From d9e5918d88e1df4d4481d5cc089a7442d668c985 Mon Sep 17 00:00:00 2001 From: Sami Alajrami Date: Thu, 3 Sep 2026 10:46:10 +0200 Subject: [PATCH 1/5] docs: note 1MB max JSON payload size for --attestation-data and --user-data Related to kosli-dev/server#5388 --- cmd/kosli/root.go | 4 ++-- cmd/kosli/testdata/output/docs/mintlify/snyk.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/kosli/root.go b/cmd/kosli/root.go index 786c3529b..d6d8abd5b 100644 --- a/cmd/kosli/root.go +++ b/cmd/kosli/root.go @@ -177,7 +177,7 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file, templateFileFlag = "[optional] The path to a yaml template file. Cannot be used together with --use-empty-template" templateFileSimpleFlag = "[optional] The path to a yaml template file." useEmptyTemplateFlag = "Use an empty template for the flow creation without specifying a file. Cannot be used together with --template or --template-file" - attestationUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the attestation." + attestationUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum json payload size is 1MB." trailUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the flow trail." gitCommitFlag = "[defaulted] The git commit from which the artifact was created. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd, otherwise defaults to HEAD )." buildUrlFlag = "The url of CI pipeline that built the artifact. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd )." @@ -265,7 +265,7 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file, attestationCompliantFlag = "[defaulted] Whether the attestation is compliant or not." attestationRepoRootFlag = "[defaulted] The directory where the source git repository is available. Only used if --commit is used or defaulted in CI, see https://docs.kosli.com/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables ." attestationCustomTypeNameFlag = "The name of the custom attestation type." - attestationCustomDataFileFlag = "The filepath of a json file containing the custom attestation data." + attestationCustomDataFileFlag = "The filepath of a json file containing the custom attestation data. The maximum json payload size is 1MB." uploadJunitResultsFlag = "[defaulted] Whether to upload the provided Junit results directory as an attachment to Kosli or not." uploadSnykResultsFlag = "[defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not." attestationAssertFlag = "[optional] Exit with non-zero code if the attestation is non-compliant" diff --git a/cmd/kosli/testdata/output/docs/mintlify/snyk.md b/cmd/kosli/testdata/output/docs/mintlify/snyk.md index ea0c2580e..5d1fb8256 100644 --- a/cmd/kosli/testdata/output/docs/mintlify/snyk.md +++ b/cmd/kosli/testdata/output/docs/mintlify/snyk.md @@ -65,7 +65,7 @@ In other CI systems, set them explicitly to capture repository metadata. | `-R`, `--scan-results` | string | The path to Snyk scan SARIF results file from 'snyk test' and 'snyk container test'. By default, the Snyk results will be uploaded to Kosli's evidence vault. | | `-T`, `--trail` | string | The Kosli trail name. | | `--upload-results` | bool | [defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not. (default true) | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum json payload size is 1MB. | ## Examples Use Cases From 67e7b55dc418ebb49803cb3b140e858939f82486 Mon Sep 17 00:00:00 2001 From: Sami Alajrami Date: Thu, 3 Sep 2026 10:53:50 +0200 Subject: [PATCH 2/5] fix(deps): upgrade golang.org/x/crypto to v0.56.0 Fixes CVE-2026-56855 (SNYK-GOLANG-GOLANGORGXCRYPTOSSH-19504090), a resource-exhaustion vulnerability in x/crypto/ssh connection multiplexing that could let a malicious peer deadlock a connection. --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index dd8bd3d29..a5fd06f2b 100644 --- a/go.mod +++ b/go.mod @@ -242,7 +242,7 @@ require ( go.opentelemetry.io/proto/otlp v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect go.yaml.in/yaml/v3 v3.0.5 // indirect - golang.org/x/crypto v0.55.0 // indirect + golang.org/x/crypto v0.56.0 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/mod v0.38.0 // indirect golang.org/x/net v0.58.0 // indirect diff --git a/go.sum b/go.sum index d203fafb7..38522714c 100644 --- a/go.sum +++ b/go.sum @@ -605,8 +605,8 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= -golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= +golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= +golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk= From 5192d300c08adbcab0f019830e43f4c4d6188bee Mon Sep 17 00:00:00 2001 From: Sami Alajrami Date: Thu, 3 Sep 2026 10:56:46 +0200 Subject: [PATCH 3/5] Apply suggestion from @claude[bot] Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> --- cmd/kosli/root.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/kosli/root.go b/cmd/kosli/root.go index d6d8abd5b..34ddf0057 100644 --- a/cmd/kosli/root.go +++ b/cmd/kosli/root.go @@ -177,7 +177,7 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file, templateFileFlag = "[optional] The path to a yaml template file. Cannot be used together with --use-empty-template" templateFileSimpleFlag = "[optional] The path to a yaml template file." useEmptyTemplateFlag = "Use an empty template for the flow creation without specifying a file. Cannot be used together with --template or --template-file" - attestationUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum json payload size is 1MB." + attestationUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB." trailUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the flow trail." gitCommitFlag = "[defaulted] The git commit from which the artifact was created. