Skip to content

flux-source-controller/1.6.2-r1: cve remediation #58640

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
efbar merged 3 commits into from
Jul 10, 2025

Merge branch 'main' into cve-flux-source-controller-1.6.2-r1-b7517d07…

00af230
Select commit
Loading
Failed to load commit list.
Merged

flux-source-controller/1.6.2-r1: cve remediation #58640

Merge branch 'main' into cve-flux-source-controller-1.6.2-r1-b7517d07…
00af230
Select commit
Loading
Failed to load commit list.
Chainguard Internal / elastic-build (eco-2-28) completed Jul 10, 2025 in 4m 34s

Failed to build APKs

Build ID: 6f787aae-7c7f-4bba-9848-aa9f5147237e
Error: failed to build flux-source-controller: building group: pod failed: build failed
did not test because building group: pod failed: build failed

Details

x86_64 Logs

Click to expand 
parsed env
configuring puller identity "e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910"...
running command chainctl [auth login --audience apk.cgr.dev --identity e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910]
Successfully exchanged token.
Valid! Id: e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910
Updates are available for chainctl (current version: 0.2.101; latest: 0.2.102). To install, please run:
    $ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running build...
running command melange [build flux-source-controller.yaml --gcplog --source-dir flux-source-controller --arch x86_64 --arch=x86_64 --env-file=build-x86_64.env --namespace=chainguard --pipeline-dir=pipelines --out-dir=./packages/ --runner=bubblewrap --repository-append=https://apk.cgr.dev/chainguard --repository-append=https://apk.cgr.dev/chainguard-private --repository-append=https://apk.cgr.dev/chainguard-2.28 --repository-append=https://apk.cgr.dev/chainguard-2.28-presubmit/4f40198b061c61e0df0ff31c0abf9c5457fec52a --package-append=ct-manylinux-2.28 --package-append=gcc-14-default --repository-append=https://apk.cgr.dev/chainguard-2.28-presubmit/4f40198b061c61e0df0ff31c0abf9c5457fec52a --git-repo-url=https://github.com/wolfi-dev/os]
melange v0.29.1+dirty is building:
populating workspace /tmp/melange-workspace-290789469 from flux-source-controller
image configuration:
  contents:
    build repositories: [https://apk.cgr.dev/chainguard https://apk.cgr.dev/chainguard-2.28 https://apk.cgr.dev/chainguard-2.28-presubmit/4f40198b061c61e0df0ff31c0abf9c5457fec52a https://apk.cgr.dev/chainguard-private]
    runtime repositories: []
    keyring:      []
    packages:     [bash=5.3-r0 binutils=2.44-r9 build-base=1-r8 busybox=1.37.0-r46 ca-certificates-bundle=20241121-r42 clang-16=16.0.6-r10 coreutils=9.7-r1 ct-manylinux-2.28=1.27.0-r0 curl=8.14.1-r2 cyrus-sasl=2.1.28-r42 findutils=4.10.0-r2 gcc-14-default=14.3.0-r2 gcc-14=14.3.0-r2 gdbm=1.25-r2 gfortran-14=14.3.0-r2 git=2.50.1-r0 glibc-dev=2.41-r53 glibc-locale-posix=2.41-r53 glibc=2.41-r53 gmp=6.3.0-r7 gnutar=1.35-r4 go-1.24=1.24.5-r0 gobump=0.9.1-r0 grep=3.12-r2 heimdal-libs=7.8.0-r41 isl=0.27-r3 jq=1.8.1-r0 keyutils-libs=1.6.3-r35 krb5-conf=1.0-r6 krb5-libs=1.21.3-r42 ld-linux=2.41-r53 