fix(buck2): Remediate GHSA-xwfj-jgwm-7wp5#64882
Merged
dnegreira merged 1 commit intoSep 2, 2025
Merged
Chainguard Internal / elastic-build (eco-2-28)
succeeded
Sep 2, 2025 in 7m 6s
APKs built successfully
Build ID: b985d3d8-e217-4156-9125-bafbbb30cd6c
Details
x86_64 Logs
Click to expand
000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/linux-raw-sys-0.4.15/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/linux-raw-sys-0.9.4/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/memchr-2.7.5/COPYING: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/os_str_bytes-6.6.1/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/quickcheck-1.0.3/COPYING: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand-0.8.5/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand_chacha-0.3.1/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand_core-0.6.4/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rand_distr-0.4.3/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/regex-automata-0.1.10/COPYING: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustix-0.38.44/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/rustix-1.0.8/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/same-file-1.0.6/COPYING: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/siphasher-0.3.11/COPYING: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/siphasher-1.0.1/COPYING: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/unicode-segmentation-1.12.0/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/unicode-width-0.1.14/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/unicode-xid-0.2.6/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/utf8_iter-1.0.4/COPYRIGHT: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/walkdir-2.5.0/COPYING: NOASSERTION (0.000000) (unknown)
.rustup/toolchains/nightly-2025-01-03-x86_64-unknown-linux-gnu/share/doc/rust/COPYRIGHT: NCSA (0.880000) (notice)
.rustup/toolchains/nightly-2025-01-03-x86_64-unknown-linux-gnu/share/doc/rust/COPYRIGHT: Unicode-DFS-2016 (0.812665) (notice)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/petgraph-0.6.5/assets/LICENSE.md: NOASSERTION (0.000000) (unknown)
.rustup/toolchains/nightly-2025-01-03-x86_64-unknown-linux-gnu/lib/rustlib/src/rust/src/llvm-project/libunwind/LICENSE.TXT: NCSA (0.880000) (notice)
starlark-rust/starlark_syntax/testcases/parse/license.star: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/deltae-0.3.2/docs/doc/COPYRIGHT.txt: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/bstr-0.2.17/src/unicode/data/LICENSE-UNICODE: Unicode-DFS-2016 (0.823219) (notice)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/constant_time_eq-0.2.6/LICENSE-MIT0: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/constant_time_eq-0.3.1/LICENSE-MIT0: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/sequence_trie-0.3.6/LICENSE-APACHE: NOASSERTION (0.000000) (unknown)
.cargo/registry/src/index.crates.io-1949cf8c6b5b557f/shlex-1.3.0/LICENSE-APACHE: NOASSERTION (0.000000) (unknown)
.rustup/toolchains/nightly-2025-01-03-x86_64-unknown-linux-gnu/share/doc/rust/html/static.files/COPYRIGHT-eb44e4cf.txt: NOASSERTION (0.000000) (unknown)
could not identify some licenses, please check the configuration
license information check complete
invalid license: NOASSERTION
writing SBOM for buck2
generating package buck2-20250401-r4
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
interpreter for buck2 => /lib64/ld-linux-x86-64.so.2
found lib libdl.so.2 for usr/bin/buck2
found lib libc.so.6 for usr/bin/buck2
found lib ld-linux-x86-64.so.2 for usr/bin/buck2
found lib libgcc_s.so.1 for usr/bin/buck2
found lib libpthread.so.0 for usr/bin/buck2
found lib libm.so.6 for usr/bin/buck2
scanning for commands...
found command usr/bin/buck2
scanning for -doc package...
scanning for pkg-config data...
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
runtime:
so:ld-linux-x86-64.so.2
so:libc.so.6
so:libdl.so.2
so:libgcc_s.so.1
so:libm.so.6
so:libpthread.so.0
provides:
cmd:buck2=20250401-r4
installed-size: 138698136
data.tar.gz digest: 166d8f27879642f2f2f300caacd86e13535d205c0528509673301a31b7317100
wrote packages/x86_64/buck2-20250401-r4.apk
cleaning Workspace by removing 62 file/directories in /home/build
generating apk index from packages in packages/x86_64
processing package packages/x86_64/buck2-20250401-r4.apk
updating index at packages/x86_64/APKINDEX.tar.gz with new packages: [buck2-20250401-r4]
command "melange" completed successfully
build completed successfully
creating packages tarball...