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd, otherwise defaults to HEAD )." buildUrlFlag = "The url of CI pipeline that built the artifact. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd )." From 5808934a8737e286607442591a2cc52df7e0f9e1 Mon Sep 17 00:00:00 2001 From: Sami Alajrami Date: Thu, 3 Sep 2026 10:59:19 +0200 Subject: [PATCH 4/5] docs: add 1MB payload note to --user-data for trails, use JSON casing consistently Related to kosli-dev/server#5388 --- cmd/kosli/root.go | 4 ++-- cmd/kosli/testdata/output/docs/mintlify/snyk.md | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/cmd/kosli/root.go b/cmd/kosli/root.go index 34ddf0057..f9c6fefee 100644 --- a/cmd/kosli/root.go +++ b/cmd/kosli/root.go @@ -178,7 +178,7 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file, templateFileSimpleFlag = "[optional] The path to a yaml template file." useEmptyTemplateFlag = "Use an empty template for the flow creation without specifying a file. Cannot be used together with --template or --template-file" attestationUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB." - trailUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the flow trail." + trailUserDataFlag = "[optional] The path to a JSON file containing additional data you would like to attach to the flow trail. The maximum JSON payload size is 1MB." gitCommitFlag = "[defaulted] The git commit from which the artifact was created. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd, otherwise defaults to HEAD )." buildUrlFlag = "The url of CI pipeline that built the artifact. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd )." commitUrlFlag = "The url for the git commit that created the artifact. (defaulted in some CIs: https://docs.kosli.com/integrations/ci_cd )." @@ -265,7 +265,7 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file, attestationCompliantFlag = "[defaulted] Whether the attestation is compliant or not." attestationRepoRootFlag = "[defaulted] The directory where the source git repository is available. Only used if --commit is used or defaulted in CI, see https://docs.kosli.com/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables ." attestationCustomTypeNameFlag = "The name of the custom attestation type." - attestationCustomDataFileFlag = "The filepath of a json file containing the custom attestation data. The maximum json payload size is 1MB." + attestationCustomDataFileFlag = "The filepath of a json file containing the custom attestation data. The maximum JSON payload size is 1MB." uploadJunitResultsFlag = "[defaulted] Whether to upload the provided Junit results directory as an attachment to Kosli or not." uploadSnykResultsFlag = "[defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not." attestationAssertFlag = "[optional] Exit with non-zero code if the attestation is non-compliant" diff --git a/cmd/kosli/testdata/output/docs/mintlify/snyk.md b/cmd/kosli/testdata/output/docs/mintlify/snyk.md index 5d1fb8256..317a7c0c8 100644 --- a/cmd/kosli/testdata/output/docs/mintlify/snyk.md +++ b/cmd/kosli/testdata/output/docs/mintlify/snyk.md @@ -65,7 +65,7 @@ In other CI systems, set them explicitly to capture repository metadata. | `-R`, `--scan-results` | string | The path to Snyk scan SARIF results file from 'snyk test' and 'snyk container test'. By default, the Snyk results will be uploaded to Kosli's evidence vault. | | `-T`, `--trail` | string | The Kosli trail name. | | `--upload-results` | bool | [defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not. (default true) | -| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum json payload size is 1MB. | +| `-u`, `--user-data` | string | [optional] The path to a JSON file containing additional data you would like to attach to the attestation. The maximum JSON payload size is 1MB. | ## Examples Use Cases From 2fa8d8a945a169dea60d5e31bc3cdacb9a0b502d Mon Sep 17 00:00:00 2001 From: Sami Alajrami Date: Thu, 3 Sep 2026 11:09:23 +0200 Subject: [PATCH 5/5] Update cmd/kosli/root.go Co-authored-by: claude[bot] <209825114+claude[bot]@users.noreply.github.com> --- cmd/kosli/root.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/cmd/kosli/root.go b/cmd/kosli/root.go index f9c6fefee..71e36020b 100644 --- a/cmd/kosli/root.go +++ b/cmd/kosli/root.go @@ -265,7 +265,7 @@ The ^.kosli_ignore^ will be treated as part of the artifact like any other file, attestationCompliantFlag = "[defaulted] Whether the attestation is compliant or not." attestationRepoRootFlag = "[defaulted] The directory where the source git repository is available. Only used if --commit is used or defaulted in CI, see https://docs.kosli.com/integrations/ci_cd/#defaulted-kosli-command-flags-from-ci-variables ." attestationCustomTypeNameFlag = "The name of the custom attestation type." - attestationCustomDataFileFlag = "The filepath of a json file containing the custom attestation data. The maximum JSON payload size is 1MB." + attestationCustomDataFileFlag = "The filepath of a JSON file containing the custom attestation data. The maximum JSON payload size is 1MB." uploadJunitResultsFlag = "[defaulted] Whether to upload the provided Junit results directory as an attachment to Kosli or not." uploadSnykResultsFlag = "[defaulted] Whether to upload the provided Snyk results file as an attachment to Kosli or not." attestationAssertFlag = "[optional] Exit with non-zero code if the attestation is non-compliant"