From 5e36435a3a02e7ed21d214d2cc6f2a60fbba7752 Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Tue, 16 Jun 2026 15:02:45 +0200 Subject: [PATCH 1/7] Pin GitHub Actions And bump the trivy-action to the newest version. Signed-off-by: Tom Wieczorek (cherry picked from commit 30b1743506d30d7a848f975e9eb23d7f19f7ed07) --- .github/workflows/build.yaml | 12 ++++++------ .github/workflows/dco.yaml | 4 ++-- .github/workflows/scan.yaml | 6 +++--- 3 files changed, 11 insertions(+), 11 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index c480c44..31ce63c 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -37,17 +37,17 @@ jobs: } >>"$GITHUB_OUTPUT" - name: Set up QEMU - uses: docker/setup-qemu-action@v3.6.0 + uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 with: platforms: amd64,arm64,arm,riscv64 - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@v3.10.0 + uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 - name: Build OCI image archive id: build - uses: docker/build-push-action@v6.16.0 + uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0 with: builder: ${{ steps.buildx.outputs.name }} platforms: linux/amd64,linux/arm64,linux/arm,linux/riscv64 @@ -66,7 +66,7 @@ jobs: run: zstdmt --fast oci-image.tar - name: Upload OCI image archive - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: name: oci-image.tar.zst path: oci-image.tar.zst @@ -75,7 +75,7 @@ jobs: run: mkdir image && tar xf oci-image.tar.zst -C image/ - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.30.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: input: image/ format: table @@ -84,7 +84,7 @@ jobs: - name: Log in to registry if: steps.prep.outputs.registry != 'ttl.sh' - uses: redhat-actions/podman-login@v1 + uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7 with: username: ${{ secrets.DOCKER_USERNAME }} password: ${{ secrets.DOCKER_PASSWORD }} diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml index 92583ec..611b70f 100644 --- a/.github/workflows/dco.yaml +++ b/.github/workflows/dco.yaml @@ -18,10 +18,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout k0s - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml index 86c44d2..7808e77 100644 --- a/.github/workflows/scan.yaml +++ b/.github/workflows/scan.yaml @@ -41,19 +41,19 @@ jobs: # know the ref and sha. Providing those manually won't work, for unknown # reasons. - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: ref: ${{ format('refs/tags/{0}', steps.prep.outputs.git-tag) }} persist-credentials: false - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.12.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: image-ref: ${{ format('quay.io/{0}:{1}', github.repository, steps.prep.outputs.image-tag) }} format: sarif output: trivy-results.sarif - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 with: sarif_file: trivy-results.sarif From e8a1d5306f34e45ca4fdf324f3a1b73389773ed6 Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Fri, 19 Jun 2026 13:24:41 +0200 Subject: [PATCH 2/7] Only trigger build if files affecting the build changed Add a path filter to the workflow trigger that is equivalent to the configuration in the .dockerignore file. Since pushing tags should trigger a build anyway, we need two workflows, each with different trigger settings. This allows us to dissolve the Prepare step from the build workflow because the parameters it computed can now be provided as inputs. Signed-off-by: Tom Wieczorek (cherry picked from commit 579551abe43cbf96b68fef2cf573e2287661dc18) --- .dockerignore | 2 + .github/workflows/build.yaml | 95 ++++++++++++++++------------------ .github/workflows/ci.yaml | 25 +++++++++ .github/workflows/release.yaml | 19 +++++++ .github/workflows/scan.yaml | 27 +++------- 5 files changed, 96 insertions(+), 72 deletions(-) create mode 100644 .github/workflows/ci.yaml create mode 100644 .github/workflows/release.yaml diff --git a/.dockerignore b/.dockerignore index d88a5ec..6ffc39e 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,3 +1,5 @@ .* * + +# Keep in sync with the paths in .github/workflows/ci.yaml. !src/ diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 31ce63c..5938e9d 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -1,40 +1,42 @@ name: Build on: - pull_request: - branches: - - main - push: - branches: - - main - tags: - - v?