualWisdomLab/inkspan#318@fce8fe72ebf4d438c17a7c889dd37c92118c6204, Draft/mergeable against protected Inkspan main@3b38ead2d00f44eb578d0689087b9293b3dabe1e;
its exact-head repository CI 32144783586 and SAST 32144783644 remain success, while required Security Scan 32144783558 remains failure at OSV job 95735816267 after successful base/head scans, with the hard failure at Report PR-introduced OSV findings and debug artifact 9328396543 / sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d;
no Inkspan dependency rewrite, GHSA/package ignore, severity downgrade, or gate bypass has been introduced.

The protected central movement through bbedc1a5... does not contain/evidence #1096's required provenance-aware RED→GREEN repair, so rerunning #318 now would only replay the same false-positive classification and is not a causal action. The owner acceptance remains: official immutable CDN xlsx@0.20.3 negative fixture; npm-registry xlsx@0.18.5 vulnerable positive control; malformed/unverifiable direct sources fail closed; provenance/audit evidence retained; then a fresh required Security Scan on the unchanged then-current #318 head. Please keep this issue as the sole central writer until that implementation exists.

Fresh live owner-path snapshot superseding earlier comments that reported no implementation PR:

canonical owner is open/Ready/mergeable #1158 at exact head f5d1cf48c0946b44ef6eb0131e665a53476b9d0a;
protected central main is 1ff8268255b061461d9d49b4cab4febf9a8e7bfa; fix(osv): preserve immutable direct-source provenance #1158 is diverged 82 ahead / 2 behind with merge base 1d8e872487838e16a003e96e76df9300c388e258;
exact-head OSV Direct Source Quality run/job 33311531445/99257360068 passed 1,922 tests, 1 skip, 75 subtests, with 292/292 statements and 100/100 branches;
exact-head Security Scan run 33311531488 attested the submitted head in Trivy, OSV, and dependency-review; the authoritative base/head OSV comparison completed with zero head findings and provenance reconciliation/reporting succeeded;
this is not integration-ready evidence: current formal approval is absent. All current non-outdated threads are resolved after independent exact-source verification, including the final residual-groups behavior against pinned upstream OSV Scanner v2.3.8 commit 408fcd6f8707999a29e7ba45e15809764cf24f67. Required OpenCode correctly fails without an exact-head formal verdict, required Noema incorrectly returns GitHub-success after skipping for that missing verdict, and required Strix was cancelled without an authoritative report.

The #1158 body now carries these exact identities and terminal results. Do not create a competing writer or rerun Inkspan #318 yet. Acceptance remains normal protected-main integration followed by a fresh unchanged exact-head Inkspan Security Scan proving official immutable xlsx@0.20.3 no longer receives the already-remediated npm advisories while affected and unverifiable controls remain fail-closed.

Fresh canonical owner snapshot (2026-08-31 KST): #1158 is now synchronized with protected main@1ff8268255b061461d9d49b4cab4febf9a8e7bfa at exact head 6e8d1a805e68a4a0a435486ce7e4c0c53edc0480 via a normal two-parent merge commit (no force update).

Fresh exact-tree verification:

focused OSV/required-workflow contracts: 93 passed, 54 subtests
full central suite: 1,955 passed, 1 skipped, 75 subtests
reconciler coverage: 292/292 statements and 100/100 branches; compileall clean
hosted exact-head OSV Scanner, Security Scan, SAST, CodeQL, Python Security, OSV Direct Source Quality, SBOM/attestation, Secret Scan, Scorecard, commercial-readiness quality, and Strix changed-path quality all completed successfully.

This is source/quality evidence only. #1158 still has no qualifying formal approval and no fresh authoritative required Strix/OpenCode verdict on this exact head, so it remains unmerged. Issue #1096 must remain open until protected-main integration and a fresh then-current Inkspan #318 Security Scan prove the direct-tarball contradiction is gone without weakening genuine findings.

Navigation Menu

Repository navigation

security(osv): preserve direct-tarball provenance instead of npm false positives #1096

Exact downstream defect

First causal boundary

Required test-first repair

GREEN acceptance

Inkspan-side revalidation criterion

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

security(osv): preserve direct-tarball provenance instead of npm false positives #1096

Description

Exact downstream defect

First causal boundary

Required test-first repair

GREEN acceptance

Inkspan-side revalidation criterion

Activity

seonghobae commented on Aug 17, 2026

seonghobae commented on Aug 18, 2026

seonghobae commented on Aug 18, 2026

seonghobae commented on Aug 19, 2026

seonghobae commented on Aug 30, 2026

seonghobae commented on Aug 30, 2026

Metadata

Metadata

Assignees

Labels

Type

Projects

Milestone

Relationships

Development

Issue actions