libLLVM-16=16.0.6-r10 libacl1=2.3.2-r50 libattr1=2.5.2-r50 libbrotlicommon1=1.1.0-r5 libbrotlidec1=1.1.0-r5 libclang-cpp-16=16.0.6-r10 libcom_err=1.47.2-r22 libcrypt1=2.41-r53 libcrypto3=3.5.1-r0 libcurl-openssl4=8.14.1-r2 libexpat1=2.7.1-r1 libffi=3.5.1-r0 libgcc=15.1.0-r1 libgfortran-14=14.3.0-r2 libgfortran=15.1.0-r1 libidn2=2.3.8-r2 libldap=2.6.10-r3 libnghttp2-14=1.66.0-r0 libpcre2-8-0=10.45-r2 libpsl=0.21.5-r5 libquadmath=15.1.0-r1 libssl3=3.5.1-r0 libstdc++-14-dev=14.3.0-r2 libstdc++-14=14.3.0-r2 libstdc++=15.1.0-r1 libunistring=1.3-r3 libverto=0.3.2-r5 libxcrypt-dev=4.4.38-r2 libxcrypt=4.4.38-r2 libxml2=2.14.4-r0 libzstd1=1.5.7-r2 linux-headers=6.15.5-r0 lld-16=16.0.6-r10 llvm-16=16.0.6-r10 make=4.4.1-r7 mpc=1.3.1-r6 mpfr=4.2.2-r1 ncurses-terminfo-base=6.5_p20250621-r0 ncurses=6.5_p20250621-r0 nss-db=2.41-r53 nss-hesiod=2.41-r53 oniguruma=6.9.10-r1 openssf-compiler-options=20240627-r25 pkgconf=2.5.1-r0 posix-cc-wrappers=1-r6 readline=8.3-r0 scanelf=1.3.8-r4 sed=4.9-r5 sqlite-libs=3.50.2-r0 wolfi-baselayout=20230201-r22 xz=5.8.1-r1 zlib=1.3.1-r50]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
auth configured for: []
installing wolfi-baselayout (20230201-r22)
installing ca-certificates-bundle (20241121-r42)
installing glibc-locale-posix (2.41-r53)
installing libgcc (15.1.0-r1)
installing glibc (2.41-r53)
installing ld-linux (2.41-r53)
installing ncurses-terminfo-base (6.5_p20250621-r0)
installing ncurses (6.5_p20250621-r0)
installing bash (5.3-r0)
installing libstdc++ (15.1.0-r1)
installing libzstd1 (1.5.7-r2)
installing binutils (2.44-r9)
installing libxcrypt (4.4.38-r2)
installing libxcrypt-dev (4.4.38-r2)
installing nss-db (2.41-r53)
installing nss-hesiod (2.41-r53)
installing linux-headers (6.15.5-r0)
installing glibc-dev (2.41-r53)
installing libquadmath (15.1.0-r1)
installing posix-cc-wrappers (1-r6)
installing gmp (6.3.0-r7)
installing isl (0.27-r3)
installing mpfr (4.2.2-r1)
installing mpc (1.3.1-r6)
installing zlib (1.3.1-r50)
installing libstdc++-14 (14.3.0-r2)
installing libstdc++-14-dev (14.3.0-r2)
installing openssf-compiler-options (20240627-r25)
installing gcc-14 (14.3.0-r2)
installing libgfortran-14 (14.3.0-r2)
installing gfortran-14 (14.3.0-r2)
installing libgfortran (15.1.0-r1)
installing gcc-14-default (14.3.0-r2)
installing make (4.4.1-r7)
installing pkgconf (2.5.1-r0)
installing build-base (1-r8)
installing libcrypt1 (2.41-r53)
installing busybox (1.37.0-r46)
installing libffi (3.5.1-r0)
installing xz (5.8.1-r1)
installing libxml2 (2.14.4-r0)
installing libLLVM-16 (16.0.6-r10)
installing libclang-cpp-16 (16.0.6-r10)
installing llvm-16 (16.0.6-r10)
installing clang-16 (16.0.6-r10)
installing libacl1 (2.3.2-r50)
installing libattr1 (2.5.2-r50)
installing libcrypto3 (3.5.1-r0)
installing coreutils (9.7-r1)
installing ct-manylinux-2.28 (1.27.0-r0)
installing libbrotlicommon1 (1.1.0-r5)
installing libbrotlidec1 (1.1.0-r5)
installing libcom_err (1.47.2-r22)
installing keyutils-libs (1.6.3-r35)
installing libssl3 (3.5.1-r0)
installing libverto (0.3.2-r5)
installing krb5-conf (1.0-r6)
installing krb5-libs (1.21.3-r42)
