security(osv): preserve direct-tarball provenance instead of npm false positives

[seonghobae]

Exact downstream defect

The organization-required Security Scan produces false-positive OSV failures when a pnpm lock entry uses an official direct tarball that intentionally carries a package version newer than the last vulnerable npm registry release.

Current central owner: protected .github main@c47afc2dc68488292c1db7c9d6f82dcd5360f181, .github/workflows/security-scan.yml.

Concrete downstream reproduction: ContextualWisdomLab/inkspan#318 predecessor exact head 9f1c8b732e9b91f152cfff2e9277b758c0959c4a, Security Scan run 32013961603, OSV job/check 95339355813, debug artifact 9282795069 (osv-scan-debug). The Inkspan lock pins SheetJS from the official immutable CDN tarball https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz.

The captured new-results.json classifies that lock entry as:

{"name":"xlsx","version":"0.20.3","ecosystem":"npm"}

and reports both GHSA-4r6h-8v6p-xvw6 / CVE-2023-30533 and GHSA-5pgg-2g8v-p4x9 / CVE-2024-22363. The same evidence embeds database_specific.last_known_affected_version_range values < 0.19.3 and < 0.20.2 respectively. Therefore 0.20.3 is outside both affected ranges, but the npm advisory records expose an open-ended SEMVER range because the fixed SheetJS releases are not npm-registry releases. Treating the direct CDN tarball as ordinary npm ecosystem evidence makes a patched package look permanently vulnerable.

This is a central scanner/provenance classification defect, not an Inkspan product vulnerability. An Inkspan-local advisory ignore would hide the causal control-plane defect and is not acceptable.

First causal boundary

The central workflow delegates direct manifest/lock evidence to OSV Scanner with --no-resolve and then treats the resulting npm-ecosystem finding as authoritative without retaining/validating the pnpm resolution origin. For direct immutable tarballs, package name/version alone is insufficient provenance for npm advisory semantics.

Required test-first repair

1. Add a RED central contract fixture containing a pnpm lock entry for exact official SheetJS CDN tarball xlsx-0.20.3.tgz; prove the current gate incorrectly fails it against the two GHSA records above.
2. Add a vulnerable control fixture (for example an npm-registry xlsx@0.18.5) that must continue to fail.
3. Preserve package-source provenance when interpreting OSV results. A finding may be suppressed/normalized only when an exact immutable non-registry source can be proven, its package/version identity is exact, and authoritative advisory metadata proves that exact source version is outside the affected range. Unknown, mutable, malformed, redirected, or unverifiable source identity must fail closed.
4. Do not add blanket GHSA ignores, package-name ignores, severity downgrades, continue-on-error, or a generic xlsx exception.
5. Keep the existing base/head diff semantics, exact PR head checkout, hard fail-on-new-vulnerability behavior, Trivy/dependency-review independence, immutable action pins, and least-privilege permissions.
6. Add an explicit malformed-source fixture and an npm xlsx@0.18.5 fixture to prove source confusion cannot manufacture green evidence.
7. Run focused contract tests plus the complete central security/quality suite, then canary on an exact current Inkspan fix(review): put contract-reliable reasoning models first, flagships last #318 head that still pins the same official 0.20.3 CDN tarball.

GREEN acceptance

• direct official CDN xlsx@0.20.3 is not classified as a vulnerable npm release merely because its lock entry has the same package name;
• npm-registry vulnerable xlsx@0.18.5 still hard-fails;
• unknown/unverifiable direct sources fail closed or remain findings;
• the resulting OSV evidence records package source/provenance sufficiently to audit why a finding was retained or excluded;
• Inkspan reruns Security Scan on the then-current exact PR head and obtains fresh evidence; predecessor success is not transferred.

Inkspan-side revalidation criterion

After the central repair reaches protected .github main, rerun the required Security Scan for the unchanged then-current ContextualWisdomLab/inkspan#318 head and require the OSV job to inspect the official xlsx-0.20.3 tarball without those two false-positive npm-ecosystem findings. All other required Inkspan checks remain independently required.

