Skip to content

flux-source-controller/1.6.2-r1: cve remediation#58640

Merged
efbar merged 3 commits into
mainfrom
cve-flux-source-controller-1.6.2-r1-b7517d0700e5b80ef9402e26ed0418df
Jul 10, 2025
Merged

flux-source-controller/1.6.2-r1: cve remediation#58640
efbar merged 3 commits into
mainfrom
cve-flux-source-controller-1.6.2-r1-b7517d0700e5b80ef9402e26ed0418df

Merge branch 'main' into cve-flux-source-controller-1.6.2-r1-b7517d07…

00af230
Select commit
Loading
Failed to load commit list.
Chainguard Internal / elastic-build succeeded Jul 10, 2025 in 11m 17s

APKs built successfully

Build ID: 35128232-1b3d-4c86-a8f0-cbc1b27d15ba

Details

x86_64 Logs

Click to expand
en is cached. (default 1h0m0s)
      --token-cache-max-size int                  The maximum size of the cache in number of tokens. (default 100)
      --watch-all-namespaces                      Watch for resources in all namespaces, if set to false it will only watch the runtime namespace. (default true)
      --watch-label-selector string               Watch for resources with matching labels e.g. 'sharding.fluxcd.io/shard=shard1'.
pflag: help requested
running step "test/kwok/cluster"
Cluster is creating cluster=kwok
Cluster is created elapsed=0.5s cluster=kwok
Cluster is starting cluster=kwok
Cluster is started elapsed=0.8s cluster=kwok
You can now use your cluster with:

	kubectl cluster-info --context kwok-kwok

Thanks for using kwok!
No resource found, use default resource resource=node cluster=kwok
Load resources counter=1 elapsed=4ms resource=nodes replicas=1 name=node cluster=kwok
Attempt 1: /healthz not ready, retrying...
Attempt 2: /healthz not ready, retrying...
/healthz is ready
/readyz is ready
/openapi/v2 is ready
node/node-000000 condition met
Kubernetes control plane is running at https://127.0.0.1:32764

To further debug and diagnose cluster problems, use 'kubectl cluster-info dump'.
running step "start flux-source-controller and test"
running step "start daemon on localhost"
running setup from /tmp/tmp.yeJg21/setup
customresourcedefinition.apiextensions.k8s.io/buckets.source.toolkit.fluxcd.io created
customresourcedefinition.apiextensions.k8s.io/gitrepositories.source.toolkit.fluxcd.io created
customresourcedefinition.apiextensions.k8s.io/helmcharts.source.toolkit.fluxcd.io created
customresourcedefinition.apiextensions.k8s.io/helmrepositories.source.toolkit.fluxcd.io created
customresourcedefinition.apiextensions.k8s.io/ocirepositories.source.toolkit.fluxcd.io created
node/node-000000 condition met
daemon started as pid 1358 with: source-controller --storage-adv-addr=source-controller.default.svc.cluster.local --storage-path=/ --health-addr :9441 --metrics-addr :8081
looking for 5 lines in output within 30 seconds
found within 2 seconds: starting file server
found within 2 seconds: starting manager
found within 2 seconds: source.toolkit.fluxcd.io
found within 2 seconds: Starting Controller
found within 2 seconds: Starting workers
running post from /tmp/tmp.yeJg21/post
# HELP rest_client_requests_total Number of HTTP requests, partitioned by status code, method, and host.
# TYPE rest_client_requests_total counter
rest_client_requests_total{code="200",host="127.0.0.1:32764",method="GET"} 12
< HTTP/1.1 200 OK

