move cve fixes from github.com/docker/distribution@v2.8.2-beta.1 to g…

argo-cd.yaml

@@ -1,7 +1,7 @@
 package:
   name: argo-cd
   version: 2.7.9
-  epoch: 1
+  epoch: 2
   description: Declarative continuous deployment for Kubernetes.
   copyright:
     - license: Apache-2.0
@@ -39,7 +39,7 @@ pipeline:
       unset GOFLAGS
 
       # CVE-2023-2253
-      go get github.com/docker/distribution@v2.8.2-beta.1
+      go get github.com/docker/distribution@v2.8.2
 
       # CVE-2023-2728, CVE-2023-2727
       go get k8s.io/kubernetes@v1.24.15

cadvisor.yaml

@@ -1,7 +1,7 @@
 package:
   name: cadvisor
   version: 0.47.3
-  epoch: 1
+  epoch: 2
   description: Analyzes resource usage and performance characteristics of running containers.
   copyright:
     - license: Apache-2.0
@@ -30,7 +30,7 @@ pipeline:
       # Handle GHSA-232p-vwff-86mp GHSA-33pg-m6jh-5237 and GHSA-6wrf-mxfj-pf5p
       go get github.com/docker/docker@v20.10.24
       # Handle GHSA-hqxw-f8mx-cpmw
-      go get github.com/docker/distribution@v2.8.2-beta.1
+      go get github.com/docker/distribution@v2.8.2
       go mod tidy
       cd cmd
       go mod tidy

calico.yaml

@@ -1,7 +1,7 @@
 package:
   name: calico
   version: 3.26.1
-  epoch: 9
+  epoch: 10
   description: "Cloud native networking and network security"
   target-architecture:
     - x86_64
@@ -51,7 +51,7 @@ pipeline:
       expected-commit: b1d192c95c89288e163038c5095fd23f9adfb8c1
   - runs: |
       # Remediate GHSA-hqxw-f8mx-cpmw
-      go get github.com/docker/distribution@v2.8.2-beta.1
+      go get github.com/docker/distribution@v2.8.2
 
       # Remediate GHSA-cfgp-2977-2fmm
       go get google.golang.org/grpc@v1.53.0

cluster-autoscaler.yaml

@@ -1,7 +1,7 @@
 package:
   name: cluster-autoscaler
   version: 1.27.2
-  epoch: 3
+  epoch: 4
   description: Autoscaling components for Kubernetes
   copyright:
     - license: Apache-2.0
@@ -27,7 +27,7 @@ pipeline:
       packages: .
       output: cluster-autoscaler
       ldflags: -s -w
-      deps: github.com/docker/distribution@v2.8.2-beta.1
+      deps: github.com/docker/distribution@v2.8.2
       vendor: true
 
   - uses: strip

crane.yaml

@@ -1,7 +1,7 @@
 package:
   name: crane
   version: 0.15.2
-  epoch: 4
+  epoch: 5
   description: Tool for interacting with remote images and registries.
   copyright:
     - license: Apache-2.0
@@ -29,7 +29,7 @@ pipeline:
       packages: ./cmd/crane
       ldflags: -s -w -buildid= -X github.com/google/go-containerregistry/cmd/crane/cmd.Version=${{package.version}} -X github.com/google/go-containerregistry/pkg/v1/remote/transport.Version=${{package.version}}
       output: crane
-      deps: github.com/docker/distribution@v2.8.2-beta.1
+      deps: github.com/docker/distribution@v2.8.2
       vendor: true
 
   - uses: strip

cri-tools.yaml

@@ -1,7 +1,7 @@
 package:
   name: cri-tools
   version: 1.27.1
-  epoch: 1
+  epoch: 2
   description: CLI and validation tools for Kubelet Container Runtime Interface (CRI) .
   copyright:
     - license: Apache-2.0
@@ -23,7 +23,7 @@ pipeline:
 
   - runs: |
       # Fix for CVE-2023-2253
-      go get github.com/docker/distribution@v2.8.2-beta.1
+      go get github.com/docker/distribution@v2.8.2
       make vendor
 
