Skip to content

sonarqube/25.6.0.109173-r0: cve remediation#56973

Closed
octo-sts[bot] wants to merge 1 commit into
mainfrom
cve-sonarqube-25.6.0.109173-r0-2c89fe5628821664a029718dff47e0d1
Closed

sonarqube/25.6.0.109173-r0: cve remediation#56973
octo-sts[bot] wants to merge 1 commit into
mainfrom
cve-sonarqube-25.6.0.109173-r0-2c89fe5628821664a029718dff47e0d1

sonarqube/25.6.0.109173-r0: fix GHSA-wxr5-93ph-8wr9

587596b
Select commit
Loading
Failed to load commit list.
Chainguard Internal / elastic-build failed Jun 18, 2025 in 3m 3s

Failed to build APKs

Build ID: 9d1c7eb1-b126-40c5-a247-a01de27827f8
Error: failed to build sonarqube: building group: pod failed: build failed
did not test because building group: pod failed: build failed

Details

x86_64 Logs

Click to expand 
parsed env
configuring puller identity "720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69"...
running command chainctl [auth login --audience apk.cgr.dev --identity 720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69]
Successfully exchanged token.
Valid! Id: 720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69
Updates are available for chainctl (current version: 0.2.89; latest: 0.2.90). To install, please run:
    $ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running build...
running command melange [build sonarqube.yaml --gcplog --source-dir sonarqube --arch x86_64 --arch=x86_64 --env-file=build-x86_64.env --namespace=wolfi --pipeline-dir=pipelines --out-dir=./packages/ --runner=qemu --keyring-append=https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --repository-append=https://packages.wolfi.dev/os --repository-append=https://apk.cgr.dev/wolfi-presubmit/c9612f46ada9aaf5cbd33e71c705ca7cae6818bc --repository-append=https://apk.cgr.dev/wolfi-presubmit/c9612f46ada9aaf5cbd33e71c705ca7cae6818bc --git-repo-url=https://github.com/wolfi-dev/os]
melange v0.26.12+dirty is building:
populating workspace /tmp/melange-workspace-437396842 from sonarqube
Updates are available for chainctl (current version: 0.2.89; latest: 0.2.90). To install, please run:
    $ chainctl update
image configuration:
  contents:
    build repositories: [https://apk.cgr.dev/wolfi-presubmit/c9612f46ada9aaf5cbd33e71c705ca7cae6818bc https://packages.wolfi.dev/os]
    runtime repositories: []
    keyring:      [https://packages.wolfi.dev/os/wolfi-signing.rsa.pub]
    packages:     [alsa-lib=1.2.14-r1 binutils=2.44-r9 build-base=1-r8 busybox=1.37.0-r46 c-ares=1.34.5-r1 ca-certificates-bundle=20241121-r42 ca-certificates=20241121-r42 cyrus-sasl=2.1.28-r42 fontconfig-config=2.16.2-r1 freetype=2.13.3-r1 gcc=15.1.0-r1 gdbm=1.25-r1 giflib=5.2.2-r9 git=2.50.0-r0 glibc-dev=2.41-r9 glibc-locale-posix=2.41-r9 glibc=2.41-r9 gmp=6.3.0-r6 heimdal-libs=7.8.0-r41 icu-data-full=75.1-r41 icu-libs=75.1-r41 isl=0.27-r3 java-cacerts=20241121-r41 java-common-jre=0.2-r1 java-common=0.2-r1 keyutils-libs=1.6.3-r35 krb5-conf=1.0-r6 krb5-libs=1.21.3-r42 lcms2=2.17-r3 ld-linux=2.41-r9 libatomic=15.1.0-r1 libbrotlicommon1=1.1.0-r5 libbrotlidec1=1.1.0-r5 libbrotlienc1=1.1.0-r5 libbz2-1=1.0.8-r18 libcom_err=1.47.2-r22 libcrypt1=2.41-r9 libcrypto3=3.5.0-r2 