-- begin output --
> {"level":"info","ts":"2025-07-10T08:47:16.992Z","logger":"setup","msg":"caching of Helm index files is disabled"}
> {"level":"info","ts":"2025-07-10T08:47:16.993Z","logger":"setup","msg":"starting manager"}
> {"level":"info","ts":"2025-07-10T08:47:16.993Z","logger":"controller-runtime.metrics","msg":"Starting metrics server"}
> {"level":"info","ts":"2025-07-10T08:47:16.993Z","logger":"controller-runtime.metrics","msg":"Serving metrics server","bindAddress":":8081","secure":false}
> {"level":"info","ts":"2025-07-10T08:47:16.993Z","msg":"starting server","name":"health probe","addr":"[::]:9441"}
> {"level":"info","ts":"2025-07-10T08:47:17.094Z","msg":"Starting EventSource","controller":"gitrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"GitRepository","source":"kind source: *v1.GitRepository"}
> {"level":"info","ts":"2025-07-10T08:47:17.094Z","msg":"Starting EventSource","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","source":"kind source: *v1.Bucket"}
> {"level":"info","ts":"2025-07-10T08:47:17.094Z","msg":"Starting EventSource","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","source":"kind source: *v1.HelmChart"}
> {"level":"info","ts":"2025-07-10T08:47:17.094Z","msg":"Starting EventSource","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","source":"kind source: *v1.HelmRepository"}
> {"level":"info","ts":"2025-07-10T08:47:17.094Z","msg":"Starting EventSource","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","source":"kind source: *v1.GitRepository"}
> {"level":"info","ts":"2025-07-10T08:47:17.094Z","msg":"Starting EventSource","controller":"helmrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmRepository","source":"kind source: *v1.HelmRepository"}
> {"level":"info","ts":"2025-07-10T08:47:17.095Z","msg":"Starting EventSource","controller":"ocirepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"OCIRepository","source":"kind source: *v1.OCIRepository"}
> {"level":"info","ts":"2025-07-10T08:47:17.095Z","msg":"Starting EventSource","controller":"bucket","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"Bucket","source":"kind source: *v1.Bucket"}
> {"level":"info","ts":"2025-07-10T08:47:17.095Z","logger":"setup","msg":"starting file server"}
> {"level":"info","ts":"2025-07-10T08:47:17.194Z","msg":"Starting Controller","controller":"gitrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"GitRepository"}
> {"level":"info","ts":"2025-07-10T08:47:17.194Z","msg":"Starting workers","controller":"gitrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"GitRepository","worker count":2}
> {"level":"info","ts":"2025-07-10T08:47:17.195Z","msg":"Starting Controller","controller":"bucket","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"Bucket"}
> {"level":"info","ts":"2025-07-10T08:47:17.195Z","msg":"Starting workers","controller":"bucket","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"Bucket","worker count":2}
> {"level":"info","ts":"2025-07-10T08:47:17.196Z","msg":"Starting Controller","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart"}
> {"level":"info","ts":"2025-07-10T08:47:17.196Z","msg":"Starting workers","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","worker count":2}
> {"level":"info","ts":"2025-07-10T08:47:17.196Z","msg":"Starting Controller","controller":"helmrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmRepository"}
> {"level":"info","ts":"2025-07-10T08:47:17.196Z","msg":"Starting workers","controller":"helmrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmRepository","worker count":2}