[seonghobae]

Fresh Inkspan consumer evidence for the existing central-owner repair path (updated in place; this snapshot supersedes predecessor consumer and owner-PR metadata):

• affected consumer: ContextualWisdomLab/inkspan#318, exact unchanged head fce8fe72ebf4d438c17a7c889dd37c92118c6204, Draft/mergeable against protected inkspan/main@3b38ead2d00f44eb578d0689087b9293b3dabe1e;
• consumer CI 32144783586 and SAST 32144783644 are terminal success; required Security Scan 32144783558 remains terminal failure at exact OSV job 95735816267 after both base/head scans, specifically at Report PR-introduced OSV findings;
• exact debug artifact 9328396543, digest sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d, remains bound to that run/head; Trivy 95735816261, Scorecard 95735816309, and dependency-review wrapper 95735816431 succeeded;
• protected central owner baseline is now signed .github/main@6479989bbff475404cc2cccc468d5fb1d6c632e5;
• contrary to this comment's predecessor snapshot, the existing implementation owner now exists as Ready/open/mergeable .github#1158 (fix/osv): preserve immutable direct-source provenance) at exact head f285fd790ba12161ad6385a46d9e3e60371103b4, base 6479989bbff475404cc2cccc468d5fb1d6c632e5. Do not create a competing writer;
• all current-head fix(osv): preserve immutable direct-source provenance #1158 hosted workflows are terminal success: OSV Direct Source Quality CI 32378887519, OSV-Scanner PR 32378888535, SBOM 32378887599, Secret 32378887719, SAST 32378887415, Scorecard 32378887778, Security 32378887899, CodeQL 32378887551, and Python Security 32378887965;
• formal submitted reviews on fix(osv): preserve immutable direct-source provenance #1158 remain 0. The single exact-head OpenCode request is issue-comment 5360429583; its current direct reaction set is empty. This is non-passing review evidence, but the request is already present, so do not duplicate it.

RCA is now source-repaired on the existing owner branch rather than merely diagnosed: the reusable Security Scan previously discarded direct-tarball URL/integrity provenance before OSV verdict interpretation, allowing npm-registry advisory ranges to be attributed to the official immutable SheetJS CE 0.20.3 tarball. #1158 preserves immutable direct-source provenance, retains genuine affected releases and malformed/unknown/conflicting metadata fail-closed, and does not suppress advisory IDs or severities.

Owner-path GREEN before consumer replay: unchanged exact #1158 head must satisfy every live protected central workflow/review gate and integrate to protected .github/main; predecessor or status-only evidence does not transfer. Consumer GREEN after that protected integration: rerun required Security Scan on the then-unchanged #318 head. OSV must stop attributing the two npm-registry advisories to the proven official xlsx@0.20.3 artifact while genuine affected dependencies and unrelated advisories remain fail-closed. Do not rerun #318 before protected owner integration, and do not add an Inkspan-local ignore, dependency rename, severity downgrade, or gate bypass.

[seonghobae]

Fresh downstream revalidation on the existing owner path, without any Inkspan advisory suppression or dependency rewrite:

• consumer: ContextualWisdomLab/inkspan#318
• exact current head: fce8fe72ebf4d438c17a7c889dd37c92118c6204
• live protected Inkspan base: 3b38ead2d00f44eb578d0689087b9293b3dabe1e
• live protected central baseline: .github/main@bbedc1a51ec1a2421f129955c629b3cd0507a4ec
• fresh open-PR search for repo:ContextualWisdomLab/.github is:pr is:open 1096: no active implementation PR; security(osv): preserve direct-tarball provenance instead of npm false positives #1096 remains the existing owner path
• repository CI 32144783586: success
• SAST Semgrep 32144783644: success
• Security Scan 32144783558: failure
• exact failing job 95735816267 (osv-scan): base scan success, head scan success, required output success, then Report PR-introduced OSV findings fails; SARIF upload and debug-artifact upload succeed
• parallel same-run Trivy 95735816261: success; Scorecard 95735816309: success; dependency-review 95735816431: support check success, action step skipped
• exact osv-scan-debug artifact 9328396543, digest sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d, explicitly bound by GitHub to head fce8fe72ebf4d438c17a7c889dd37c92118c6204 and run 32144783558.

The first causal boundary remains central provenance classification: the official immutable SheetJS CDN resolution is reduced to npm ecosystem name/version evidence before OSV findings are interpreted. Protected central movement through bbedc1a... does not itself satisfy #1096 because no source/test repair for this contract is present on protected main and no active owner PR exists.

Keep the owner repair test-first and fail-closed: official immutable SheetJS CDN xlsx@0.20.3 as the false-positive RED fixture, npm-registry xlsx@0.18.5 as the vulnerable positive control, and malformed/mutable/unverifiable direct source as fail-closed controls. Do not add package/GHSA ignores, continue-on-error, severity downgrades, or an Inkspan-local exception.

GREEN acceptance remains a fresh required Security Scan on the then-unchanged #318 head after the central repair reaches protected .github/main; OSV must stop attributing those two npm-registry advisories to the proven direct xlsx@0.20.3 artifact while genuine affected dependencies and unrelated advisories remain fail-closed.

[seonghobae]

Fresh owner-boundary verification against the current protected central source supersedes every older owner-baseline SHA in this issue without changing the Inkspan consumer or adding a local workaround.

• protected central owner baseline: .github/main@9e9f59f3ac1e96a960c021b131d768c238f4c21a;
• exact current central .github/workflows/security-scan.yml (blob c3b8fa5dbbb21a684209683a3d4b6d29c8e0d536) still feeds base/head --no-resolve OSV JSON directly to google/osv-scanner-action/osv-reporter-action with --fail-on-vuln=true; it prints the OSV source.path/name but does not preserve or validate pnpm direct-tarball origin before npm-ecosystem advisory interpretation;
• affected consumer remains ContextualWisdomLab/inkspan#318@fce8fe72ebf4d438c17a7c889dd37c92118c6204 against inkspan/main@3b38ead2d00f44eb578d0689087b9293b3dabe1e; the PR is still Draft and mechanically mergeable;
• exact consumer CI 32144783586 and SAST 32144783644 remain success; Security Scan 32144783558 remains failure at OSV job 95735816267, first hard failure Report PR-introduced OSV findings, with debug artifact 9328396543 / sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d;
• current fix(review): put contract-reliable reasoning models first, flagships last #318 still pins the official immutable SheetJS CE tarball https://cdn.sheetjs.com/xlsx-0.20.3/xlsx-0.20.3.tgz; no advisory ignore, package rename, severity downgrade, continue-on-error, or Inkspan-local suppression has been introduced.

The falsifiable RCA therefore still lands at the central provenance-classification boundary on current protected source: direct pnpm artifact provenance is discarded before the reporter compares the resulting npm package/version advisory records. Movement of central main through 9e9f59f... (including the unrelated trusted-uv repair from #1136) does not satisfy #1096's RED/GREEN acceptance.

Keep the owner repair test-first and fail-closed: official immutable CDN xlsx@0.20.3 as the false-positive RED fixture; npm-registry xlsx@0.18.5 as the vulnerable positive control; malformed/mutable/unverifiable source as negative controls. Only authenticated immutable direct-source provenance plus authoritative affected-range evidence may normalize a finding. Do not add blanket GHSA/package ignores, continue-on-error, severity downgrades, or an Inkspan-local exception.

GREEN consumer criterion remains a genuinely fresh Security Scan on the then-unchanged exact #318 head after the central repair reaches protected .github/main; OSV must cease attributing the two npm-registry advisories to the proven official xlsx@0.20.3 direct artifact while genuine applicable findings remain fail-closed. Any later #318 head movement invalidates this canary and requires exact evidence refresh.

[seonghobae]

Fresh exact-boundary refresh for the existing Inkspan consumer canary; no competing source writer created.

• protected central owner baseline is now .github/main@bbedc1a51ec1a2421f129955c629b3cd0507a4ec (protected);
• a fresh central open-PR search for 1096 still returns no implementation PR;
• affected consumer remains ContextualWisdomLab/inkspan#318@fce8fe72ebf4d438c17a7c889dd37c92118c6204, Draft/mergeable against protected Inkspan main@3b38ead2d00f44eb578d0689087b9293b3dabe1e;
• its exact-head repository CI 32144783586 and SAST 32144783644 remain success, while required Security Scan 32144783558 remains failure at OSV job 95735816267 after successful base/head scans, with the hard failure at Report PR-introduced OSV findings and debug artifact 9328396543 / sha256:594d8a8551017a78c98a33b6574bfbb9ce945f8b202988788ab96b224c3cfd3d;
• no Inkspan dependency rewrite, GHSA/package ignore, severity downgrade, or gate bypass has been introduced.

The protected central movement through bbedc1a5... does not contain/evidence #1096's required provenance-aware RED→GREEN repair, so rerunning #318 now would only replay the same false-positive classification and is not a causal action. The owner acceptance remains: official immutable CDN xlsx@0.20.3 negative fixture; npm-registry xlsx@0.18.5 vulnerable positive control; malformed/unverifiable direct sources fail closed; provenance/audit evidence retained; then a fresh required Security Scan on the unchanged then-current #318 head. Please keep this issue as the sole central writer until that implementation exists.