libcurl-openssl4=8.14.1-r2 libexpat1=2.7.1-r1 libffi=3.5.1-r0 libfontconfig1=2.16.2-r1 libgcc=15.1.0-r1 libgo=15.1.0-r1 libgomp=15.1.0-r1 libidn2=2.3.8-r1 libjpeg-turbo=3.1.1-r0 libldap=2.6.10-r2 libnghttp2-14=1.66.0-r0 libpcre2-8-0=10.45-r2 libpng=1.6.49-r0 libpsl=0.21.5-r5 libquadmath=15.1.0-r1 libssl3=3.5.0-r2 libstdc++-dev=15.1.0-r1 libstdc++=15.1.0-r1 libtasn1=4.20.0-r3 libunistring=1.3-r2 libuv=1.51.0-r0 libverto=0.3.2-r5 libx11=1.8.12-r1 libxau=1.0.12-r2 libxcb=1.17.0-r6 libxcrypt-dev=4.4.38-r2 libxcrypt=4.4.38-r2 libxdmcp=1.1.5-r7 libxext=1.3.6-r5 libxi=1.8.2-r2 libxrender=0.9.12-r3 libxtst=1.2.5-r2 libzstd1=1.5.7-r2 linux-headers=6.15.2-r0 make=4.4.1-r6 mpc=1.3.1-r6 mpfr=4.2.2-r1 ncurses-terminfo-base=6.5_p20241228-r2 ncurses=6.5_p20241228-r2 nodejs-18=18.20.8-r1 npm=11.4.2-r0 nss-db=2.41-r9 nss-hesiod=2.41-r9 openjdk-17-default-jdk=17.0.15-r1 openjdk-17=17.0.15-r1 openssf-compiler-options=20240627-r20 p11-kit-trust=0.25.5-r2 p11-kit=0.25.5-r2 patch=2.8-r1 pkgconf=2.4.3-r2 pombump=0.0.14-r1 posix-cc-wrappers=1-r6 readline=8.2.13-r4 sqlite-libs=3.50.1-r0 ttf-dejavu=2.37-r6 wolfi-baselayout=20230201-r20 yarn=1.22.22-r1 zlib=1.3.1-r7 zstd-dev=1.5.7-r2]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
auth configured for: []
installing wolfi-baselayout (20230201-r20)
installing ca-certificates-bundle (20241121-r42)
installing glibc-locale-posix (2.41-r9)
installing libgcc (15.1.0-r1)
installing glibc (2.41-r9)
installing ld-linux (2.41-r9)
installing alsa-lib (1.2.14-r1)
installing libstdc++ (15.1.0-r1)
installing libzstd1 (1.5.7-r2)
installing binutils (2.44-r9)
installing libxcrypt (4.4.38-r2)
installing libxcrypt-dev (4.4.38-r2)
installing linux-headers (6.15.2-r0)
installing nss-db (2.41-r9)
installing nss-hesiod (2.41-r9)
installing glibc-dev (2.41-r9)
installing libquadmath (15.1.0-r1)
installing libstdc++-dev (15.1.0-r1)
installing openssf-compiler-options (20240627-r20)
installing posix-cc-wrappers (1-r6)
installing libatomic (15.1.0-r1)
installing gmp (6.3.0-r6)
installing libgo (15.1.0-r1)
installing libgomp (15.1.0-r1)
installing isl (0.27-r3)
installing mpfr (4.2.2-r1)
installing mpc (1.3.1-r6)
installing zlib (1.3.1-r7)
installing gcc (15.1.0-r1)
installing make (4.4.1-r6)
installing pkgconf (2.4.3-r2)
installing build-base (1-r8)
installing libcrypt1 (2.41-r9)
installing busybox (1.37.0-r46)
installing c-ares (1.34.5-r1)
installing libcrypto3 (3.5.0-r2)
installing ca-certificates (20241121-r42)
installing gdbm (1.25-r1)
installing ncurses-terminfo-base (6.5_p20241228-r2)
installing ncurses (6.5_p20241228-r2)
installing readline (8.2.13-r4)
installing sqlite-libs (3.50.1-r0)
installing heimdal-libs (7.8.0-r41)
installing cyrus-sasl (2.1.28-r42)
installing fontconfig-config (2.16.2-r1)
installing libbrotlicommon1 (1.1.0-r5)
installing libbrotlidec1 (1.1.0-r5)
installing libbz2-1 (1.0.8-r18)
installing libpng (1.6.49-r0)
installing freetype (2.13.3-r1)
installing giflib (5.2.2-r9)
installing krb5-conf (1.0-r6)
installing libcom_err (1.47.2-r22)
installing keyutils-libs (1.6.3-r35)
installing libssl3 (3.5.0-r2)
installing libverto (0.3.2-r5)
installing krb5-libs (1.21.3-r42)
installing libldap (2.6.10-r2)
