Skip to content

airflow-3/3.0.6-r1: cve remediation #64989

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
octo-sts wants to merge 1 commit into from

airflow-3/3.0.6-r1: fix GHSA-pph8-gcv7-4qj5

550dd8e
Select commit
Loading
Failed to load commit list.
Closed

airflow-3/3.0.6-r1: cve remediation #64989

airflow-3/3.0.6-r1: fix GHSA-pph8-gcv7-4qj5
550dd8e
Select commit
Loading
Failed to load commit list.
Chainguard Internal Staging / elastic-build (STAGING) completed Sep 2, 2025 in 4m 0s

Failed to build APKs

Build ID: 51e839cf-a4ad-451c-ac70-fbeb30831ebc
Error: failed to build airflow-3: building group: pod failed: build failed
did not test because building group: pod failed: build failed

Details

airflow-3 (x86_64)

The primary issue is an authentication failure with chainctl due to a missing federated identity, which likely prevents the melange build process from proceeding correctly.

❌ Other error
Command:
chainctl auth token
Diagnostic:
rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 117407589438042601705)
Log Snippets:
This is the core error message indicating that a federated identity required for authentication was not found. 
Error: rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 117407589438042601705)

This line confirms that the `chainctl auth token` command failed, which is a direct consequence of the missing identity and indicates an authentication problem. 
Error running `chainctl auth token`: exit status 1

This shows the `melange` build command that was being executed when the authentication error occurred, indicating that `melange` relies on `chainctl` for its operations. 
running command melange [build airflow-3.yaml --gcplog --source-dir airflow-3 --arch x86_64 --arch=x86_64 --env-file=build-x86_64.env --namespace=wolfi --pipeline-dir=./pipelines --out-dir=./packages/ --runner=qemu --repository-append=https://apk.cgr.dev/chainguard --repository-append=https://apk.chainreg.biz/wolfi-presubmit/d5ad738ae7a707761ee7daae01e3dc9830d29faa --repository-append=https://apk.chainreg.biz/wolfi-presubmit/d5ad738ae7a707761ee7daae01e3dc9830d29faa --git-repo-url=https://github.com/wolfi-dev/os]

airflow-3 (aarch64)

The build failed due to an authentication error with chainctl, specifically a 'no identity found' error when trying to federate identity with Google Accounts. This is a critical issue that needs to be resolved for successful builds.

❌ Build error
Command:
chainctl auth token
Diagnostic:
rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 117407589438042601705)
Log Snippets:
This is the primary error message indicating a failure to find an identity for authentication with Google Accounts. 
Error: rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 117407589438042601705)

This line confirms that the `chainctl auth token` command failed, which is the direct cause of the authentication issue. 
Error running `chainctl auth token`: exit status 1

This is the main `melange build` command that was running when the authentication error occurred, indicating that the `chainctl` authentication is a prerequisite for this build process. 
running command melange [build airflow-3.yaml --gcplog --source-dir airflow-3 --arch aarch64 --arch=aarch64 --env-file=build-aarch64.env --namespace=wolfi --pipeline-dir=./pipelines --out-dir=./packages/ --runner=bubblewrap --repository-append=https://apk.cgr.dev/chainguard --repository-append=https://apk.chainreg.biz/wolfi-presubmit/d5ad738ae7a707761ee7daae01e3dc9830d29faa --repository-append=https://apk.chainreg.biz/wolfi-presubmit/d5ad738ae7a707761ee7daae01e3dc9830d29faa --git-repo-url=https://github.com/wolfi-dev/os]

Indexes

https://apk.chainreg.biz/wolfi-presubmit/d5ad738ae7a707761ee7daae01e3dc9830d29faa

❌ Failed Packages

  • ❌ airflow-3 (error | 1m2s)

Packages

More Observability

Command

cg build log \
  --build-id 51e839cf-a4ad-451c-ac70-fbeb30831ebc \
  --project staging-images-183e \
  --cluster elastic-pre-a \
  --namespace pre-wolfi \
  --start 2025-09-02T14:21:16Z \
  --end 2025-09-02T14:35:18Z
View more details on Chainguard Internal Staging