   - uses: go/build

kube-bench.yaml

@@ -1,7 +1,7 @@
 package:
   name: kube-bench
   version: 0.6.15
-  epoch: 0
+  epoch: 1
   description: Checks whether Kubernetes is deployed according to security best practices as defined in the CIS Kubernetes Benchmark
   copyright:
     - license: Apache-2.0
@@ -27,7 +27,7 @@ pipeline:
       modroot: .
       packages: .
       output: kube-bench
-      deps: github.com/docker/distribution@v2.8.2-beta.1
+      deps: github.com/docker/distribution@v2.8.2
       ldflags: |
         -s -w
         -X github.com/aquasecurity/kube-bench/cmd.cfgDir=/etc/kube-bench/cfg

kubernetes-dashboard.yaml

@@ -2,7 +2,7 @@ package:
   name: kubernetes-dashboard
   # When bumping, check to see if the GHSA mitigations below can be removed.
   version: 2.7.0
-  epoch: 4
+  epoch: 5
   description: General-purpose web UI for Kubernetes clusters
   copyright:
     - license: Apache-2.0
@@ -34,7 +34,7 @@ pipeline:
       go get golang.org/x/text@v0.3.8
       go get golang.org/x/net@v0.7.0
       # Mitigate CVE-2023-2253
-      go get github.com/docker/distribution@v2.8.2-beta.1
+      go get github.com/docker/distribution@v2.8.2
       go mod tidy
 
       PATH=/root/go/bin:$PATH GOPATH=$(go env GOPATH) ARCH=$(go env GOARCH) make build

paranoia.yaml

@@ -1,7 +1,7 @@
 package:
   name: paranoia
   version: 0.2.1
-  epoch: 3
+  epoch: 4
   description: Inspect certificate authorities in container images
   copyright:
     - license: Apache-2.0
@@ -23,7 +23,7 @@ pipeline:
 
   - runs: |
       # GHSA-hqxw-f8mx-cpmw
-      go get github.com/docker/distribution@v2.8.2-beta.1
+      go get github.com/docker/distribution@v2.8.2
 
       # GHSA-232p-vwff-86mp, GHSA-33pg-m6jh-5237, GHSA-6wrf-mxfj-pf5p
       go get github.com/docker/docker@v20.10.24

prometheus-operator.yaml

@@ -1,7 +1,7 @@
 package:
   name: prometheus-operator
   version: 0.66.0
-  epoch: 1
+  epoch: 2
   description: Prometheus Operator creates/configures/manages Prometheus clusters atop Kubernetes
   copyright:
     - license: Apache-2.0
@@ -28,7 +28,7 @@ pipeline:
   - working-directory: ${{package.name}}
     pipeline:
       - runs: |
-          go get github.com/docker/distribution@v2.8.2-beta.1
+          go get github.com/docker/distribution@v2.8.2
           go mod tidy
       - uses: autoconf/make
         with:

spire-server.yaml

@@ -1,7 +1,7 @@
 package:
   name: spire-server
   version: 1.7.0
-  epoch: 1
+  epoch: 2
   description: The SPIFFE Runtime Environment (SPIRE) server
   copyright:
     - license: Apache-2.0
@@ -41,7 +41,7 @@ pipeline:
 
       # Mitigate some CVEs
       go get github.com/cloudflare/circl@v1.3.3
-      go get github.com/docker/distribution@v2.8.2-beta.1
+      go get github.com/docker/distribution@v2.8.2
       go get github.com/sigstore/rekor@v1.2.0
       go mod tidy
 

tekton-chains.yaml

@@ -1,7 +1,7 @@
 package:
   name: tekton-chains
   version: 0.16.0
-  epoch: 0
+  epoch: 1
   description: Supply Chain Security in Tekton Pipelines
   copyright:
     - license: Apache-2.0
@@ -24,7 +24,7 @@ pipeline:
       output: tekton-chains
       modroot: chains
       vendor: true
-      deps: github.com/cloudflare/circl@v1.3.3 github.com/docker/distribution@v2.8.2-beta.1
+      deps: github.com/cloudflare/circl@v1.3.3 github.com/docker/distribution@v2.8.2
 
 update:
   enabled: true

zot.yaml

@@ -1,7 +1,7 @@
 package:
   name: zot
   version: 1.4.3 # Check if the Go module patching can be removed in the next release.
-  epoch: 7
+  epoch: 8
   description: A production-ready vendor-neutral OCI-native container image registry (purely based on OCI Distribution Specification)
   copyright:
     - license: Apache-2.0
@@ -35,7 +35,7 @@ pipeline:
       sed -i '/github\.com\/opencontainers\/runc v1\.1\.2/d' go.mod
       sed -i '/github\.com\/hashicorp\/go-getter v1\.6\.1/d' go.mod
 
-      go get github.com/docker/distribution@v2.8.2-beta.1
+      go get github.com/docker/distribution@v2.8.2
       go get github.com/docker/docker@v20.10.24
       go get github.com/hashicorp/go-getter@v1.7.0
       go get github.com/opencontainers/runc@v1.1.5