installing libnghttp2-14 (1.66.0-r0)
installing libunistring (1.3-r2)
installing libidn2 (2.3.8-r1)
installing libpsl (0.21.5-r5)
installing libcurl-openssl4 (8.14.1-r2)
installing libexpat1 (2.7.1-r1)
installing libpcre2-8-0 (10.45-r2)
installing git (2.50.0-r0)
installing icu-data-full (75.1-r41)
installing icu-libs (75.1-r41)
installing libffi (3.5.1-r0)
installing libtasn1 (4.20.0-r3)
installing p11-kit (0.25.5-r2)
installing p11-kit-trust (0.25.5-r2)
installing java-cacerts (20241121-r41)
installing java-common-jre (0.2-r1)
installing java-common (0.2-r1)
installing lcms2 (2.17-r3)
installing libbrotlienc1 (1.1.0-r5)
installing libfontconfig1 (2.16.2-r1)
installing libjpeg-turbo (3.1.1-r0)
installing libuv (1.51.0-r0)
installing libxau (1.0.12-r2)
installing libxdmcp (1.1.5-r7)
installing libxcb (1.17.0-r6)
installing libx11 (1.8.12-r1)
installing libxext (1.3.6-r5)
installing libxi (1.8.2-r2)
installing libxrender (0.9.12-r3)
installing libxtst (1.2.5-r2)
installing nodejs-18 (18.20.8-r1)
installing npm (11.4.2-r0)
installing ttf-dejavu (2.37-r6)
installing openjdk-17 (17.0.15-r1)
installing openjdk-17-default-jdk (17.0.15-r1)
installing patch (2.8-r1)
installing pombump (0.0.14-r1)
installing yarn (1.22.22-r1)
installing zstd-dev (1.5.7-r2)
qemu: generating ssh key pairs for ephemeral VM
qemu: generating initramfs
image configuration:
  contents:
    build repositories: [https://apk.cgr.dev/chainguard]
    runtime repositories: []
    keyring:      []
    packages:     [microvm-init]
installing wolfi-baselayout (20230201-r20)
installing ca-certificates-bundle (20241121-r42)
installing libgcc (15.1.0-r1)
installing glibc-locale-posix (2.41-r9)
installing glibc (2.41-r9)
installing ld-linux (2.41-r9)
installing gnutar (1.35-r3)
installing libattr1 (2.5.2-r6)
installing attr (2.5.2-r6)
installing zlib (1.3.1-r7)
installing libzstd1 (1.5.7-r2)
installing xz (5.8.1-r1)
installing libcrypto3 (3.5.0-r2)
installing kmod (34.2-r40)
installing libbz2-1 (1.0.8-r18)
installing libelf (0.193-r1)
installing libmnl (1.0.5-r6)
installing libnftnl (1.2.9-r0)
installing iptables (1.8.11-r22)
installing iproute2 (6.15.0-r0)
installing libblkid (2.41-r42)
installing libmount (2.41-r42)
installing mount (2.41-r42)
installing ncurses-terminfo-base (6.5_p20241228-r2)
installing ncurses (6.5_p20241228-r2)
installing setarch (2.41-r42)
installing libuuid (2.41-r42)
installing libfdisk (2.41-r42)
installing sqlite-libs (3.50.1-r0)
installing util-linux (2.41-r42)
installing libsmartcols (2.41-r42)
installing util-linux-misc (2.41-r42)
installing libpcre2-8-0 (10.45-r2)
installing libsepol (3.8.1-r3)
installing libselinux (3.8.1-r42)
installing libxcrypt (4.4.38-r2)
installing libcrypt1 (2.41-r9)
installing linux-pam (1.7.1-r0)
installing openssh-keygen (10.0_p1-r1)
installing openssh-server-config (10.0_p1-r1)
installing openssh-server (10.0_p1-r1)
installing libstdc++ (15.1.0-r1)
installing inih (60-r0)
installing userspace-rcu (0.15.3-r0)
installing xfsprogs-core (6.14.0-r4)
installing xfsprogs (6.14.0-r4)
installing busybox (1.37.0-r46)
installing microvm-init (0.0.1-r11)
qemu: starting VM
qemu: waiting for SSH