* + workflow_call: + inputs: + registry: + type: string + required: true + description: The registry to push the image to. + image-owner: + type: string + required: true + description: The owner of the image. + image-name: + type: string + required: true + description: The name of the image. + image-tag: + type: string + required: true + description: The tag of the image. + secrets: + registry-username: + description: The username for the registry. + registry-password: + description: The password for the registry. jobs: build: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - name: Prepare - id: prep - run: | - # If this is a git tag, use the tag name as a docker tag - if [[ $GITHUB_REF == refs/tags/v?* ]]; then - registry=quay.io - name="$GITHUB_REPOSITORY" - tag="${GITHUB_REF#refs/tags/v}" - tag="${tag//+/-}" - else - registry=ttl.sh - name="${GITHUB_REPOSITORY//\//-}-$GITHUB_SHA-$GITHUB_RUN_ID" - tag=1d - fi - - { - echo registry="$registry" - echo name="$name" - echo tag="$tag" - } >>"$GITHUB_OUTPUT" + id: prepare + env: + # GitHub Actions doesn't seem to support the secrets + # context in if fields, hence this workaround. + REGISTRY_CREDENTIALS_AVAILABLE: "${{ case(secrets.registry-username != '', 'true', '') }}" + run: echo registry-credentials-available="$REGISTRY_CREDENTIALS_AVAILABLE" >>"$GITHUB_OUTPUT" - name: Set up QEMU uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 @@ -51,28 +53,21 @@ jobs: with: builder: ${{ steps.buildx.outputs.name }} platforms: linux/amd64,linux/arm64,linux/arm,linux/riscv64 - tags: ${{ format('{0}/{1}:{2}', steps.prep.outputs.registry, steps.prep.outputs.name, steps.prep.outputs.tag) }} + tags: ${{ format('{0}/{1}/{2}:{3}', inputs.registry, inputs.image-owner, inputs.image-name, inputs.image-tag) }} outputs: type=oci,dest=oci-image.tar - - name: Compress OCI image archive - # Pre-compress the image archive so that the upload-artifact action - # doesn't try to do it. The layers inside the tar archive are themselves - # already gzip compressed, so this is not for size reduction, but solely - # to prevent the very slow compression process in the upload-artifact - # action. - # See: https://github.com/actions/upload-artifact/issues/199 - # See: https://github.com/actions/toolkit/blob/6c1f9eaae833355a0b212b66c5f2e3ac366de185/packages/artifact/src/internal/upload-gzip.ts#L11-L33 - # Might be fixed when upload-artifact@v4 gets released: https://github.com/actions/toolkit/pull/1488 - run: zstdmt --fast oci-image.tar - - name: Upload OCI image archive uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: - name: oci-image.tar.zst - path: oci-image.tar.zst + name: ${{ format('{0}-{1}.tar', inputs.image-name, inputs.image-tag) }} + path: oci-image.tar + # The layers inside the tar archive are themselves already gzip + # compressed. No need to compress the metadata. Speeds things up a + # bit. + compression-level: 0 - name: Extract OCI image archive - run: mkdir image && tar xf oci-image.tar.zst -C image/ + run: mkdir image && tar xf oci-image.tar -C image/ - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 @@ -83,18 +78,16 @@ jobs: exit-code: "1" - name: Log in to registry - if: steps.prep.outputs.registry != 'ttl.sh' + if: steps.prepare.outputs.registry-credentials-available uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7 with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKER_PASSWORD }} - registry: ${{ steps.prep.outputs.registry }} + registry: ${{ inputs.registry }} + username: ${{ secrets.registry-username }} + password: ${{ secrets.registry-password }} - name: Upload OCI image to registry env: - REGISTRY: ${{ steps.prep.outputs.registry }} - NAME: ${{ steps.prep.outputs.name }} - TAG: ${{ steps.prep.outputs.tag }} + IMAGE: ${{ format('{0}/{1}/{2}:{3}', inputs.registry, inputs.image-owner, inputs.image-name, inputs.image-tag) }} run: | podmanArgs=(-v "$(realpath oci-image.tar):/image.tar:ro") skopeoArgs=(--multi-arch all --preserve-digests) @@ -107,4 +100,4 @@ jobs: set -x podman run "${podmanArgs[@]}" \ docker://quay.io/skopeo/stable:v1.18.0 copy "${skopeoArgs[@]}" \ - oci-archive:/image.tar "docker://$REGISTRY/$NAME:$TAG" + oci-archive:/image.tar "docker://$IMAGE" diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml new file mode 100644 index 0000000..6c22a67 --- /dev/null +++ b/.github/workflows/ci.yaml @@ -0,0 +1,25 @@ +name: CI + +on: + pull_request: &triggers + branches: + - main + paths: + - .github/workflows/ci.yaml + - .github/workflows/build.yaml + - Dockerfile + - .dockerignore + # keep in sync with .dockerignore + - src/** + push: *triggers + +jobs: + build: + name: Build OCI image + uses: ./.github/workflows/build.yaml + with: + # This will produce images tagged like ttl.sh/k0sproject/cni-node-27741332811-1:1d. + registry: ttl.sh + image-owner: ${{ github.repository_owner }} + image-name: ${{ format('{0}-{1}-{2}', github.event.repository.name, github.run_id, github.run_attempt) }} + image-tag: 1d diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml new file mode 100644 index 0000000..9cabb9f --- /dev/null +++ b/.github/workflows/release.yaml @@ -0,0 +1,19 @@ +name: Release + +on: + push: + tags: + - v?* + +jobs: + build: + name: Build OCI image + uses: ./.github/workflows/build.yaml + with: + registry: quay.io + image-owner: ${{ github.repository_owner }} + image-name: ${{ github.event.repository.name }} + image-tag: ${{ github.ref_name }} + secrets: + registry-username: ${{ secrets.DOCKER_USERNAME }} + registry-password: ${{ secrets.DOCKER_PASSWORD }} diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml index 7808e77..14bb09a 100644 --- a/.github/workflows/scan.yaml +++ b/.github/workflows/scan.yaml @@ -14,28 +14,13 @@ jobs: security-events: write # upload sarif results steps: - - name: Prepare - id: prep + - name: Determine latest release + id: latest-release + if: github.event.release.tag_name == '' env: - PUBLISHED_TAG: ${{ github.event.release.tag_name }} GH_REPO: ${{ github.repository }} GH_TOKEN: ${{ github.token }} - run: | - if [ -n "$PUBLISHED_TAG" ]; then - gitTag="$PUBLISHED_TAG" - else - # Get the tag name from the latest GitHub release - gitTag="$(gh api repos/{owner}/{repo}/releases/latest --jq .tag_name)" - fi - - # Determine OCI image tag - imageTag="${gitTag//+/-}" - imageTag="${imageTag#v}" - - { - echo git-tag="$gitTag" - echo image-tag="$imageTag" - } >>"$GITHUB_OUTPUT" + run: gh api 'repos/{owner}/{repo}/releases/latest' --jq '"tag-name=\(.tag_name)"' >>"$GITHUB_OUTPUT" # The checkout is solely required for the upload-sarif action. It needs to # know the ref and sha. Providing those manually won't work, for unknown @@ -43,13 +28,13 @@ jobs: - name: Checkout uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: - ref: ${{ format('refs/tags/{0}', steps.prep.outputs.git-tag) }} + ref: ${{ format('refs/tags/{0}', github.event.release.tag_name || steps.latest-release.outputs.tag-name) }} persist-credentials: false - name: Run Trivy vulnerability scanner uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: - image-ref: ${{ format('quay.io/{0}:{1}', github.repository, steps.prep.outputs.image-tag) }} + image-ref: ${{ format('quay.io/{0}:{1}', github.repository, github.event.release.tag_name || steps.latest-release.outputs.tag-name) }} format: sarif output: trivy-results.sarif From bdf3f20c40ffbf670d7bae825ccdf5acb314c644 Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Tue, 28 Jul 2026 14:45:13 +0200 Subject: [PATCH 3/7] Only run Trivy as a nightly job It doesn't help if a previously green main branch suddenly becomes red because there have been some CVEs published. Better to address this by automatically bumping the dependency versions. Signed-off-by: Tom Wieczorek (cherry picked from commit 201915d59d63a6b57138dd403e80eed118565864) --- .github/workflows/build.yaml | 8 -------- .github/workflows/scan.yaml | 3 --- 2 files changed, 11 deletions(-) diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index 5938e9d..832b408 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -69,14 +69,6 @@ jobs: - name: Extract OCI image archive run: mkdir image && tar xf oci-image.tar -C image/ - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 - with: - input: image/ - format: table - list-all-pkgs: "true" # Flags a warning, but prints out stuff nevertheless - exit-code: "1" - - name: Log in to registry if: steps.prepare.outputs.registry-credentials-available uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7 diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml index 14bb09a..d77fbcd 100644 --- a/.github/workflows/scan.yaml +++ b/.github/workflows/scan.yaml @@ -2,9 +2,6 @@ name: Security scan on: schedule: - cron: 0 2 * * 1-5 - release: - types: - - published workflow_dispatch: jobs: From 3cc79b30503a5c59d0b92b8410bb4cb049ffb644 Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Thu, 22 Oct 2026 10:02:55 +0200 Subject: [PATCH 4/7] Run CI for release branches, too There's some security fixes that should reach version 1.8, which is still used in k0s 1.34 and 1.35. So let's setup CI for that. Signed-off-by: Tom Wieczorek (cherry picked from commit 2dae4affe09dabcd6f201f0f98ec4ac0430869f2) --- .github/workflows/ci.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 6c22a67..35d5eb6 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -4,6 +4,7 @@ on: pull_request: &triggers branches: - main + - release-* paths: - .github/workflows/ci.yaml - .github/workflows/build.yaml From 2d84bebe2651b6553b1f88e9be5a6bbca1255a2d Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Thu, 22 Oct 2026 10:19:36 +0200 Subject: [PATCH 5/7] Restructure the 1.8 build the same way as the 1.9 build This is basically c74f56715d032a2a429f27aa52f819dfc601f0d5, just without the version bump. Signed-off-by: Tom Wieczorek --- Dockerfile | 39 ++++++++++++++++----------------------- 1 file changed, 16 insertions(+), 23 deletions(-) diff --git a/Dockerfile b/Dockerfile index 9aa6e73..4c60d18 100644 --- a/Dockerfile +++ b/Dockerfile @@ -4,29 +4,22 @@ ARG \ VERSION=1.8.0 \ HASH=f0510b4452dda4b08d4b088d02e005ac507cb96fb7247b4422ae591286390369 -FROM --platform=$BUILDPLATFORM $GOLANG_IMAGE AS bins +FROM --platform=$BUILDPLATFORM $GOLANG_IMAGE AS sources +ENV GOTOOLCHAIN=local GOTELEMETRY=off +WORKDIR /go/src/containernetworking-plugins ARG VERSION HASH - -RUN wget https://github.com/containernetworking/plugins/archive/refs/tags/v${VERSION}.tar.gz \ - && { echo "${HASH} *v${VERSION}.tar.gz" | sha256sum -c -; } \ - && tar xf "v${VERSION}.tar.gz" -C /go \ - && rm -- "v${VERSION}.tar.gz" - -WORKDIR /go/plugins-$VERSION - -ARG TARGETPLATFORM -RUN set -x \ - && apk add bash \ - && mkdir -p /opt/stage/usr/local/bin \ - && case "${TARGETPLATFORM-~}" in \ - linux/amd64) export GOARCH=amd64 ;; \ - linux/arm64) export GOARCH=arm64 ;; \ - linux/arm/v7) export GOARCH=arm ;; \ - linux/riscv64) export GOARCH=riscv64 ;; \ - ~);; \ - *) echo Unsupported target platform: "$TARGETPLATFORM" >&2; exit 1;; \ - esac \ - && CGO_ENABLED=0 ./build_linux.sh -trimpath -buildvcs=false \ +RUN --mount=type=tmpfs,target=/tmp \ + set -euo pipefail \ + && wget -qO /tmp/sources.tar.gz https://github.com/containernetworking/plugins/archive/refs/tags/v$VERSION.tar.gz \ + && { echo $HASH /tmp/sources.tar.gz | sha256sum -c -; } || { sha256sum /tmp/sources.tar.gz; exit 1; } \ + && tar xf /tmp/sources.tar.gz --strip-components=1 + + +FROM sources AS bins +ARG TARGETARCH SOURCE_DATE_EPOCH +RUN --mount=type=cache,id=calico-gocache-$TARGETARCH,target=/root/.cache/go-build \ + --network=none \ + CGO_ENABLED=0 GOARCH=$TARGETARCH ./build_linux.sh -trimpath -buildvcs=false \ -ldflags "-s -w -extldflags -static -X github.com/containernetworking/plugins/pkg/utils/buildversion.BuildVersion=v$VERSION" @@ -45,6 +38,6 @@ LABEL org.opencontainers.image.licenses="Apache-2.0" \ org.opencontainers.image.source="https://github.com/k0sproject/cni-node" COPY --from=baselayout / / ARG VERSION -COPY --from=bins /go/plugins-$VERSION/bin/ /opt/cni/bin/ +COPY --from=bins /go/src/containernetworking-plugins/bin/ /opt/cni/bin/ ENTRYPOINT ["/bin/cni-node"] CMD ["install"] From deed6e322c1007dbb26d256196b6723160a2be1c Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Thu, 22 Oct 2026 10:28:52 +0200 Subject: [PATCH 6/7] Introduce a way to add patches to the build This is basically 21ea3ff25ffb5f7e841cd0dd2481c67387cb8d66, but without the patches it added. Signed-off-by: Tom Wieczorek --- .dockerignore | 1 + .github/workflows/ci.yaml | 1 + Dockerfile | 11 +++++++++-- files/patches/.keep | 0 4 files changed, 11 insertions(+), 2 deletions(-) create mode 100644 files/patches/.keep diff --git a/.dockerignore b/.dockerignore index 6ffc39e..49aa35d 100644 --- a/.dockerignore +++ b/.dockerignore @@ -3,3 +3,4 @@ # Keep in sync with the paths in .github/workflows/ci.yaml. !src/ +!files/ diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml index 35d5eb6..61ee420 100644 --- a/.github/workflows/ci.yaml +++ b/.github/workflows/ci.yaml @@ -12,6 +12,7 @@ on: - .dockerignore # keep in sync with .dockerignore - src/** + - files/** push: *triggers jobs: diff --git a/Dockerfile b/Dockerfile index 4c60d18..05ef9c1 100644 --- a/Dockerfile +++ b/Dockerfile @@ -5,14 +5,21 @@ ARG \ HASH=f0510b4452dda4b08d4b088d02e005ac507cb96fb7247b4422ae591286390369 FROM --platform=$BUILDPLATFORM $GOLANG_IMAGE AS sources +RUN apk add --no-cache patch ENV GOTOOLCHAIN=local GOTELEMETRY=off WORKDIR /go/src/containernetworking-plugins ARG VERSION HASH -RUN --mount=type=tmpfs,target=/tmp \ +RUN --mount=source=files/patches,target=/run/patches,ro \ + --mount=type=tmpfs,target=/tmp \ set -euo pipefail \ && wget -qO /tmp/sources.tar.gz https://github.com/containernetworking/plugins/archive/refs/tags/v$VERSION.tar.gz \ && { echo $HASH /tmp/sources.tar.gz | sha256sum -c -; } || { sha256sum /tmp/sources.tar.gz; exit 1; } \ - && tar xf /tmp/sources.tar.gz --strip-components=1 + && tar xf /tmp/sources.tar.gz --strip-components=1 \ + && for p in /run/patches/*.patch; do \ + [ "$p" != '/run/patches/*.patch' ] || { echo No patches found.; break; }; \ + echo Applying "$p" >&2; \ + patch -p1 <"$p"; \ + done FROM sources AS bins diff --git a/files/patches/.keep b/files/patches/.keep new file mode 100644 index 0000000..e69de29 From 5355672446de77d3627f9c28630b9db579074a16 Mon Sep 17 00:00:00 2001 From: Tom Wieczorek Date: Thu, 22 Oct 2026 11:47:52 +0200 Subject: [PATCH 7/7] Bump Alpine to 3.22.7, Go to 1.26.10 This adapts upstream commit 0a482377ea5ceb144eb634e555fb3bf914f59f24. Alpine 3.22.7 fixes musl's CVE-2026-107891, and drops the infamous eMudhra CAs with their ridiculous private keys. Go 1.26.10 rejects certificate chains containing any of the eight compromised eMudhra keys (CVE-2026-111943). The github.com/opencontainers/selinux bump to v1.13.0 fixes CVE-2025-52881 in github.com/opencontainers/selinux, which is flagged by CVE scanners in the tap plugin. The golang.org/x/net bump to 0.61.0 fixes CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669 and CVE-2026-97032, which Trivy flags in the dhcp plugin. Signed-off-by: Tom Wieczorek --- Dockerfile | 7 +- ...VE-2025-52881-Bump-selinux-to-1.13.0.patch | 86 ++++++++++++++ ...002-Bump-golang.org-x-net-to-v0.61.0.patch | 112 ++++++++++++++++++ 3 files changed, 203 insertions(+), 2 deletions(-) create mode 100644 files/patches/0001-CVE-2025-52881-Bump-selinux-to-1.13.0.patch create mode 100644 files/patches/0002-Bump-golang.org-x-net-to-v0.61.0.patch diff --git a/Dockerfile b/Dockerfile index 05ef9c1..7e168dc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,6 +1,6 @@ ARG \ - ALPINE_IMAGE=docker.io/library/alpine:3.22.2 \ - GOLANG_IMAGE=docker.io/library/golang:1.25.2-alpine \ + ALPINE_IMAGE=docker.io/library/alpine:3.22.7 \ + GOLANG_IMAGE=docker.io/library/golang:1.26.10-alpine3.23 \ VERSION=1.8.0 \ HASH=f0510b4452dda4b08d4b088d02e005ac507cb96fb7247b4422ae591286390369 @@ -21,6 +21,9 @@ RUN --mount=source=files/patches,target=/run/patches,ro \ patch -p1 <"$p"; \ done +# Re-vendor the dependencies, as the patches may have touched go.mod/go.sum +RUN go mod vendor + FROM sources AS bins ARG TARGETARCH SOURCE_DATE_EPOCH diff --git a/files/patches/0001-CVE-2025-52881-Bump-selinux-to-1.13.0.patch b/files/patches/0001-CVE-2025-52881-Bump-selinux-to-1.13.0.patch new file mode 100644 index 0000000..7865d95 --- /dev/null +++ b/files/patches/0001-CVE-2025-52881-Bump-selinux-to-1.13.0.patch @@ -0,0 +1,86 @@ +From dada84a99a00147611749bc0457dd810fd71bec7 Mon Sep 17 00:00:00 2001 +From: sbiradar10 +Date: Sat, 14 Feb 2026 14:13:15 +0530 +Subject: [PATCH 1/2] CVE-2025-52881: Bump selinux to 1.13.0 + +Signed-off-by: sbiradar10 +--- +Limited to go.mod and