> {"level":"info","ts":"2025-07-10T08:47:17.197Z","msg":"Starting Controller","controller":"ocirepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"OCIRepository"}
> {"level":"info","ts":"2025-07-10T08:47:17.197Z","msg":"Starting workers","controller":"ocirepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"OCIRepository","worker count":2}
-- end   output --
found 5 of expected 5 lines in output.
found 0 / 9 error strings in output.
twk: SIGTERM sent to pid 1358. kill returned 0.
twk: pid 1358 exited within 2 seconds after SIGTERM
qemu: sending shutdown signal
running test pipeline for subpackage flux-source-controller-bitnami-compat
image configuration:
  contents:
    build repositories: []
    runtime repositories: []
    keyring:      []
    packages:     [flux-source-controller flux-source-controller-bitnami-compat]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r22)
installing ca-certificates-bundle (20241121-r42)
installing ld-linux (2.41-r53)
installing libgcc (15.1.0-r1)
installing glibc-locale-posix (2.41-r53)
installing glibc (2.41-r53)
installing script (2.41.1-r1)
installing flux-source-controller (1.6.2-r2)
installing flux-source-controller-bitnami-compat (1.6.2-r2)
installing wolfi-keys (1-r11)
installing zlib (1.3.1-r50)
installing libcrypto3 (3.5.1-r0)
installing libssl3 (3.5.1-r0)
installing apk-tools (2.14.10-r5)
installing libxcrypt (4.4.38-r2)
installing libcrypt1 (2.41-r53)
installing busybox (1.37.0-r46)
installing wolfi-base (1-r7)
qemu: generating ssh key pairs for ephemeral VM
qemu: starting VM
qemu: waiting for SSH
qemu: meta-data=/dev/vda               isize=512    agcount=8, agsize=1638400 blks
qemu:          =                       sectsz=4096  attr=2, projid32bit=1
qemu:          =                       crc=1        finobt=1, sparse=1, rmapbt=1
qemu:          =                       reflink=1    bigtime=1 inobtcount=1 nrext64=1
qemu:          =                       exchange=0   metadir=0
qemu: data     =                       bsize=4096   blocks=13107200, imaxpct=25
qemu:          =                       sunit=0      swidth=0 blks
qemu: naming   =version 2              bsize=4096   ascii-ci=0, ftype=1, parent=0
qemu: log      =internal log           bsize=4096   blocks=16384, version=2
qemu:          =                       sectsz=4096  sunit=1 blks, lazy-count=1
qemu: realtime =none                   extsz=4096   blocks=0, rtextents=0
qemu:          =                       rgcount=0    rgsize=0 extents
qemu:          =                       zoned=0      start=0 reserved=0
qemu: Discarding blocks...Done.
qemu: ssh-keygen: generating new host keys: RSA ECDSA ED25519 
qemu: Server listening on 0.0.0.0 port 2223.
qemu: Server listening on 0.0.0.0 port 22.
qemu: VM started successfully, SSH server is up
qemu: Connection closed by 10.0.2.2 port 47456
qemu: Accepted publickey for root from 10.0.2.2 port 47470 ssh2: ECDSA SHA256:D9m0G3PQ+VQsFUMGtt6kSer894sc13mcMkWD4jbKsaw
qemu: Connection closed by 10.0.2.2 port 47470
qemu: Accepted publickey for root from 10.0.2.2 port 47478 ssh2: ECDSA SHA256:D9m0G3PQ+VQsFUMGtt6kSer894sc13mcMkWD4jbKsaw
qemu: Accepted publickey for root from 10.0.2.2 port 57058 ssh2: ECDSA SHA256:D9m0G3PQ+VQsFUMGtt6kSer894sc13mcMkWD4jbKsaw
qemu: setting up local workspace
Usage of /opt/bitnami/flux/bin/source-controller:
qemu: sending shutdown signal
running test pipeline for subpackage flux-source-controller-iamguarded-compat