running command tar [-C packages -cf packages.tar .]
command "tar" completed successfully
packages.tar sha256sum: ac0ef46507b977391084f2b0f79d6d150163214db586620b4b677ced95ec6eea
sha256sum "ac0ef46507b977391084f2b0f79d6d150163214db586620b4b677ced95ec6eea" written to /dev/termination-log
Built 1 packages, hash: ac0ef46507b977391084f2b0f79d6d150163214db586620b4b677ced95ec6eea, size: 42054144 bytes
uploading final packages tarball...
running command curl [-s --upload-file packages.tar -H Content-Type: application/octet-stream https://storage.googleapis.com/prod-bundle-staging/eco-2-28/x86_64/1756804392730248736-buck2-20250401-r4.tar.gz?Expires=1756847592&GoogleAccessId=ebuild-456o8jve9m82pzkyd0rxyya%40prod-enforce-fabc.iam.gserviceaccount.com&Signature=Kcu6wEvz9r4E09GXAu7vIeZx1OXjF0OwcB8ghY8CyntbVjU9ZGVt6qt0NNJvZd3h%2BATGgVZWBWAf3q84KyoAK%2FEM1Th4ZtvBU9%2BAzFwtOkGyjG4%2BI%2BrqVefS%2F3DYnra4ENr3T2sphcPVGvUh3bP83AyqBsKZm0eQxbrNCP5h1pTsnCx%2FPAoHruG0x8zEwDoDigVTl3JBHfhlY8wcOKzUFlIWny0LmUJOPa0MC49OLPqsOnNrErlE7LQnvZHSlRh4DZ2XmodZDSupPFtIKM5%2F6oCfR%2Bvh5B4CzeKqcOeXX6DGXgppmvPXSaNaTCpsfU7ZJ7JmfpJQRcKx2gCGtLEYvA%3D%3D]
command "curl" completed successfully
upload completed successfully
parsed env
configuring puller identity "e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910"...
running command chainctl [auth login --audience apk.cgr.dev --identity e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910]
Successfully exchanged token.
Valid! Id: e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910
Updates are available for chainctl (current version: 0.2.133; latest: 0.2.134). To install, please run:
$ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running tests...
running command /usr/bin/dind [dockerd] in background
command "/usr/bin/dind" started successfully
running command bash [-c
# Retry up to 60 seconds to wait for docker to start.
worked=false
for i in $(seq 60); do
if docker info >/dev/null 2>&1; then
worked=true
break
fi
echo "docker healthcheck failed, docker is not ready, retrying... ($i/60 seconds so far)..."
sleep 1
done
if [ "$worked" = "false" ]; then
echo "Failed to start docker after 60 seconds"
exit 1
fi
]
command "bash" completed successfully
running command melange [test buck2.yaml --gcplog --source-dir buck2 --test-package-append wolfi-base --arch=x86_64 --env-file=build-x86_64.env --pipeline-dirs=./pipelines --runner=docker --repository-append=https://apk.cgr.dev/chainguard --repository-append=https://apk.cgr.dev/chainguard-private --repository-append=https://apk.cgr.dev/chainguard-2.28 --repository-append=https://apk.cgr.dev/chainguard-2.28-presubmit/1e81754cc4ff561de6d2ff98c58ca36707c37362 --test-package-append=ct-manylinux-2.28 --test-package-append=gcc-14-default --repository-append=https://apk.cgr.dev/chainguard-2.28-presubmit/1e81754cc4ff561de6d2ff98c58ca36707c37362]
melange v0.31.1+dirty with runner docker is testing:
image configuration:
contents:
build repositories: []
runtime repositories: []
repositories: []
keyring: []
packages: [buck2]
accounts:
runas:
users:
- uid=1000(build) gid=1000
groups:
- gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r23)
installing ca-certificates-bundle (20250619-r5)
installing glibc-locale-posix (2.42-r0)
installing glibc (2.42-r0)