installing gdbm (1.25-r2)
installing readline (8.3-r0)
installing sqlite-libs (3.50.2-r0)
installing heimdal-libs (7.8.0-r41)
installing cyrus-sasl (2.1.28-r42)
installing libldap (2.6.10-r3)
installing libnghttp2-14 (1.66.0-r0)
installing libunistring (1.3-r3)
installing libidn2 (2.3.8-r2)
installing libpsl (0.21.5-r5)
installing libcurl-openssl4 (8.14.1-r2)
installing curl (8.14.1-r2)
installing findutils (4.10.0-r2)
installing libexpat1 (2.7.1-r1)
installing libpcre2-8-0 (10.45-r2)
installing git (2.50.1-r0)
installing gnutar (1.35-r4)
installing go-1.24 (1.24.5-r0)
installing gobump (0.9.1-r0)
installing grep (3.12-r2)
installing oniguruma (6.9.10-r1)
installing jq (1.8.1-r0)
installing lld-16 (16.0.6-r10)
installing scanelf (1.3.8-r4)
installing sed (4.9-r5)
running step "git-checkout"
[git checkout] repo='https://github.com/fluxcd/source-controller' dest='.' depth='unset' branch='' tag='v1.6.2' expcommit='254ef2ec92b4855d2a09bf61a1a6e8b1ac34d4a5' recurse='false'
[git checkout] execute: git config --global --add safe.directory /tmp/tmp.BmTHF357Do
[git checkout] execute: git config --global --add safe.directory /home/build
[git checkout] execute: git clone --quiet --origin=origin --config=user.name=Melange Build [email protected] --config=advice.detachedHead=false --branch=v1.6.2 --depth=1 https://github.com/fluxcd/source-controller /tmp/tmp.BmTHF357Do
warning: refs/tags/v1.6.2 cbd65fa7792abfc882c7267908dad9a793b65b7a is not a commit!
[git checkout] execute: cd /tmp/tmp.BmTHF357Do
[git checkout] tar -c . | tar -C "/home/build" -x
[git checkout] execute: cd /home/build
[git checkout] execute: git config --global --add safe.directory /home/build
[git checkout] execute: git fetch --quiet origin --depth=1 --no-tags +refs/tags/v1.6.2:refs/origin/tags/v1.6.2
[git checkout] execute: git checkout --quiet origin/tags/v1.6.2
[git checkout] tag v1.6.2 is 254ef2ec92b4855d2a09bf61a1a6e8b1ac34d4a5
running step "go/bump"
2025/07/10 08:39:53 Local Go version: 1.24.5
2025/07/10 08:39:53 Running go mod tidy with go version '1.24.5' ...
2025/07/10 08:39:58 Update package: github.com/go-viper/mapstructure/v2
2025/07/10 08:39:58 Running go mod edit -droprequire ...
2025/07/10 08:39:58 Running go get ...
2025/07/10 08:39:59 Update package: helm.sh/helm/v3
2025/07/10 08:39:59 Running go mod edit -droprequire ...
2025/07/10 08:39:59 Running go get ...
2025/07/10 08:39:59 Running go mod tidy with go version '1.24.5' ...
running step "strip"
running pipeline for subpackage flux-source-controller-bitnami-compat
running pipeline for subpackage flux-source-controller-iamguarded-compat
running step "iamguarded/build-compat"
running step "auth/github"
Using OctoSTS to get a token for chainguard-dev/iamguarded-tools as elastic-build
curl: (22) The requested URL returned error: 403
failed to build package: unable to run subpackage flux-source-controller-iamguarded-compat pipeline: unable to run pipeline: unable to run pipeline: unable to run pipeline: exit status 22
failed to build: command melange failed: exit status 1
build failed: command melange failed: exit status 1

aarch64 Logs

Click to expand 
parsed env
configuring puller identity "e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910"...
running command chainctl [auth login --audience apk.cgr.dev --identity e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910]
Successfully exchanged token.
Valid! Id: e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910
Updates are available for chainctl (current version: 0.2.101; latest: 0.2.102). To install, please run:
    $ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running build...
running command melange [build flux-source-controller.yaml --gcplog --source-dir flux-source-controller --arch aarch64 --arch=aarch64 --env-file=build-aarch64.env --namespace=chainguard --pipeline-dir=pipelines --out-dir=./packages/ --runner=bubblewrap --repository-append=https://apk.cgr.dev/chainguard --repository-append=https://apk.cgr.dev/chainguard-private --repository-append=https://apk.cgr.dev/chainguard-2.28 --repository-append=https://apk.cgr.dev/chainguard-2.28-presubmit/4f40198b061c61e0df0ff31c0abf9c5457fec52a --package-append=ct-manylinux-2.28 --package-append=gcc-14-default --repository-append=https://apk.cgr.dev/chainguard-2.28-presubmit/4f40198b061c61e0df0ff31c0abf9c5457fec52a --git-repo-url=https://github.com/wolfi-dev/os]
melange v0.29.1+dirty is building:
populating workspace /tmp/melange-workspace-2960078970 from flux-source-controller
image configuration:
  contents:
    build repositories: [https://apk.cgr.dev/chainguard https://apk.cgr.dev/chainguard-2.28 https://apk.cgr.dev/chainguard-2.28-presubmit/4f40198b061c61e0df0ff31c0abf9c5457fec52a https://apk.cgr.dev/chainguard-private]
    runtime repositories: []
    keyring:      []
    packages:     [bash=5.3-r0 binutils=2.44-r9 build-base=1-r8 busybox=1.37.0-r46 ca-certificates-bundle=20241121-r42 clang-16=16.0.6-r10 coreutils=9.7-r1 ct-manylinux-2.28=1.27.0-r0 curl=8.14.1-r2 cyrus-sasl=2.1.28-r42 findutils=4.10.0-r2 gcc-14-default=14.3.0-r2 gcc-14=14.3.0-r2 gdbm=1.25-r2 gfortran-14=14.3.0-r2 git=2.50.1-r0 glibc-dev=2.41-r53 glibc-locale-posix=2.41-r53 glibc=2.41-r53 gmp=6.3.0-r7 gnutar=1.35-r4 go-1.24=1.24.5-r0 gobump=0.9.1-r0 grep=3.12-r2 heimdal-libs=7.8.0-r41 isl=0.27-r3 jq=1.8.1-r0 keyutils-libs=1.6.3-r35 krb5-conf=1.0-r6 krb5-libs=1.21.3-r42 ld-linux=2.41-r53 libLLVM-16=16.0.6-r10 libacl1=2.3.2-r50 libattr1=2.5.2-r50 libbrotlicommon1=1.1.0-r5 libbrotlidec1=1.1.0-r5 libclang-cpp-16=16.0.6-r10 libcom_err=1.47.2-r22 libcrypt1=2.41-r53 libcrypto3=3.5.1-r0 libcurl-openssl4=8.14.1-r2 libexpat1=2.7.1-r1 libffi=3.5.1-r0 libgcc=15.1.0-r1 libgfortran-14=14.3.0-r2 libgfortran=15.1.0-r1 libidn2=2.3.8-r2 libldap=2.6.10-r3 libnghttp2-14=1.66.0-r0 libpcre2-8-0=10.45-r2 libpsl=0.21.5-r5 libquadmath=15.1.0-r1 libssl3=3.5.1-r0 libstdc++-14-dev=14.3.0-r2 libstdc++-14=14.3.0-r2 libstdc++=15.1.0-r1 libunistring=1.3-r3 libverto=0.3.2-r5 libxcrypt-dev=4.4.38-r2 