security: prove openpgp is not shipped

SECURITY.md

@@ -21,3 +21,7 @@ Report suspected vulnerabilities through this repository's private security advi
 The source tree and shipped CGO-disabled product binary must contain no Critical or High vulnerability and no secret. The disposable Ubuntu builder is also scanned, but is not shipped or run as the product.
 
 Critical or High records in the builder are accepted only when every record is an unfixed `affected` finding for the Ubuntu `linux-libc-dev` package. That package contains user-space API headers needed by GCC and Go race tests, not the vulnerable Linux kernel implementation. The gate reports the raw count and fails closed for any other package, fixed finding, status, package URL, or secret. This categorical rule follows the build boundary and does not require a version-specific list that becomes stale on each Ubuntu package refresh.
+
+## Go module applicability
+
+[`security/openvex.json`](security/openvex.json) records the reviewed `GO-2026-5932` applicability decision. The advisory is limited to the discontinued `golang.org/x/crypto/openpgp` package. Host Provisioner uses maintained SSH packages from the same module; the source gate enumerates the complete package graph and fails if `openpgp` becomes reachable or appears in the vendored tree. The VEX product identity is pinned to the resolved module version and must be updated whenever that version changes.

scripts/validate

@@ -27,6 +27,20 @@ if grep -R -n -E 'GO111MODULE=off|GO15VENDOREXPERIMENT' Dockerfile.dapper .githu
 fi
 go list -mod=vendor -deps ./... >/dev/null
 
+crypto_version=$(go list -mod=vendor -m -f '{{.Version}}' golang.org/x/crypto)
+grep -F -- "\"@id\": \"pkg:golang/golang.org/x/crypto@${crypto_version}\"" security/openvex.json >/dev/null || {
+  echo 'OpenVEX x/crypto identity does not match the resolved module.' >&2
+  exit 1
+}
+if go list -mod=vendor -deps ./... | grep -F 'golang.org/x/crypto/openpgp'; then
+  echo 'Vulnerable openpgp package is reachable.' >&2
+  exit 1
+fi
+if test -d vendor/golang.org/x/crypto/openpgp; then
+  echo 'Vulnerable openpgp package is present in the vendored tree.' >&2
+  exit 1
+fi
+
 echo Running: go vet
 go vet ./...
 echo Checking: gofmt

security/openvex.json

@@ -0,0 +1,22 @@
+{
+  "@context": "https://openvex.dev/ns/v0.2.0",
+  "@id": "https://github.com/PastureStack/host-provisioner/security/openvex/2026-08-26",
+  "author": "PastureStack contributors",
+  "timestamp": "2026-08-26T15:32:00+08:00",
+  "version": 1,
+  "statements": [
+    {
+      "vulnerability": {
+        "name": "GO-2026-5932"
+      },
+      "products": [
+        {
+          "@id": "pkg:golang/golang.org/x/crypto@v0.55.0"
+        }
+      ],
+      "status": "not_affected",
+      "justification": "vulnerable_code_not_present",
+      "impact_statement": "GO-2026-5932 is limited to the discontinued golang.org/x/crypto/openpgp package. Host Provisioner imports only maintained x/crypto primitives used by SSH; the complete vendored package graph contains no openpgp package. Govulncheck reports no imported-package or reachable-code finding."
+    }
+  ]
+}