Skip to content

Conversation

@guptaNswati
Copy link
Contributor

The scanner is still flagging the keys are they are removed in final build but still present in the openssh-server install layer.

Found in internal scan message": "Secret content search analyzer found regexp match in container: file=/etc/ssh/ssh_host_ecdsa_key regexp=PRIV_KEY",

and local scan done with trivy


Report Summary

┌────────────────────────────────────────────────────────────────┬────────┬─────────┐
│                             Target                             │  Type  │ Secrets │
├────────────────────────────────────────────────────────────────┼────────┼─────────┤
│ ghcr.io/nvidia/k8s-samples:nvbandwidth-b9d88f4a (ubuntu 22.04) │ ubuntu │    -    │
├────────────────────────────────────────────────────────────────┼────────┼─────────┤
│ /etc/ssh/ssh_host_ecdsa_key                                    │  text  │    1    │
├────────────────────────────────────────────────────────────────┼────────┼─────────┤
│ /etc/ssh/ssh_host_ed25519_key                                  │  text  │    1    │
├────────────────────────────────────────────────────────────────┼────────┼─────────┤
│ /etc/ssh/ssh_host_rsa_key                                      │  text  │    1    │
└────────────────────────────────────────────────────────────────┴────────┴─────────┘

Signed-off-by: Swati Gupta <[email protected]>
@copy-pr-bot
Copy link

copy-pr-bot bot commented Oct 9, 2025

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

@guptaNswati guptaNswati merged commit 86d426f into NVIDIA:main Oct 13, 2025
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants