From e7db125d59ffd7509e910f9d8042cf77b612a196 Mon Sep 17 00:00:00 2001 From: ajayk Date: Tue, 25 Jul 2023 08:43:13 -0700 Subject: [PATCH] move cve fixes from github.com/docker/distribution@v2.8.2-beta.1 to github.com/docker/distribution@v2.8.2 --- argo-cd.yaml | 4 ++-- cadvisor.yaml | 4 ++-- calico.yaml | 4 ++-- cluster-autoscaler.yaml | 4 ++-- crane.yaml | 4 ++-- cri-tools.yaml | 4 ++-- kube-bench.yaml | 4 ++-- kubernetes-dashboard.yaml | 4 ++-- paranoia.yaml | 4 ++-- prometheus-operator.yaml | 4 ++-- spire-server.yaml | 4 ++-- tekton-chains.yaml | 4 ++-- zot.yaml | 4 ++-- 13 files changed, 26 insertions(+), 26 deletions(-) diff --git a/argo-cd.yaml b/argo-cd.yaml index ef5e182c648d..c3c80a70e75a 100644 --- a/argo-cd.yaml +++ b/argo-cd.yaml @@ -1,7 +1,7 @@ package: name: argo-cd version: 2.7.9 - epoch: 1 + epoch: 2 description: Declarative continuous deployment for Kubernetes. copyright: - license: Apache-2.0 @@ -39,7 +39,7 @@ pipeline: unset GOFLAGS # CVE-2023-2253 - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 # CVE-2023-2728, CVE-2023-2727 go get k8s.io/kubernetes@v1.24.15 diff --git a/cadvisor.yaml b/cadvisor.yaml index 20c9dec9715d..e9363f2681c6 100644 --- a/cadvisor.yaml +++ b/cadvisor.yaml @@ -1,7 +1,7 @@ package: name: cadvisor version: 0.47.3 - epoch: 1 + epoch: 2 description: Analyzes resource usage and performance characteristics of running containers. copyright: - license: Apache-2.0 @@ -30,7 +30,7 @@ pipeline: # Handle GHSA-232p-vwff-86mp GHSA-33pg-m6jh-5237 and GHSA-6wrf-mxfj-pf5p go get github.com/docker/docker@v20.10.24 # Handle GHSA-hqxw-f8mx-cpmw - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 go mod tidy cd cmd go mod tidy diff --git a/calico.yaml b/calico.yaml index 7c9d8b2d88cc..b224198e0d44 100644 --- a/calico.yaml +++ b/calico.yaml @@ -1,7 +1,7 @@ package: name: calico version: 3.26.1 - epoch: 9 + epoch: 10 description: "Cloud native networking and network security" target-architecture: - x86_64 @@ -51,7 +51,7 @@ pipeline: expected-commit: b1d192c95c89288e163038c5095fd23f9adfb8c1 - runs: | # Remediate GHSA-hqxw-f8mx-cpmw - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 # Remediate GHSA-cfgp-2977-2fmm go get google.golang.org/grpc@v1.53.0 diff --git a/cluster-autoscaler.yaml b/cluster-autoscaler.yaml index e59422b9b254..dbbbff519a16 100644 --- a/cluster-autoscaler.yaml +++ b/cluster-autoscaler.yaml @@ -1,7 +1,7 @@ package: name: cluster-autoscaler version: 1.27.2 - epoch: 3 + epoch: 4 description: Autoscaling components for Kubernetes copyright: - license: Apache-2.0 @@ -27,7 +27,7 @@ pipeline: packages: . output: cluster-autoscaler ldflags: -s -w - deps: github.com/docker/distribution@v2.8.2-beta.1 + deps: github.com/docker/distribution@v2.8.2 vendor: true - uses: strip diff --git a/crane.yaml b/crane.yaml index bf5e8176bb39..aaca3074de29 100644 --- a/crane.yaml +++ b/crane.yaml @@ -1,7 +1,7 @@ package: name: crane version: 0.15.2 - epoch: 4 + epoch: 5 description: Tool for interacting with remote images and registries. copyright: - license: Apache-2.0 @@ -29,7 +29,7 @@ pipeline: packages: ./cmd/crane ldflags: -s -w -buildid= -X github.com/google/go-containerregistry/cmd/crane/cmd.Version=${{package.version}} -X github.com/google/go-containerregistry/pkg/v1/remote/transport.Version=${{package.version}} output: crane - deps: github.com/docker/distribution@v2.8.2-beta.1 + deps: github.com/docker/distribution@v2.8.2 vendor: true - uses: strip diff --git a/cri-tools.yaml b/cri-tools.yaml index 6e2bbf1be2ad..6280af3b8d78 100644 --- a/cri-tools.yaml +++ b/cri-tools.yaml @@ -1,7 +1,7 @@ package: name: cri-tools version: 1.27.1 - epoch: 1 + epoch: 2 description: CLI and validation tools for Kubelet Container Runtime Interface (CRI) . copyright: - license: Apache-2.0 @@ -23,7 +23,7 @@ pipeline: - runs: | # Fix for CVE-2023-2253 - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 make vendor - uses: go/build diff --git a/kube-bench.yaml b/kube-bench.yaml index e29db51f6e7c..d605fa35a2fc 100644 --- a/kube-bench.yaml +++ b/kube-bench.yaml @@ -1,7 +1,7 @@ package: name: kube-bench version: 0.6.15 - epoch: 0 + epoch: 1 description: Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark copyright: - license: Apache-2.0 @@ -27,7 +27,7 @@ pipeline: modroot: . packages: . output: kube-bench - deps: github.com/docker/distribution@v2.8.2-beta.1 + deps: github.com/docker/distribution@v2.8.2 ldflags: | -s -w -X github.com/aquasecurity/kube-bench/cmd.cfgDir=/etc/kube-bench/cfg diff --git a/kubernetes-dashboard.yaml b/kubernetes-dashboard.yaml index 82b4e9101714..e74107795cc7 100644 --- a/kubernetes-dashboard.yaml +++ b/kubernetes-dashboard.yaml @@ -2,7 +2,7 @@ package: name: kubernetes-dashboard # When bumping, check to see if the GHSA mitigations below can be removed. version: 2.7.0 - epoch: 4 + epoch: 5 description: General-purpose web UI for Kubernetes clusters copyright: - license: Apache-2.0 @@ -34,7 +34,7 @@ pipeline: go get golang.org/x/text@v0.3.8 go get golang.org/x/net@v0.7.0 # Mitigate CVE-2023-2253 - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 go mod tidy PATH=/root/go/bin:$PATH GOPATH=$(go env GOPATH) ARCH=$(go env GOARCH) make build diff --git a/paranoia.yaml b/paranoia.yaml index 04a970b3f87b..329c2ac29d56 100644 --- a/paranoia.yaml +++ b/paranoia.yaml @@ -1,7 +1,7 @@ package: name: paranoia version: 0.2.1 - epoch: 3 + epoch: 4 description: Inspect certificate authorities in container images copyright: - license: Apache-2.0 @@ -23,7 +23,7 @@ pipeline: - runs: | # GHSA-hqxw-f8mx-cpmw - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 # GHSA-232p-vwff-86mp, GHSA-33pg-m6jh-5237, GHSA-6wrf-mxfj-pf5p go get github.com/docker/docker@v20.10.24 diff --git a/prometheus-operator.yaml b/prometheus-operator.yaml index b50394bf3bf0..0e7808b12939 100644 --- a/prometheus-operator.yaml +++ b/prometheus-operator.yaml @@ -1,7 +1,7 @@ package: name: prometheus-operator version: 0.66.0 - epoch: 1 + epoch: 2 description: Prometheus Operator creates/configures/manages Prometheus clusters atop Kubernetes copyright: - license: Apache-2.0 @@ -28,7 +28,7 @@ pipeline: - working-directory: ${{package.name}} pipeline: - runs: | - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 go mod tidy - uses: autoconf/make with: diff --git a/spire-server.yaml b/spire-server.yaml index a3afd2692177..e618edbe1ae8 100644 --- a/spire-server.yaml +++ b/spire-server.yaml @@ -1,7 +1,7 @@ package: name: spire-server version: 1.7.0 - epoch: 1 + epoch: 2 description: The SPIFFE Runtime Environment (SPIRE) server copyright: - license: Apache-2.0 @@ -41,7 +41,7 @@ pipeline: # Mitigate some CVEs go get github.com/cloudflare/circl@v1.3.3 - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 go get github.com/sigstore/rekor@v1.2.0 go mod tidy diff --git a/tekton-chains.yaml b/tekton-chains.yaml index 8172a6d94de8..9a70387677d0 100644 --- a/tekton-chains.yaml +++ b/tekton-chains.yaml @@ -1,7 +1,7 @@ package: name: tekton-chains version: 0.16.0 - epoch: 0 + epoch: 1 description: Supply Chain Security in Tekton Pipelines copyright: - license: Apache-2.0 @@ -24,7 +24,7 @@ pipeline: output: tekton-chains modroot: chains vendor: true - deps: github.com/cloudflare/circl@v1.3.3 github.com/docker/distribution@v2.8.2-beta.1 + deps: github.com/cloudflare/circl@v1.3.3 github.com/docker/distribution@v2.8.2 update: enabled: true diff --git a/zot.yaml b/zot.yaml index 5659696a0185..158f4736ccde 100644 --- a/zot.yaml +++ b/zot.yaml @@ -1,7 +1,7 @@ package: name: zot version: 1.4.3 # Check if the Go module patching can be removed in the next release. - epoch: 7 + epoch: 8 description: A production-ready vendor-neutral OCI-native container image registry (purely based on OCI Distribution Specification) copyright: - license: Apache-2.0 @@ -35,7 +35,7 @@ pipeline: sed -i '/github\.com\/opencontainers\/runc v1\.1\.2/d' go.mod sed -i '/github\.com\/hashicorp\/go-getter v1\.6\.1/d' go.mod - go get github.com/docker/distribution@v2.8.2-beta.1 + go get github.com/docker/distribution@v2.8.2 go get github.com/docker/docker@v20.10.24 go get github.com/hashicorp/go-getter@v1.7.0 go get github.com/opencontainers/runc@v1.1.5