fix(security): suppress non-reachable GO-2026-4337 in gosu binary

.grype.yaml

@@ -97,6 +97,39 @@ ignore:
       type: go-module
       location: "/usr/local/bin/gh"
 
+  # ── stdlib@go1.24.6 embedded in gosu binary ──────────────────────────────────
+  #
+  # GO-2026-4337 (stdlib go1.24.6 -> 1.24.13 / 1.25.7 / 1.26.0-rc.3, CRITICAL):
+  #   During TLS session resumption, changes to ClientCAs or RootCAs between
+  #   the original and resumed handshakes may be ignored, allowing a peer
+  #   whose certificate is no longer trusted to resume the session.
+  #
+  #   Risk acceptance — NOT REACHABLE in gosu:
+  #     gosu is a minimal setuid/exec privilege-drop binary (github.com/tianon/gosu
+  #     v1.19.0). It accepts a user specification and a command, sets up credentials
+  #     via setuid(2)/setgid(2), and calls execve(2). It contains no network code,
+  #     opens no TLS connections, and never calls any crypto/tls function. The
+  #     affected TLS resumption path is entirely unreachable in this binary.
+  #     govulncheck analysis confirms: gosu does not import or exercise any
+  #     crypto/tls code paths (upstream tracking: tianon/gosu#176).
+  #
+  #   No fix is shippable today:
+  #     gosu 1.19.0 is the latest upstream release; no newer official release
+  #     rebuilt with Go >= 1.24.13 exists as of 2026-07-27. Building gosu from
+  #     unreleased source would ship an untagged, unofficial binary (worse
+  #     supply-chain posture than accepting a non-reachable CVE finding).
+  #
+  #   Revisit: once a new official gosu release (> 1.19.0) built with Go >= 1.24.13
+  #   is published, update the GOSU_VERSION pin and per-architecture SHA256
+  #   checksums in containers/agent/Dockerfile and DELETE this entry.
+  #   Tracked in github/gh-aw-firewall#6640.
+  - vulnerability: GO-2026-4337
+    package:
+      name: stdlib
+      version: "go1.24.6"
+      type: go-module
+      location: "/usr/local/bin/gosu"
+
   # ── brace-expansion bundled inside the vendored npm CLI ──────────────────────
   #
   # GHSA-mh99-v99m-4gvg (brace-expansion <=5.0.7 -> 5.0.8, HIGH):

containers/agent/Dockerfile

@@ -70,6 +70,10 @@ RUN set -eux; \
     apt_install_retry $PKGS && \
     # Install gosu 1.19 from GitHub releases (compiled with Go 1.24.6 — avoids Ubuntu's
     # apt gosu which is compiled with Go 1.18 and carries 44 stdlib CVEs including Critical ones).
+    # GO-2026-4337 (TLS session resumption in Go stdlib) is reported against this binary by
+    # Grype, but is NOT REACHABLE: gosu is a pure setuid/exec privilege-drop tool with no
+    # network or TLS code. It is suppressed in .grype.yaml with a full justification.
+    # See also: tianon/gosu#176 for the upstream govulncheck reachability policy.
     # Checksums sourced from https://github.com/tianon/gosu/releases/tag/1.19
     GOSU_VERSION="1.19" && \
     GOSU_ARCH="$(dpkg --print-architecture)" && \