installing ld-linux (2.42-r0)
installing libgcc (15.2.0-r1)
installing buck2 (20250401-r4)
installing ct-manylinux-2.28 (1.27.0-r2)
installing libstdc++ (15.2.0-r1)
installing gmp (6.3.0-r8)
installing mpfr (4.2.2-r2)
installing mpc (1.3.1-r7)
installing posix-cc-wrappers (1-r7)
installing zlib (1.3.1-r51)
installing isl (0.27-r4)
installing libzstd1 (1.5.7-r3)
installing libstdc++-14 (14.3.0-r8)
installing libstdc++-14-dev (14.3.0-r8)
installing libquadmath (15.2.0-r1)
installing binutils (2.45-r1)
installing openssf-compiler-options (20240627-r27)
installing libxcrypt (4.4.38-r4)
installing libxcrypt-dev (4.4.38-r4)
installing nss-db (2.42-r0)
installing nss-hesiod (2.42-r0)
installing linux-headers (6.16.4-r0)
installing glibc-dev (2.42-r0)
installing gcc-14 (14.3.0-r8)
installing libgfortran-14 (14.3.0-r8)
installing gfortran-14 (14.3.0-r8)
installing libgfortran (15.2.0-r1)
installing gcc-14-default (14.3.0-r8)
installing wolfi-keys (1-r12)
installing libcrypto3 (3.5.2-r1)
installing libssl3 (3.5.2-r1)
installing apk-tools (2.14.10-r8)
installing libcrypt1 (2.42-r0)
installing busybox (1.37.0-r49)
installing wolfi-base (1-r7)
layer digest: sha256:169bccd372838287e228cd4a409ccbcd2b96b9cca551a5e3d7d185c072bdb8e0
layer diffID: sha256:712ec0c943f745adfe7ab6fc227b86810e93b5e053f45a2c5f3c89f120e50791
saving OCI image locally: apko.local/cache:33f45710768d2f708fd36fb73e528ba5800e916efecce67e812de94ad74d2401
aarch64 Logs
Click to expand
icense: NOASSERTION
writing SBOM for buck2
generating package buck2-20250401-r4
scanning for ld.so.conf.d files...
scanning for shared object dependencies...
interpreter for buck2 => /lib/ld-linux-aarch64.so.1
found lib libc.so.6 for usr/bin/buck2
found lib ld-linux-aarch64.so.1 for usr/bin/buck2
found lib libgcc_s.so.1 for usr/bin/buck2
found lib librt.so.1 for usr/bin/buck2
found lib libpthread.so.0 for usr/bin/buck2
found lib libm.so.6 for usr/bin/buck2
found lib libdl.so.2 for usr/bin/buck2
scanning for commands...
found command usr/bin/buck2
scanning for -doc package...
scanning for pkg-config data...
scanning for python modules...
scanning for ruby gems...
scanning for shbang deps...
runtime:
so:ld-linux-aarch64.so.1
so:libc.so.6
so:libdl.so.2
so:libgcc_s.so.1
so:libm.so.6
so:libpthread.so.0
so:librt.so.1
provides:
cmd:buck2=20250401-r4
installed-size: 135074449
data.tar.gz digest: 7b1cb58637663d591cc2f8fa09de3f55b3e2391d5dbfcde17a37ca59fecd0d4f
wrote packages/aarch64/buck2-20250401-r4.apk
cleaning Workspace by removing 62 file/directories in /home/build
generating apk index from packages in packages/aarch64
processing package packages/aarch64/buck2-20250401-r4.apk
updating index at packages/aarch64/APKINDEX.tar.gz with new packages: [buck2-20250401-r4]
command "melange" completed successfully
build completed successfully
creating packages tarball...
running command tar [-C packages -cf packages.tar .]
command "tar" completed successfully
packages.tar sha256sum: eafe69dcb11a8391754f2115febfa5854bb2fbdfa88a400241f5b3d0de2c4640
sha256sum "eafe69dcb11a8391754f2115febfa5854bb2fbdfa88a400241f5b3d0de2c4640" written to /dev/termination-log
Built 1 packages, hash: eafe69dcb11a8391754f2115febfa5854bb2fbdfa88a400241f5b3d0de2c4640, size: 45696000 bytes
uploading final packages tarball...