libxcrypt=4.4.38-r2 libxml2=2.14.4-r0 libzstd1=1.5.7-r2 linux-headers=6.15.5-r0 lld-16=16.0.6-r10 llvm-16=16.0.6-r10 make=4.4.1-r7 mpc=1.3.1-r6 mpfr=4.2.2-r1 ncurses-terminfo-base=6.5_p20250621-r0 ncurses=6.5_p20250621-r0 nss-db=2.41-r53 nss-hesiod=2.41-r53 oniguruma=6.9.10-r1 openssf-compiler-options=20240627-r25 pkgconf=2.5.1-r0 posix-cc-wrappers=1-r6 readline=8.3-r0 scanelf=1.3.8-r4 sed=4.9-r5 sqlite-libs=3.50.2-r0 wolfi-baselayout=20230201-r22 xz=5.8.1-r1 zlib=1.3.1-r50]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
auth configured for: []
installing wolfi-baselayout (20230201-r22)
installing ca-certificates-bundle (20241121-r42)
installing glibc-locale-posix (2.41-r53)
installing libgcc (15.1.0-r1)
installing glibc (2.41-r53)
installing ld-linux (2.41-r53)
installing ncurses-terminfo-base (6.5_p20250621-r0)
installing ncurses (6.5_p20250621-r0)
installing bash (5.3-r0)
installing libstdc++ (15.1.0-r1)
installing libzstd1 (1.5.7-r2)
installing binutils (2.44-r9)
installing libxcrypt (4.4.38-r2)
installing libxcrypt-dev (4.4.38-r2)
installing nss-db (2.41-r53)
installing nss-hesiod (2.41-r53)
installing linux-headers (6.15.5-r0)
installing glibc-dev (2.41-r53)
installing posix-cc-wrappers (1-r6)
installing gmp (6.3.0-r7)
installing isl (0.27-r3)
installing mpfr (4.2.2-r1)
installing mpc (1.3.1-r6)
installing zlib (1.3.1-r50)
installing libquadmath (15.1.0-r1)
installing libstdc++-14 (14.3.0-r2)
installing libstdc++-14-dev (14.3.0-r2)
installing openssf-compiler-options (20240627-r25)
installing gcc-14 (14.3.0-r2)
installing libgfortran-14 (14.3.0-r2)
installing gfortran-14 (14.3.0-r2)
installing libgfortran (15.1.0-r1)
installing gcc-14-default (14.3.0-r2)
installing make (4.4.1-r7)
installing pkgconf (2.5.1-r0)
installing build-base (1-r8)
installing libcrypt1 (2.41-r53)
installing busybox (1.37.0-r46)
installing libffi (3.5.1-r0)
installing xz (5.8.1-r1)
installing libxml2 (2.14.4-r0)
installing libLLVM-16 (16.0.6-r10)
installing libclang-cpp-16 (16.0.6-r10)
installing llvm-16 (16.0.6-r10)
installing clang-16 (16.0.6-r10)
installing libacl1 (2.3.2-r50)
installing libattr1 (2.5.2-r50)
installing libcrypto3 (3.5.1-r0)
installing coreutils (9.7-r1)
installing ct-manylinux-2.28 (1.27.0-r0)
installing libbrotlicommon1 (1.1.0-r5)
installing libbrotlidec1 (1.1.0-r5)
installing libcom_err (1.47.2-r22)
installing keyutils-libs (1.6.3-r35)
installing libssl3 (3.5.1-r0)
installing libverto (0.3.2-r5)
installing krb5-conf (1.0-r6)
installing krb5-libs (1.21.3-r42)
installing gdbm (1.25-r2)
installing readline (8.3-r0)
installing sqlite-libs (3.50.2-r0)
installing heimdal-libs (7.8.0-r41)
installing cyrus-sasl (2.1.28-r42)
installing libldap (2.6.10-r3)
installing libnghttp2-14 (1.66.0-r0)
installing libunistring (1.3-r3)
installing libidn2 (2.3.8-r2)
installing libpsl (0.21.5-r5)
installing libcurl-openssl4 (8.14.1-r2)