go.sum; the vendor tree is regenerated at build time. + + go.mod | 4 +++- + go.sum | 12 ++++++++---- + 2 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/go.mod b/go.mod +index edf51d4..513e7c8 100644 +--- a/go.mod ++++ b/go.mod +@@ -15,7 +15,7 @@ require ( + github.com/networkplumbing/go-nft v0.4.0 + github.com/onsi/ginkgo/v2 v2.25.1 + github.com/onsi/gomega v1.38.1 +- github.com/opencontainers/selinux v1.12.0 ++ github.com/opencontainers/selinux v1.13.0 + github.com/pkg/errors v0.9.1 + github.com/safchain/ethtool v0.6.2 + github.com/vishvananda/netlink v1.3.1 +@@ -25,12 +25,14 @@ require ( + ) + + require ( ++ cyphar.com/go-pathrs v0.2.1 // indirect + github.com/Masterminds/semver/v3 v3.4.0 // indirect + github.com/Microsoft/go-winio v0.6.2 // indirect + github.com/containerd/cgroups/v3 v3.0.3 // indirect + github.com/containerd/errdefs v0.3.0 // indirect + github.com/containerd/errdefs/pkg v0.3.0 // indirect + github.com/containerd/typeurl/v2 v2.2.0 // indirect ++ github.com/cyphar/filepath-securejoin v0.6.0 // indirect + github.com/go-logr/logr v1.4.3 // indirect + github.com/go-task/slim-sprig/v3 v3.0.0 // indirect + github.com/gogo/protobuf v1.3.2 // indirect +diff --git a/go.sum b/go.sum +index 5bd059b..708fef9 100644 +--- a/go.sum ++++ b/go.sum +@@ -1,4 +1,6 @@ + cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= ++cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8= ++cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc= + github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= + github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= + github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +@@ -27,6 +29,8 @@ github.com/coreos/go-iptables v0.8.0 h1:MPc2P89IhuVpLI7ETL/2tx3XZ61VeICZjYqDEgNs + github.com/coreos/go-iptables v0.8.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q= + github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo= + github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU= ++github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is= ++github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= + github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= + github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= + github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +@@ -95,8 +99,8 @@ github.com/onsi/ginkgo/v2 v2.25.1 h1:Fwp6crTREKM+oA6Cz4MsO8RhKQzs2/gOIVOUscMAfZY + github.com/onsi/ginkgo/v2 v2.25.1/go.mod h1:ppTWQ1dh9KM/F1XgpeRqelR+zHVwV81DGRSDnFxK7Sk= + github.com/onsi/gomega v1.38.1 h1:FaLA8GlcpXDwsb7m0h2A9ew2aTk3vnZMlzFgg5tz/pk= + github.com/onsi/gomega v1.38.1/go.mod h1:LfcV8wZLvwcYRwPiJysphKAEsmcFnLMK/9c+PjvlX8g= +-github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8= +-github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U= ++github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+LGaWfbL84= ++github.com/opencontainers/selinux v1.13.0/go.mod h1:XxWTed+A/s5NNq4GmYScVy+9jzXhGBVEOAyucdRUY8s= + github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ= + github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4= + github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= +@@ -119,8 +123,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ + github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= + github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= + github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= +-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= ++github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= ++github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= + github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8RaCKgVpHZnecvArXvPXcFkM= + github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701/go.mod h1:P3a5rG4X7tI17Nn3aOIAYr5HbIMukwXG0urG0WuL8OA= + github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0= +-- +2.54.0 + diff --git a/files/patches/0002-Bump-golang.org-x-net-to-v0.61.0.patch b/files/patches/0002-Bump-golang.org-x-net-to-v0.61.0.patch new file mode 100644 index 0000000..ce81c9e --- /dev/null +++ b/files/patches/0002-Bump-golang.org-x-net-to-v0.61.0.patch @@ -0,0 +1,112 @@ +From 995ef0a771ae6eb19ab02ffe9c27375dd520db25 Mon Sep 17 00:00:00 2001 +From: Tom Wieczorek +Date: Thu, 22 Oct 2026 09:28:40 +0200 +Subject: [PATCH 2/2] Bump golang.org/x/net to v0.61.0 + +Fixes CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669 +and CVE-2026-97032 in golang.org/x/net/http2, which are flagged by CVE +scanners in the dhcp plugin. + +Pulls in the newer golang.org/x/{sync,sys,text,tools} modules that x/net +v0.61.0 requires, and bumps the go directive to 1.26.0 accordingly. + +Signed-off-by: Tom Wieczorek +--- + go.mod | 12 ++++++------ + go.sum | 20 ++++++++++---------- + 2 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/go.mod b/go.mod +index 513e7c8..0e25794 100644 +--- a/go.mod ++++ b/go.mod +@@ -1,6 +1,6 @@ + module github.com/containernetworking/plugins + +-go 1.24.2 ++go 1.26.0 + + require ( + github.com/Microsoft/hcsshim v0.13.0 +@@ -20,7 +20,7 @@ require ( + github.com/safchain/ethtool v0.6.2 + github.com/vishvananda/netlink v1.3.1 + github.com/vishvananda/netns v0.0.5 +- golang.org/x/sys v0.35.0 ++ golang.org/x/sys v0.49.0 + sigs.k8s.io/knftables v0.0.18 + ) + +@@ -48,10 +48,10 @@ require ( + go.opencensus.io v0.24.0 // indirect + go.uber.org/automaxprocs v1.6.0 // indirect + go.yaml.in/yaml/v3 v3.0.4 // indirect +- golang.org/x/net v0.43.0 // indirect +- golang.org/x/sync v0.16.0 // indirect +- golang.org/x/text v0.28.0 // indirect +- golang.org/x/tools v0.36.0 // indirect ++ golang.org/x/net v0.61.0 // indirect ++ golang.org/x/sync v0.24.0 // indirect ++ golang.org/x/text v0.43.0 // indirect ++ golang.org/x/tools v0.51.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect + google.golang.org/grpc v1.69.0 // indirect + google.golang.org/protobuf v1.36.7 // indirect +diff --git a/go.sum b/go.sum +index 708fef9..866acd8 100644 +--- a/go.sum ++++ b/go.sum +@@ -160,8 +160,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL + golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= + golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= + golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= +-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE= +-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg= ++golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= ++golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= + golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= + golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +@@ -169,8 +169,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ + golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= +-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= ++golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= ++golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= + golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +@@ -182,13 +182,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc + golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= +-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= ++golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= ++golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= + golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= + golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng= +-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU= ++golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= ++golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= + golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= + golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= + golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= +@@ -198,8 +198,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn + golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= + golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= + golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= +-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg= +-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s= ++golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= ++golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= + golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= + golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= + golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +-- +2.54.0 +