running command curl [-s --upload-file packages.tar -H Content-Type: application/octet-stream https://storage.googleapis.com/prod-bundle-staging/eco-2-28/aarch64/1756804392730281097-buck2-20250401-r4.tar.gz?Expires=1756847592&GoogleAccessId=ebuild-456o8jve9m82pzkyd0rxyya%40prod-enforce-fabc.iam.gserviceaccount.com&Signature=G6JMEzauYb%2F8CnTcsG7wZgRIc%2F0BzJ92VtyeXS0QwEUCCnCLY0UW1LiW2glz8caeSG8i3NNaxOoefgbp9HhH2I%2Fga1kfd6B%2BrT9pFsqZ8dCiHmJ%2BWudLCtOKT6ecEejoElKxPk6W5LZUp2kehyPHICiSCYjkIvpb0u3QVaGGn%2BcUWxkxYcV06lThZtiSBz4fQ9tVfn40dCShKteXhMRitklG0YqTE8Zsakrq2kfh%2Fcb1zO%2Fv4QrL3NGV%2BxzawilZOI33SVAB3j5D9x97JyDevo%2BKg3pEeYmVHrLYbRPI%2BCTFXQSfqpAyml%2FOf54mMCwCGKrjFFhrpBVSlEjWZxgqGw%3D%3D]
command "curl" completed successfully
upload completed successfully
parsed env
configuring puller identity "e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910"...
running command chainctl [auth login --audience apk.cgr.dev --identity e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910]
Successfully exchanged token.
Valid! Id: e2fa069c57acc83f3f2748a8bed50e44dff064dc/dcb8fb2f15475910
Updates are available for chainctl (current version: 0.2.133; latest: 0.2.134). To install, please run:
$ chainctl update
command "chainctl" completed successfully
puller identity configured successfully
puller identity configured successfully
running tests...
running command /usr/bin/dind [dockerd] in background
command "/usr/bin/dind" started successfully
running command bash [-c
# Retry up to 60 seconds to wait for docker to start.
worked=false
for i in $(seq 60); do
if docker info >/dev/null 2>&1; then
worked=true
break
fi
echo "docker healthcheck failed, docker is not ready, retrying... ($i/60 seconds so far)..."
sleep 1
done
if [ "$worked" = "false" ]; then
echo "Failed to start docker after 60 seconds"
exit 1
fi
]
command "bash" completed successfully
running command melange [test buck2.yaml --gcplog --source-dir buck2 --test-package-append wolfi-base --arch=aarch64 --env-file=build-aarch64.env --pipeline-dirs=./pipelines --runner=docker --repository-append=https://apk.cgr.dev/chainguard --repository-append=https://apk.cgr.dev/chainguard-private --repository-append=https://apk.cgr.dev/chainguard-2.28 --repository-append=https://apk.cgr.dev/chainguard-2.28-presubmit/1e81754cc4ff561de6d2ff98c58ca36707c37362 --test-package-append=ct-manylinux-2.28 --test-package-append=gcc-14-default --repository-append=https://apk.cgr.dev/chainguard-2.28-presubmit/1e81754cc4ff561de6d2ff98c58ca36707c37362]
melange v0.31.1+dirty with runner docker is testing:
image configuration:
contents:
build repositories: []
runtime repositories: []
repositories: []
keyring: []
packages: [buck2]
accounts:
runas:
users:
- uid=1000(build) gid=1000
groups:
- gid=1000(build) members=[build]
installing wolfi-baselayout (20230201-r23)
installing ca-certificates-bundle (20250619-r5)
installing glibc-locale-posix (2.42-r0)
installing ld-linux (2.42-r0)
installing glibc (2.42-r0)
installing libgcc (15.2.0-r1)
installing buck2 (20250401-r4)
installing ct-manylinux-2.28 (1.27.0-r2)
installing libstdc++ (15.2.0-r1)
installing gmp (6.3.0-r8)
installing mpfr (4.2.2-r2)
installing mpc (1.3.1-r7)
installing posix-cc-wrappers (1-r7)
installing zlib (1.3.1-r51)
installing isl (0.27-r4)
installing libzstd1 (1.5.7-r3)
installing libstdc++-14 (14.3.0-r8)
installing libstdc++-14-dev (14.3.0-r8)
installing libquadmath (15.2.0-r1)
installing binutils (2.45-r1)
installing openssf-compiler-options (20240627-r27)
installing libxcrypt (4.4.38-r4)
installing libxcrypt-dev (4.4.38-r4)
installing nss-db (2.42-r0)
installing nss-hesiod (2.42-r0)
installing linux-headers (6.16.4-r0)
installing glibc-dev (2.42-r0)
installing gcc-14 (14.3.0-r8)
installing libgfortran-14 (14.3.0-r8)
installing gfortran-14 (14.3.0-r8)
installing libgfortran (15.2.0-r1)
installing gcc-14-default (14.3.0-r8)
installing wolfi-keys (1-r12)
installing libcrypto3 (3.5.2-r1)
installing libssl3 (3.5.2-r1)
installing apk-tools (2.14.10-r8)