aarch64 Logs

Click to expand 
parsed env
configuring puller identity "720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69"...
running command chainctl [auth login --audience apk.cgr.dev --identity 720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69]
Successfully exchanged token.
Valid! Id: 720909c9f5279097d847ad02a2f24ba8f59de36a/a49c7fedc33adf69
Updates are available for chainctl (current version: 0.2.89; latest: 0.2.90). To install, please run:
    $ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running build...
running command melange [build sonarqube.yaml --gcplog --source-dir sonarqube --arch aarch64 --arch=aarch64 --env-file=build-aarch64.env --namespace=wolfi --pipeline-dir=pipelines --out-dir=./packages/ --runner=bubblewrap --keyring-append=https://packages.wolfi.dev/os/wolfi-signing.rsa.pub --repository-append=https://packages.wolfi.dev/os --repository-append=https://apk.cgr.dev/wolfi-presubmit/c9612f46ada9aaf5cbd33e71c705ca7cae6818bc --repository-append=https://apk.cgr.dev/wolfi-presubmit/c9612f46ada9aaf5cbd33e71c705ca7cae6818bc --git-repo-url=https://github.com/wolfi-dev/os]
melange v0.26.12+dirty is building:
populating workspace /tmp/melange-workspace-2797798356 from sonarqube
Updates are available for chainctl (current version: 0.2.89; latest: 0.2.90). To install, please run:
    $ chainctl update
image configuration:
  contents:
    build repositories: [https://apk.cgr.dev/wolfi-presubmit/c9612f46ada9aaf5cbd33e71c705ca7cae6818bc https://packages.wolfi.dev/os]
    runtime repositories: []
    keyring:      [https://packages.wolfi.dev/os/wolfi-signing.rsa.pub]
    packages:     [alsa-lib=1.2.14-r1 binutils=2.44-r9 build-base=1-r8 busybox=1.37.0-r46 c-ares=1.34.5-r1 ca-certificates-bundle=20241121-r42 ca-certificates=20241121-r42 cyrus-sasl=2.1.28-r42 fontconfig-config=2.16.2-r1 freetype=2.13.3-r1 gcc=15.1.0-r1 gdbm=1.25-r1 giflib=5.2.2-r9 git=2.50.0-r0 glibc-dev=2.41-r9 glibc-locale-posix=2.41-r9 glibc=2.41-r9 gmp=6.3.0-r6 heimdal-libs=7.8.0-r41 icu-data-full=75.1-r41 icu-libs=75.1-r41 isl=0.27-r3 java-cacerts=20241121-r41 java-common-jre=0.2-r1 java-common=0.2-r1 keyutils-libs=1.6.3-r35 krb5-conf=1.0-r6 krb5-libs=1.21.3-r42 lcms2=2.17-r3 ld-linux=2.41-r9 libatomic=15.1.0-r1 libbrotlicommon1=1.1.0-r5 libbrotlidec1=1.1.0-r5 libbrotlienc1=1.1.0-r5 libbz2-1=1.0.8-r18 libcom_err=1.47.2-r22 libcrypt1=2.41-r9 libcrypto3=3.5.0-r2 libcurl-openssl4=8.14.1-r2 