The vault-config identity guard can pass without checking, and its identity floor is off by one #3284

🤖 Generated by the Agentic Engineer

Evidence

Two defects in scripts/tests/test-trivyignore-vault-config-identity-boundary.sh, both found by Codex on the sibling guard in #3282 and both present here. Neither is caused by that PR — they are pre-existing, and the new guard inherited them by being modelled on this one.

1. A failed yq enumeration does not reach the parent

run_yq records a failure by calling fail(), which sets status=1. Every one of its seven call sites invokes it through a command substitution — if out="$(run_yq …)"; then — so that assignment happens in a subshell and the parent's status is untouched. The caller's if then simply skips its body.

So when a query fails, the guard skips the check and prints PASS having inspected nothing. That is precisely the outcome the helper's own comment block says it exists to prevent:

A query that did not run is not evidence that a boundary holds.

Reproduced on the sibling guard before fixing it there: a readable-but-malformed .trivyignore.yaml produced PASS and exit 0. After the fix it exits 1 with QUERY FAILED.

2. The identity floor excludes exactly 10000

HIGH_UID_FLOOR=10000, compared with -lt (pod default) and -ge (container loop). KSV-0020 and KSV-0021 fire for values <= 10000, so 10000 is itself low — but both comparisons treat it as high.

A container or pod default set to exactly 10000 would therefore be reported by trivy, suppressed by the path-scoped ignore, and still pass this guard: an off-by-one at the exact boundary the guard polices. Verified on the sibling: a container at 10000 passes with the old floor and fails with 10001.

Why it matters

This guard is the only thing asserting the per-container premise behind the vault-config KSV-0020/KSV-0021 dispositions — the ignorefile cannot express it, and the workload ships to production. A guard that can pass without checking is worse than no guard, because a passing build reads as the premise having been verified.

Expected behaviour

• A failed enumeration makes the guard exit non-zero, never PASS.
• A UID or GID of exactly 10000 is treated as low.

Fix shape

Both fixes are already applied to test-trivyignore-vault-backup-identity-boundary.sh in #3282 and can be copied: run_yq reports to stderr and returns non-zero while each caller records the failure in the parent via a query_failed helper; the floor becomes 10001 with the comparisons unchanged.

Kept out of #3282 deliberately — that PR already extends into this file for the digest pin, and restructuring control flow at seven call sites in a currently-green production security guard deserves its own change and its own ablations rather than riding along.

Acceptance criteria

• A malformed or unreadable input at any of the seven call sites makes the guard exit non-zero, demonstrated by ablation rather than asserted.
• A container at exactly 10000 fails the premise layer, demonstrated the same way.
• The guard still passes on the unmodified tree.