aarch64 Logs

Click to expand
hing of Helm index files is disabled"}
> {"level":"info","ts":"2025-07-10T08:47:03.640Z","logger":"setup","msg":"starting manager"}
> {"level":"info","ts":"2025-07-10T08:47:03.640Z","logger":"controller-runtime.metrics","msg":"Starting metrics server"}
> {"level":"info","ts":"2025-07-10T08:47:03.640Z","logger":"controller-runtime.metrics","msg":"Serving metrics server","bindAddress":":8081","secure":false}
> {"level":"info","ts":"2025-07-10T08:47:03.640Z","msg":"starting server","name":"health probe","addr":"[::]:9441"}
> {"level":"info","ts":"2025-07-10T08:47:03.745Z","msg":"Starting EventSource","controller":"gitrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"GitRepository","source":"kind source: *v1.GitRepository"}
> {"level":"info","ts":"2025-07-10T08:47:03.747Z","logger":"setup","msg":"starting file server"}
> {"level":"info","ts":"2025-07-10T08:47:03.747Z","msg":"Starting EventSource","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","source":"kind source: *v1.Bucket"}
> {"level":"info","ts":"2025-07-10T08:47:03.747Z","msg":"Starting EventSource","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","source":"kind source: *v1.HelmChart"}
> {"level":"info","ts":"2025-07-10T08:47:03.747Z","msg":"Starting EventSource","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","source":"kind source: *v1.HelmRepository"}
> {"level":"info","ts":"2025-07-10T08:47:03.747Z","msg":"Starting EventSource","controller":"bucket","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"Bucket","source":"kind source: *v1.Bucket"}
> {"level":"info","ts":"2025-07-10T08:47:03.747Z","msg":"Starting EventSource","controller":"helmrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmRepository","source":"kind source: *v1.HelmRepository"}
> {"level":"info","ts":"2025-07-10T08:47:03.747Z","msg":"Starting EventSource","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","source":"kind source: *v1.GitRepository"}
> {"level":"info","ts":"2025-07-10T08:47:03.747Z","msg":"Starting EventSource","controller":"ocirepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"OCIRepository","source":"kind source: *v1.OCIRepository"}
> {"level":"info","ts":"2025-07-10T08:47:03.962Z","msg":"Starting Controller","controller":"gitrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"GitRepository"}
> {"level":"info","ts":"2025-07-10T08:47:03.962Z","msg":"Starting workers","controller":"gitrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"GitRepository","worker count":2}
> {"level":"info","ts":"2025-07-10T08:47:03.964Z","msg":"Starting Controller","controller":"ocirepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"OCIRepository"}
> {"level":"info","ts":"2025-07-10T08:47:03.964Z","msg":"Starting workers","controller":"ocirepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"OCIRepository","worker count":2}
> {"level":"info","ts":"2025-07-10T08:47:03.964Z","msg":"Starting Controller","controller":"bucket","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"Bucket"}
> {"level":"info","ts":"2025-07-10T08:47:03.964Z","msg":"Starting workers","controller":"bucket","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"Bucket","worker count":2}
> {"level":"info","ts":"2025-07-10T08:47:03.964Z","msg":"Starting Controller","controller":"helmrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmRepository"}
> {"level":"info","ts":"2025-07-10T08:47:03.964Z","msg":"Starting workers","controller":"helmrepository","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmRepository","worker count":2}
> {"level":"info","ts":"2025-07-10T08:47:03.966Z","msg":"Starting Controller","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart"}
> {"level":"info","ts":"2025-07-10T08:47:03.966Z","msg":"Starting workers","controller":"helmchart","controllerGroup":"source.toolkit.fluxcd.io","controllerKind":"HelmChart","worker count":2}
-- end   output --
found 5 of expected 5 lines in output.
found 0 / 9 error strings in output.
twk: SIGTERM sent to pid 289. kill returned 0.
twk: pid 289 exited within 2 seconds after SIGTERM
pod b848cf296d1fc4f556d2e766ecd722a8e32d942feb711d59fc0a22561855d7f6 terminated
running test pipeline for subpackage flux-source-controller-bitnami-compat
image configuration:
  contents:
    build repositories: []
    runtime repositories: []
    keyring:      []
    packages:     [flux-source-controller flux-source-controller-bitnami-compat]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r22)
installing ca-certificates-bundle (20241121-r42)
installing flux-source-controller (1.6.2-r2)
installing flux-source-controller-bitnami-compat (1.6.2-r2)
installing wolfi-keys (1-r11)
installing libgcc (15.1.0-r1)
installing ld-linux (2.41-r53)
installing glibc-locale-posix (2.41-r53)
installing glibc (2.41-r53)
installing zlib (1.3.1-r50)
installing libcrypto3 (3.5.1-r0)
installing libssl3 (3.5.1-r0)
installing apk-tools (2.14.10-r5)
installing libxcrypt (4.4.38-r2)
installing libcrypt1 (2.41-r53)
installing busybox (1.37.0-r46)
