Drop the GO-2026-5932 openpgp exclusion once rekor releases the migration #231

Summary

.github/workflows/security.yml excludes GO-2026-5932 — golang.org/x/crypto/openpgp is deprecated by design, has no fixed version, and never will. Correct today, but it should not be permanent.

Why it exists

Nothing in this module imports openpgp. It arrives four levels up:

container/signer → sigstore-go/pkg/sign → rekor/pkg/pki → rekor/pkg/pki/pgp → golang.org/x/crypto/openpgp

rekor/pkg/pki is a pluggable signature-format registry, so importing it links every format, PGP included. There is no local call site to rewrite.

Every govulncheck trace is package-init reachability, not a call — the package is linked but never parses PGP data. The advisory is "unmaintained, unsafe by design" rather than a specific exploitable bug.

The exclusion arrived with the container/signer port; before that, nothing here linked sigstore-go/pkg/sign, so the advisory was unreachable.

What unblocks removal

Rekor already migrated to ProtonMail/go-crypto/openpgp in sigstore/rekor#2883, merged 2026-07-15, after the v1.5.3 release (2026-07-02). It is on main but unreleased.

Steps once a rekor release past v1.5.3 exists

1. Bump github.com/sigstore/rekor (indirect, currently v1.5.3), likely via sigstore-go.
2. Confirm with govulncheck ./....
3. Remove GO-2026-5932 from IGNORED_VULNS in .github/workflows/security.yml and its justification block.

Note the surrounding check step should stay — it fails on any vulnerability not explicitly listed, which is stricter than the bare action it replaced. Only the entry goes.

stacklok/toolhive carries the same exclusion and needs the same bump against its own go.mod.