installing libcrypt1 (2.42-r0)
installing busybox (1.37.0-r49)
installing wolfi-base (1-r7)
layer digest: sha256:06801284abf8d95ff576265aacdc471fb9d842261f166e79597d5710facfd427
layer diffID: sha256:9ac92ab8716c6c215ab9b7d3408a5247e3b92e2148777cc057c51c65e0fba336
saving OCI image locally: apko.local/cache:fd1c71620c59e758fd08553ae27958d4a3a3fa4f812366dd9cfb905e7bb31bfc
populating workspace /tmp/melange-workspace-4132164583 from buck2
running the main test pipeline
buck2 8c209d813426779f20346d7a2798f33df7d8447819127d7aba43370bd89aba08 <exe-hash>
A build system
Documentation: https://buck2.build/docs/
Usage: buck2 [OPTIONS] <COMMAND>
Commands:
audit Perform lower level queries
aquery Perform queries on the action graph (experimental)
build Build the specified targets
bxl Run BXL scripts
help-env Print help for environment variables used by buck2
test Build and test the specified targets
cquery Perform queries on the configured target graph
init Initialize a buck2 project
explain Generates web browser view that shows actions that ran in the last build mapped to the target graph
expand-external-cell Expand the contents of an external cell into the repo
install Build and install an application
kill Kill the buck daemon
killall Kill all buck2 processes on the machine
root Find buck cell, project or package root
query Alias for `uquery`
run Build and run the selected target
server Start, query, and control the http server
status Buckd status
starlark Run Starlark operations
targets Alias for `utargets`
utargets Show details about the specified targets
ctargets Resolve target patterns to configured targets
uquery Perform queries on the unconfigured target graph
completion Print completion configuration for shell
docs Print documentation of specified symbols
profile Run starlark profiler
clean Delete generated files and caches
log Commands for interacting with buck2 logs
lsp Start an LSP server for starlark files
subscribe Subscribe to updates from the Buck2 daemon
help Print this message or the help of the given subcommand(s)
Options:
-h, --help
Print help (see a summary with '-h')
-V, --version
Print version
Universal Options:
--isolation-dir <ISOLATION_DIR>
The name of the directory that Buck2 creates within buck-out for writing outputs and daemon information. If one is not provided, Buck2 creates a directory with the default name.
Instances of Buck2 share a daemon if and only if their isolation directory is identical. The isolation directory also influences the output paths provided by Buck2, and as a result using a non-default isolation dir will cause cache misses (and slower builds).
[env: BUCK_ISOLATION_DIR=]
[default: v2]
-v, --verbose <VERBOSITY>
How verbose buck should be while logging.
Values: 0 = Quiet, errors only; 1 = Show status. Default; 2 = more info about errors; 3 = more info about everything; 4 = more info about everything + stderr;
It can be combined with specific log items (stderr, full_failed_command, commands, actions, status, stats, success) to fine-tune the verbosity of the log. Example usage "-v=1,stderr"
[default: 1]
--oncall <ONCALL>
The oncall executing this command
--client-metadata <CLIENT_METADATA>
Metadata key-value pairs to inject into Buck2's logging. Client metadata must be of the form `key=value`, where `key` is a snake_case identifier, and will be sent to backend datasets
pod 6a2ce98b994ff78d533e65820bc603c77f4aace67fd5dfc95a44dc135b79dd17 terminated
command "melange" completed successfully
tests completed successfully
all tests passed
Indexes
https://apk.cgr.dev/chainguard-2.28-presubmit/1e81754cc4ff561de6d2ff98c58ca36707c37362
Packages
- ✅ buck2 (success | 3m46s | x86_64 logs | aarch64 logs)
Tests
- ✅ buck2 (success | 19s | x86_64 logs | aarch64 logs)
More Observability
Command
cg build log \
--build-id b985d3d8-e217-4156-9125-bafbbb30cd6c \
--project prod-eco-8de7 \
--cluster elastic-pre \
--namespace pre-eco-2-28 \
--start 2025-09-02T09:10:31Z \
--end 2025-09-02T09:27:38Z
Loading