installing wolfi-base (1-r7)
layer digest: sha256:47fa41a4526cb4b66b6a36eaf181aa198654bacacae9bbf09ff527ca693306f5
layer diffID: sha256:38d6625d9ba2601676c85b9033c1ef1fc30db47e7f507bf65bd6c8d87c4f1b6a
saving OCI image locally: apko.local/cache:4fa8b96f63fb27fe87fe810c0f4a8563f395f45f87295b3b11235cb844b0fdde
Usage of /opt/bitnami/flux/bin/source-controller:
pod 6544b0e41c5e9b86c980d245ae870671168fc7f19371b5eec2407a7a116345e4 terminated
running test pipeline for subpackage flux-source-controller-iamguarded-compat
image configuration:
  contents:
    build repositories: []
    runtime repositories: []
    keyring:      []
    packages:     [bash busybox coreutils curl findutils flux-source-controller-iamguarded-compat git gnutar grep jq sed]
  accounts:
    runas:  
    users:
      - uid=1000(build) gid=1000
    groups:
      - gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r22)
installing ca-certificates-bundle (20241121-r42)
installing ncurses-terminfo-base (6.5_p20250621-r0)
installing libgcc (15.1.0-r1)
installing ld-linux (2.41-r53)
installing glibc-locale-posix (2.41-r53)
installing glibc (2.41-r53)
installing ncurses (6.5_p20250621-r0)
installing bash (5.3-r0)
installing libxcrypt (4.4.38-r2)
installing libcrypt1 (2.41-r53)
installing busybox (1.37.0-r46)
installing libattr1 (2.5.2-r50)
installing libacl1 (2.3.2-r50)
installing libcrypto3 (3.5.1-r0)
installing coreutils (9.7-r1)
installing libunistring (1.3-r3)
installing libidn2 (2.3.8-r2)
installing libpsl (0.21.5-r5)
installing libbrotlicommon1 (1.1.0-r5)
installing libbrotlidec1 (1.1.0-r5)
installing libverto (0.3.2-r5)
installing krb5-conf (1.0-r6)
installing libcom_err (1.47.2-r22)
installing keyutils-libs (1.6.3-r35)
installing libssl3 (3.5.1-r0)
installing krb5-libs (1.21.3-r42)
installing zlib (1.3.1-r50)
installing readline (8.3-r0)
installing sqlite-libs (3.50.2-r0)
installing heimdal-libs (7.8.0-r41)
installing gdbm (1.25-r2)
installing cyrus-sasl (2.1.28-r42)
installing libldap (2.6.10-r3)
installing libnghttp2-14 (1.66.0-r0)
installing libcurl-openssl4 (8.14.1-r2)
installing curl (8.14.1-r2)
installing findutils (4.10.0-r2)
installing flux-source-controller-iamguarded-compat (1.6.2-r2)
installing libpcre2-8-0 (10.45-r2)
installing libexpat1 (2.7.1-r1)
installing git (2.50.1-r0)
installing gnutar (1.35-r4)
installing grep (3.12-r2)
installing oniguruma (6.9.10-r1)
installing jq (1.8.1-r0)
installing sed (4.9-r5)
installing wolfi-keys (1-r11)
installing apk-tools (2.14.10-r5)
installing wolfi-base (1-r7)
layer digest: sha256:a37a3e9d8878b6f7bd9d0c769b90523ff637220cf0a3d49a81cbe6056ca68fee
layer diffID: sha256:e9817b3f5c093a3279e88685d4ad4e45e0038e4f86436ab6b1bcf3f62aeceb0f
saving OCI image locally: apko.local/cache:8bb6030489e278f26d0172aef432578a67830c7393eea657bcea385413b84e5c
  File: /opt/iamguarded/flux/bin/source-controller -> /usr/bin/source-controller
  Size: 26        	Blocks: 0          IO Block: 4096   symbolic link
Device: 0,177	Inode: 4048656     Links: 1
Access: (0777/lrwxrwxrwx)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2025-07-10 08:30:07.000000000 +0000
Modify: 2025-07-10 08:30:07.000000000 +0000
Change: 2025-07-10 08:47:13.905277165 +0000
 Birth: 2025-07-10 08:47:13.905277165 +0000
running step "iamguarded/test-compat"
running step "auth/github"
Using OctoSTS to get a token for chainguard-dev/iamguarded-tools as elastic-build
running step "git-checkout"
[git checkout] repo='https://github.com/chainguard-dev/iamguarded-tools' dest='./.iamguarded-tools' depth='unset' branch='main' tag='' expcommit='' recurse='false'
[git checkout] Warning: no expected-commit
[git checkout] execute: git config --global --add safe.directory /tmp/tmp.wLPsjkmCdU
[git checkout] execute: git config --global --add safe.directory /home/build/.iamguarded-tools
[git checkout] execute: git clone --quiet --origin=origin --config=user.name=Melange Build --config=user.email=melange-build@cgr.dev --config=advice.detachedHead=false --branch=main --depth=1 https://github.com/chainguard-dev/iamguarded-tools /tmp/tmp.wLPsjkmCdU
[git checkout] execute: cd /tmp/tmp.wLPsjkmCdU
[git checkout] tar -c . | tar -C "/home/build/.iamguarded-tools" -x
[git checkout] execute: cd /home/build/.iamguarded-tools
[git checkout] execute: git config --global --add safe.directory /home/build/.iamguarded-tools
[git checkout] tip of main is commit ff1e9d2a2fa3242bc2ddeaf767d46945e9e80f68
[git checkout] Setting commit date to Jan 1, 1980 (SOURCE_DATE_EPOCH found )
INFO: test iamguarded words: passed (no unexpected issues)
pod c3845350df8ff541db3850bf7bcbbf5f2f0713b880956e1333e2abc9fd2f8bb3 terminated
command "melange" completed successfully
tests completed successfully

Indexes

https://apk.cgr.dev/wolfi-presubmit/4f40198b061c61e0df0ff31c0abf9c5457fec52a

Packages

Tests

More Observability

Command

cg build log \
  --build-id 35128232-1b3d-4c86-a8f0-cbc1b27d15ba \
  --project prod-wolfi-os \
  --cluster elastic-pre-a \
  --namespace pre-wolfi \
  --start 2025-07-10T08:36:17Z \
  --end 2025-07-10T08:57:35Z