# Copyright IBM Corp. 2020, 2026
# SPDX-License-Identifier: BUSL-1.1

container {
	dependencies = true
	alpine_secdb = true
	secrets      = false

	# Triage items that are _safe_ to ignore here. Note that this list should be
	# periodically cleaned up to remove items that are no longer found by the scanner.
	triage {
		suppress {
			vulnerabilities = [
				# busybox@1.37.0-r12 https://nvd.nist.gov/vuln/detail/CVE-2025-46394
				#
				# Boundary does not shell out to the busybox tar program.
				"CVE-2025-46394",

				# busybox@1.37.0-r12 https://nvd.nist.gov/vuln/detail/CVE-2024-58251
				#
				# Boundary does not shell out to the busybox netstat program.
				"CVE-2024-58251",

				# gnupg@2.4.7-r0 https://nvd.nist.gov/vuln/detail/CVE-2025-30258
				#
				# Boundary does not utilize GnuPG to import certificates.
				"CVE-2025-30258",

				# iputils@20240905-r0 https://nvd.nist.gov/vuln/detail/CVE-2025-47268
				#
				# Boundary does not utilize ping in iputils.
				"CVE-2025-47268",

				# iputils@20240905-r0 https://nvd.nist.gov/vuln/detail/CVE-2025-48964
				#
				# Boundary does not utilize ping in iputils.
				"CVE-2025-48964",

				# libgcrypt@1.10.3-r1 https://nvd.nist.gov/vuln/detail/CVE-2026-41989
				#
				# There is no fix available in the Alpine Docker image yet.
				"CVE-2026-41989",
			]
		}
	}
}

binary {
	secrets      = true
	go_modules   = true
	osv          = true
	oss_index    = true
	nvd          = true

	triage {
		suppress {
			vulnerabilities = [
				# golang.org/x/crypto/openpgp (GO-2026-5932)
				# https://pkg.go.dev/vuln/GO-2026-5932
				#
				# The advisory is specific to openpgp; Boundary does not import this package.
				#
				# $ go mod why golang.org/x/crypto/openpgp
				# # golang.org/x/crypto/openpgp
				# (main module does not need package golang.org/x/crypto/openpgp)
				"GO-2026-5932",
			]
		}
	}
}