Skip to content

apache-pulsar/4.0.6-r1: cve remediation#65433

Closed
octo-sts[bot] wants to merge 1 commit into
mainfrom
cve-apache-pulsar-4.0.6-r1-0212986aba9ad78b0d871ac74ceed51c
Closed

apache-pulsar/4.0.6-r1: cve remediation#65433
octo-sts[bot] wants to merge 1 commit into
mainfrom
cve-apache-pulsar-4.0.6-r1-0212986aba9ad78b0d871ac74ceed51c

apache-pulsar/4.0.6-r1: fix GHSA-fghv-69vj-qj49

b7b2948
Select commit
Loading
Failed to load commit list.
Chainguard Internal Staging / elastic-build (STAGING) completed Sep 6, 2025 in 3m 13s

Failed to build APKs

Build ID: ba197aae-578f-4998-9372-04e9dad7cc43
Error: failed to build apache-pulsar: building group: pod failed: build failed
did not test because building group: pod failed: build failed

Details

apache-pulsar (x86_64)

The build failed due to an authentication error with chainctl, specifically a 'no identity found' error during federated identity resolution. This prevented the melange build command from completing successfully.

❌ Build error
Command:
melange build apache-pulsar.yaml
Diagnostic:
rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 117407589438042601705)
Log Snippets:
This is the primary error message indicating that the federated identity could not be found, which is the root cause of the authentication failure. 
Error: rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 117407589438042601705)

This line confirms that the `chainctl auth token` command failed, which is a direct consequence of the identity not being found. It indicates an issue with the authentication setup for `chainctl`. 
Error running `chainctl auth token`: exit status 1

This shows the `melange build` command that was being executed when the authentication error occurred, indicating that the build process was interrupted by this issue. 
running command melange [build apache-pulsar.yaml --gcplog --source-dir apache-pulsar --arch x86_64 --arch=x86_64 --env-file=build-x86_64.env --namespace=wolfi --pipeline-dir=./pipelines --out-dir=./packages/ --runner=qemu --repository-append=https://apk.cgr.dev/chainguard --repository-append=https://apk.chainreg.biz/wolfi-presubmit/7ec66fdbcfc9630aa00592f5ddc29f471d08142d --repository-append=https://apk.chainreg.biz/wolfi-presubmit/7ec66fdbcfc9630aa00592f5ddc29f471d08142d --git-repo-url=https://github.com/wolfi-dev/os]

apache-pulsar (aarch64)

The build failed due to an authentication error with chainctl, specifically a 'no identity found' error when attempting to federate identity with Google accounts. This prevented the melange build process from proceeding.

❌ Build error
Command:
chainctl auth token
Diagnostic:
rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 117407589438042601705)
Log Snippets:
This is the primary error message indicating the failure to find an identity for authentication. 
Error: rpc error: code = NotFound desc = federate identity: rpc error: code = NotFound desc = no identity found for (https://accounts.google.com, 117407589438042601705)

This line confirms that the `chainctl auth token` command failed, leading to the build failure. 
Error running `chainctl auth token`: exit status 1

This shows the main melange command that was being executed when the authentication error occurred, indicating that the authentication is a prerequisite for the build. 
running command melange [build apache-pulsar.yaml --gcplog --source-dir apache-pulsar --arch aarch64 --arch=aarch64 --env-file=build-aarch64.env --namespace=wolfi --pipeline-dir=./pipelines --out-dir=./packages/ --runner=bubblewrap --repository-append=https://apk.cgr.dev/chainguard --repository-append=https://apk.chainreg.biz/wolfi-presubmit/7ec66fdbcfc9630aa00592f5ddc29f471d08142d --repository-append=https://apk.chainreg.biz/wolfi-presubmit/7ec66fdbcfc9630aa00592f5ddc29f471d08142d --git-repo-url=https://github.com/wolfi-dev/os]

Indexes

https://apk.chainreg.biz/wolfi-presubmit/7ec66fdbcfc9630aa00592f5ddc29f471d08142d

❌ Failed Packages

  • ❌ apache-pulsar (error | 18s)

Packages

More Observability

Command

cg build log \
  --build-id ba197aae-578f-4998-9372-04e9dad7cc43 \
  --project staging-images-183e \
  --cluster elastic-pre-a \
  --namespace pre-wolfi \
  --start 2025-09-06T07:22:11Z \
  --end 2025-09-06T07:35:25Z
View more details on Chainguard Internal Staging