From 2fe1dd127cdce16fade77478d2ee59c43da1c88d Mon Sep 17 00:00:00 2001
From: Seongho Bae <me@seonghobae.me>
Date: Wed, 8 Jul 2026 06:40:25 +0900
Subject: [PATCH] fix(security): scope Trivy private-key ignore to vendored
 openssl doc

Trivy's Secret scanner flags 2x HIGH AsymmetricPrivateKey (rule id:
private-key) in
packrat/lib/x86_64-pc-linux-gnu/3.4.1/openssl/doc/keys.html. That file is
vendored upstream documentation for the R "openssl" package; the PEM blocks
are EXAMPLE keys emitted by the doc's own write_pem() demonstration, not a
live credential. This is a false positive.

Add a path-scoped, documented suppression instead of globally disabling the
rule:
  - .trivyignore.yaml scopes the `private-key` ignore to
    packrat/lib/**/openssl/doc/keys.html only.
  - trivy.yaml sets `ignorefile: .trivyignore.yaml` so the YAML ignore is
    applied on a bare `trivy fs .` (Trivy 0.71.x auto-detects only a plain,
    non-path-scoped .trivyignore).

Real private keys committed anywhere else in the repo still fail the scan
(verified: same key content at another path still reports HIGH).

Local verification (trivy 0.71.1, fresh DB):
  trivy fs . --scanners vuln,secret,misconfig --severity CRITICAL,HIGH --ignore-unfixed
  before: 2 HIGH private-key   after: 0 (no new CRITICAL/HIGH introduced)

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01RTAMs4bpSZS77Xe3RQjv9P
---
 .trivyignore.yaml | 22 ++++++++++++++++++++++
 trivy.yaml        |  8 ++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 .trivyignore.yaml
 create mode 100644 trivy.yaml

diff --git a/.trivyignore.yaml b/.trivyignore.yaml
new file mode 100644
index 0000000..eeb0924
--- /dev/null
+++ b/.trivyignore.yaml
@@ -0,0 +1,22 @@
+# Trivy ignore rules (.trivyignore.yaml)
+#
+# Loaded via trivy.yaml (`ignorefile: .trivyignore.yaml`) so it applies to a
+# bare `trivy fs .`. Trivy 0.71.x only auto-detects a plain `.trivyignore`
+# (line-based, NO path scoping); the YAML form used here is what lets us scope
+# the suppression to a single path instead of disabling a rule globally.
+#
+# Scope: ONE path-scoped secret suppression. This does NOT globally disable
+# private-key detection — a real private key committed anywhere else in the
+# repo will still fail the scan.
+#
+# Why this single entry is safe (verified false positive):
+#   The R "openssl" package is vendored under packrat/ for reproducible builds.
+#   Its bundled upstream HTML docs (openssl/doc/keys.html) print an EXAMPLE PEM
+#   key from the doc's own `write_pem()` demonstration. It is published upstream
+#   example material, not a live credential, so Trivy's Secret rule "private-key"
+#   (AsymmetricPrivateKey, HIGH) is a false positive here. We scope the ignore to
+#   exactly this vendored doc path.
+secrets:
+  - id: private-key
+    paths:
+      - "packrat/lib/**/openssl/doc/keys.html"
diff --git a/trivy.yaml b/trivy.yaml
new file mode 100644
index 0000000..2bcd24c
--- /dev/null
+++ b/trivy.yaml
@@ -0,0 +1,8 @@
+# Trivy configuration (auto-loaded from the repo root by `trivy fs .`).
+#
+# Its only job is to activate the path-scoped secret suppression in
+# .trivyignore.yaml. Trivy 0.71.x auto-detects only a plain `.trivyignore`
+# (which cannot scope a rule to a path); pointing `ignorefile` at the YAML file
+# lets us suppress the vendored-doc false positive WITHOUT globally disabling
+# private-key detection. See .trivyignore.yaml for the full justification.
+ignorefile: .trivyignore.yaml