libexpat1=2.7.1-r1 libffi=3.5.1-r0 libfontconfig1=2.16.2-r1 libgcc=15.1.0-r1 libgo=15.1.0-r1 libgomp=15.1.0-r1 libidn2=2.3.8-r1 libjpeg-turbo=3.1.1-r0 libldap=2.6.10-r2 libnghttp2-14=1.66.0-r0 libpcre2-8-0=10.45-r2 libpng=1.6.49-r0 libpsl=0.21.5-r5 libquadmath=15.1.0-r1 libssl3=3.5.0-r2 libstdc++-dev=15.1.0-r1 libstdc++=15.1.0-r1 libtasn1=4.20.0-r3 libunistring=1.3-r2 libuv=1.51.0-r0 libverto=0.3.2-r5 libx11=1.8.12-r1 libxau=1.0.12-r2 libxcb=1.17.0-r6 libxcrypt-dev=4.4.38-r2 libxcrypt=4.4.38-r2 libxdmcp=1.1.5-r7 libxext=1.3.6-r5 libxi=1.8.2-r2 libxrender=0.9.12-r3 libxtst=1.2.5-r2 libzstd1=1.5.7-r2 linux-headers=6.15.2-r0 make=4.4.1-r6 mpc=1.3.1-r6 mpfr=4.2.2-r1 ncurses-terminfo-base=6.5_p20241228-r2 ncurses=6.5_p20241228-r2 nodejs-18=18.20.8-r1 npm=11.4.2-r0 nss-db=2.41-r9 nss-hesiod=2.41-r9 openjdk-17-default-jdk=17.0.15-r1 openjdk-17=17.0.15-r1 openssf-compiler-options=20240627-r20 p11-kit-trust=0.25.5-r2 p11-kit=0.25.5-r2 patch=2.8-r1 pkgconf=2.4.3-r2 pombump=0.0.14-r1 posix-cc-wrappers=1-r6 readline=8.2.13-r4 sqlite-libs=3.50.1-r0 ttf-dejavu=2.37-r6 wolfi-baselayout=20230201-r20 yarn=1.22.22-r1 zlib=1.3.1-r7 zstd-dev=1.5.7-r2]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
auth configured for: []
installing wolfi-baselayout (20230201-r20)
installing ca-certificates-bundle (20241121-r42)
installing glibc-locale-posix (2.41-r9)
installing libgcc (15.1.0-r1)
installing glibc (2.41-r9)
installing ld-linux (2.41-r9)
installing alsa-lib (1.2.14-r1)
installing libstdc++ (15.1.0-r1)
installing libzstd1 (1.5.7-r2)
installing binutils (2.44-r9)
installing libxcrypt (4.4.38-r2)
installing libxcrypt-dev (4.4.38-r2)
installing linux-headers (6.15.2-r0)
installing nss-db (2.41-r9)
installing nss-hesiod (2.41-r9)
installing glibc-dev (2.41-r9)
installing libquadmath (15.1.0-r1)
installing libstdc++-dev (15.1.0-r1)
installing openssf-compiler-options (20240627-r20)
installing posix-cc-wrappers (1-r6)
installing libatomic (15.1.0-r1)
installing gmp (6.3.0-r6)
installing libgo (15.1.0-r1)
installing libgomp (15.1.0-r1)
installing isl (0.27-r3)
installing mpfr (4.2.2-r1)
installing mpc (1.3.1-r6)
installing zlib (1.3.1-r7)
installing gcc (15.1.0-r1)
installing make (4.4.1-r6)
installing pkgconf (2.4.3-r2)
installing build-base (1-r8)
installing libcrypt1 (2.41-r9)
installing busybox (1.37.0-r46)
installing c-ares (1.34.5-r1)
installing libcrypto3 (3.5.0-r2)
installing ca-certificates (20241121-r42)