installing curl (8.14.1-r2)
installing findutils (4.10.0-r2)
installing libexpat1 (2.7.1-r1)
installing libpcre2-8-0 (10.45-r2)
installing git (2.50.1-r0)
installing gnutar (1.35-r4)
installing go-1.24 (1.24.5-r0)
installing gobump (0.9.1-r0)
installing grep (3.12-r2)
installing oniguruma (6.9.10-r1)
installing jq (1.8.1-r0)
installing lld-16 (16.0.6-r10)
installing scanelf (1.3.8-r4)
installing sed (4.9-r5)
running step "git-checkout"
[git checkout] repo='https://github.com/fluxcd/source-controller' dest='.' depth='unset' branch='' tag='v1.6.2' expcommit='254ef2ec92b4855d2a09bf61a1a6e8b1ac34d4a5' recurse='false'
[git checkout] execute: git config --global --add safe.directory /tmp/tmp.3g1mKw3pzf
[git checkout] execute: git config --global --add safe.directory /home/build
[git checkout] execute: git clone --quiet --origin=origin --config=user.name=Melange Build [email protected] --config=advice.detachedHead=false --branch=v1.6.2 --depth=1 https://github.com/fluxcd/source-controller /tmp/tmp.3g1mKw3pzf
warning: refs/tags/v1.6.2 cbd65fa7792abfc882c7267908dad9a793b65b7a is not a commit!
[git checkout] execute: cd /tmp/tmp.3g1mKw3pzf
[git checkout] tar -c . | tar -C "/home/build" -x
[git checkout] execute: cd /home/build
[git checkout] execute: git config --global --add safe.directory /home/build
[git checkout] execute: git fetch --quiet origin --depth=1 --no-tags +refs/tags/v1.6.2:refs/origin/tags/v1.6.2
[git checkout] execute: git checkout --quiet origin/tags/v1.6.2
[git checkout] tag v1.6.2 is 254ef2ec92b4855d2a09bf61a1a6e8b1ac34d4a5
running step "go/bump"
2025/07/10 08:39:52 Local Go version: 1.24.5
2025/07/10 08:39:52 Running go mod tidy with go version '1.24.5' ...
2025/07/10 08:39:59 Update package: github.com/go-viper/mapstructure/v2
2025/07/10 08:39:59 Running go mod edit -droprequire ...
2025/07/10 08:39:59 Running go get ...
2025/07/10 08:40:00 Update package: helm.sh/helm/v3
2025/07/10 08:40:00 Running go mod edit -droprequire ...
2025/07/10 08:40:00 Running go get ...
2025/07/10 08:40:00 Running go mod tidy with go version '1.24.5' ...
running step "strip"
running pipeline for subpackage flux-source-controller-bitnami-compat
running pipeline for subpackage flux-source-controller-iamguarded-compat
running step "iamguarded/build-compat"
running step "auth/github"
Using OctoSTS to get a token for chainguard-dev/iamguarded-tools as elastic-build
curl: (22) The requested URL returned error: 403

Indexes

https://apk.cgr.dev/chainguard-2.28-presubmit/4f40198b061c61e0df0ff31c0abf9c5457fec52a

❌ Failed Packages

  • ❌ flux-source-controller (error | 1m40s)

Packages

More Observability

Command

cg build log \
  --build-id 6f787aae-7c7f-4bba-9848-aa9f5147237e \
  --project prod-eco-8de7 \
  --cluster elastic-pre \
  --namespace pre-eco-2-28 \
  --start 2025-07-10T08:36:10Z \
  --end 2025-07-10T08:50:45Z
View more details on Chainguard Internal