# GENERATED by tests/supply-chain/check_exceptions.py --emit-gate.
# Source of truth: tests/supply-chain/exceptions.json (owner: rarguello, review: 2026-11-17).
# Do not edit: edit the record and regenerate.
check-for-app-update: false
ignore:
  - vulnerability: GO-2026-6604
    reason: "Accepted by the owner on 2026-10-17. Not a false positive: the vulnerable Go module and stdlib are compiled into binaries the base installs (podman, skopeo, toolbox, ipp-usb), and DeskOS neither builds nor patches them, so the fix is the distribution's rebuild. A newer base was checked first: the current CentOS Stream 10 base still carries them, so the rebuild has not happened yet. This record makes the acceptance explicit and expires on the review date below."
    package:
      name: stdlib
      type: go-module
      version: go1.25.7
  - vulnerability: GO-2026-6604
    reason: "Accepted by the owner on 2026-10-17. Not a false positive: the vulnerable Go module and stdlib are compiled into binaries the base installs (podman, skopeo, toolbox, ipp-usb), and DeskOS neither builds nor patches them, so the fix is the distribution's rebuild. A newer base was checked first: the current CentOS Stream 10 base still carries them, so the rebuild has not happened yet. This record makes the acceptance explicit and expires on the review date below."
    package:
      name: stdlib
      type: go-module
      version: go1.26.5
  - vulnerability: GO-2026-6612
    reason: "Accepted by the owner on 2026-10-17. Not a false positive: the vulnerable Go module and stdlib are compiled into binaries the base installs (podman, skopeo, toolbox, ipp-usb), and DeskOS neither builds nor patches them, so the fix is the distribution's rebuild. A newer base was checked first: the current CentOS Stream 10 base still carries them, so the rebuild has not happened yet. This record makes the acceptance explicit and expires on the review date below."
    package:
      name: golang.org/x/net
      type: go-module
      version: v0.56.0
  - vulnerability: GO-2026-6612
    reason: "Accepted by the owner on 2026-10-17. Not a false positive: the vulnerable Go module and stdlib are compiled into binaries the base installs (podman, skopeo, toolbox, ipp-usb), and DeskOS neither builds nor patches them, so the fix is the distribution's rebuild. A newer base was checked first: the current CentOS Stream 10 base still carries them, so the rebuild has not happened yet. This record makes the acceptance explicit and expires on the review date below."
    package:
      name: golang.org/x/net
      type: go-module
      version: v0.57.0
  - vulnerability: GO-2026-6612
    reason: "Accepted by the owner on 2026-10-17. Not a false positive: the vulnerable Go module and stdlib are compiled into binaries the base installs (podman, skopeo, toolbox, ipp-usb), and DeskOS neither builds nor patches them, so the fix is the distribution's rebuild. A newer base was checked first: the current CentOS Stream 10 base still carries them, so the rebuild has not happened yet. This record makes the acceptance explicit and expires on the review date below."
    package:
      name: stdlib
      type: go-module
      version: go1.25.7
  - vulnerability: GO-2026-6612
    reason: "Accepted by the owner on 2026-10-17. Not a false positive: the vulnerable Go module and stdlib are compiled into binaries the base installs (podman, skopeo, toolbox, ipp-usb), and DeskOS neither builds nor patches them, so the fix is the distribution's rebuild. A newer base was checked first: the current CentOS Stream 10 base still carries them, so the rebuild has not happened yet. This record makes the acceptance explicit and expires on the review date below."
    package:
      name: stdlib
      type: go-module
      version: go1.26.3
  - vulnerability: GO-2026-6612
    reason: "Accepted by the owner on 2026-10-17. Not a false positive: the vulnerable Go module and stdlib are compiled into binaries the base installs (podman, skopeo, toolbox, ipp-usb), and DeskOS neither builds nor patches them, so the fix is the distribution's rebuild. A newer base was checked first: the current CentOS Stream 10 base still carries them, so the rebuild has not happened yet. This record makes the acceptance explicit and expires on the review date below."
    package:
      name: stdlib
      type: go-module
      version: go1.26.5
  - vulnerability: GO-2026-6612
    reason: "Accepted by the owner on 2026-10-17. Not a false positive: the vulnerable Go module and stdlib are compiled into binaries the base installs (podman, skopeo, toolbox, ipp-usb), and DeskOS neither builds nor patches them, so the fix is the distribution's rebuild. A newer base was checked first: the current CentOS Stream 10 base still carries them, so the rebuild has not happened yet. This record makes the acceptance explicit and expires on the review date below."
    package:
      name: stdlib
      type: go-module
      version: go1.26.7
  - vulnerability: CVE-2026-114406
    reason: "Accepted by the owner on 2026-10-23 and re-reviewed on 2026-10-26 for the Stream 10 base move. Red Hat's tracker for removing the compromised eMudhra roots (RHSB-2026-012) from ca-certificates. Not a false positive: the base now carries 2026.2.92_v9.0.319-100.1, and the fixed build is 2026.2.92_v9.0.319-100.3.el10_2, which the compose does not serve yet. The image mitigates it: Profile deskos-trust blocklists emSign ECC Root CA - G3 and AAA Certificate Services in /etc/pki/ca-trust/source/blocklist, and the built image verifies that trust list has neither root, that the extracted bundle drops from 121 to 120 anchors, and that curl and dnf still work. Scope: the system trust store. Browsers keep their own store, which the root programs already fixed. Drop this entry and the profile when the compose carries ca-certificates-2026.2.92_v9.0.319-100.3."
    package:
      name: ca-certificates
      type: rpm
      version: 2026.2.92_v9.0.319-100.1.el10