installing gdbm (1.25-r1)
installing ncurses-terminfo-base (6.5_p20241228-r2)
installing ncurses (6.5_p20241228-r2)
installing readline (8.2.13-r4)
installing sqlite-libs (3.50.1-r0)
installing heimdal-libs (7.8.0-r41)
installing cyrus-sasl (2.1.28-r42)
installing fontconfig-config (2.16.2-r1)
installing libbrotlicommon1 (1.1.0-r5)
installing libbrotlidec1 (1.1.0-r5)
installing libbz2-1 (1.0.8-r18)
installing libpng (1.6.49-r0)
installing freetype (2.13.3-r1)
installing giflib (5.2.2-r9)
installing krb5-conf (1.0-r6)
installing libcom_err (1.47.2-r22)
installing keyutils-libs (1.6.3-r35)
installing libssl3 (3.5.0-r2)
installing libverto (0.3.2-r5)
installing krb5-libs (1.21.3-r42)
installing libldap (2.6.10-r2)
installing libnghttp2-14 (1.66.0-r0)
installing libunistring (1.3-r2)
installing libidn2 (2.3.8-r1)
installing libpsl (0.21.5-r5)
installing libcurl-openssl4 (8.14.1-r2)
installing libexpat1 (2.7.1-r1)
installing libpcre2-8-0 (10.45-r2)
installing git (2.50.0-r0)
installing icu-data-full (75.1-r41)
installing icu-libs (75.1-r41)
installing libffi (3.5.1-r0)
installing libtasn1 (4.20.0-r3)
installing p11-kit (0.25.5-r2)
installing p11-kit-trust (0.25.5-r2)
installing java-cacerts (20241121-r41)
installing java-common-jre (0.2-r1)
installing java-common (0.2-r1)
installing lcms2 (2.17-r3)
installing libbrotlienc1 (1.1.0-r5)
installing libfontconfig1 (2.16.2-r1)
installing libjpeg-turbo (3.1.1-r0)
installing libuv (1.51.0-r0)
installing libxau (1.0.12-r2)
installing libxdmcp (1.1.5-r7)
installing libxcb (1.17.0-r6)
installing libx11 (1.8.12-r1)
installing libxext (1.3.6-r5)
installing libxi (1.8.2-r2)
installing libxrender (0.9.12-r3)
installing libxtst (1.2.5-r2)
installing nodejs-18 (18.20.8-r1)
installing npm (11.4.2-r0)
installing ttf-dejavu (2.37-r6)
installing openjdk-17 (17.0.15-r1)
installing openjdk-17-default-jdk (17.0.15-r1)
installing patch (2.8-r1)
installing pombump (0.0.14-r1)
installing yarn (1.22.22-r1)
installing zstd-dev (1.5.7-r2)

Indexes

https://apk.cgr.dev/wolfi-presubmit/c9612f46ada9aaf5cbd33e71c705ca7cae6818bc

❌ Failed Packages

  • ❌ sonarqube (error | 33s)

Packages

More Observability

Command

cg build log \
  --build-id 9d1c7eb1-b126-40c5-a247-a01de27827f8 \
  --project prod-wolfi-os \
  --cluster elastic-pre-a \
  --namespace pre-wolfi \
  --start 2025-06-18T17:29:27Z \
  --end 2025-06-18T17:42:31Z \
  --attrs pkg,arch
View more details on Chainguard Internal