Skip to content

Commit 209f006

Browse files
agrawalitiagrawaliti
committed
fix(cve): update base images and Go toolchain for CVE remediation
1 parent 71bf497 commit 209f006

16 files changed

Lines changed: 82 additions & 85 deletions

‎cli/Dockerfile‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.26.0-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:0a0df8a0d91137926313f5eaa77de14edb89254cef8ef4a07208e1119c6067ef AS builder
2+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:260a109ea287bda2ef2db8d8e95da817c33b8661bd04deeaf66d42b8c419952f AS builder
33

44
ARG VERSION
55
ARG APP_INSIGHTS_ID
@@ -25,11 +25,11 @@ RUN --mount=type=cache,target="/root/.cache/go-build" \
2525
# minimal libs stage — provides only the system libraries needed by the CGO-enabled binary,
2626
# without the bloat of the full Go SDK image (python, gcc, systemd, etc.)
2727
# skopeo inspect docker://mcr.microsoft.com/azurelinux/base/core:3.0 --format "{{.Name}}@{{.Digest}}"
28-
FROM mcr.microsoft.com/azurelinux/base/core@sha256:2a97a634da103fbfc21697f0136231f17ad18f7880a5be94488c5d2b15eb02d3 AS libs
28+
FROM mcr.microsoft.com/azurelinux/base/core@sha256:a452d39c91576f5a2c983c7d3b62521fabd08e16b4a7237e24bf2be3b06e1651 AS libs
2929

3030
# Target 1: Distroless (secure, minimal)
3131
# skopeo inspect docker://mcr.microsoft.com/azurelinux/distroless/minimal:3.0 --format "{{.Name}}@{{.Digest}}"
32-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:c9a1ed9515e033bca0c0b3171eccec41790bfcb9e47f05130cddc0a458de46ba AS distroless-target
32+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:22810fd97d6ad5ec7d5bdd5b00233a3050be01d9e26b47b16cb6f1a7f178834b AS distroless-target
3333
COPY --from=libs /lib/ /lib
3434
COPY --from=libs /usr/lib/ /usr/lib
3535
COPY --from=libs /etc/pki/tls/ /etc/pki/tls/
@@ -38,7 +38,7 @@ COPY --from=builder /workspace/kubectl-retina .
3838

3939
# Target 2: Shell-enabled (operational, init container support)
4040
# skopeo inspect docker://mcr.microsoft.com/azurelinux/base/core:3.0 --format "{{.Name}}@{{.Digest}}"
41-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/azurelinux/base/core@sha256:2a97a634da103fbfc21697f0136231f17ad18f7880a5be94488c5d2b15eb02d3 AS shell-target
41+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/azurelinux/base/core@sha256:a452d39c91576f5a2c983c7d3b62521fabd08e16b4a7237e24bf2be3b06e1651 AS shell-target
4242
WORKDIR /
4343
COPY --from=builder /workspace/kubectl-retina /bin/kubectl-retina
4444
RUN chmod +x /bin/kubectl-retina

‎controller/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,13 @@
11
# pinned base images
22

33
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.26.0-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
4-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:0a0df8a0d91137926313f5eaa77de14edb89254cef8ef4a07208e1119c6067ef AS golang
4+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:260a109ea287bda2ef2db8d8e95da817c33b8661bd04deeaf66d42b8c419952f AS golang
55

66
# skopeo inspect docker://mcr.microsoft.com/azurelinux/base/core:3.0 --format "{{.Name}}@{{.Digest}}"
7-
FROM mcr.microsoft.com/azurelinux/base/core@sha256:2a97a634da103fbfc21697f0136231f17ad18f7880a5be94488c5d2b15eb02d3 AS azurelinux-core
7+
FROM mcr.microsoft.com/azurelinux/base/core@sha256:a452d39c91576f5a2c983c7d3b62521fabd08e16b4a7237e24bf2be3b06e1651 AS azurelinux-core
88

99
# skopeo inspect docker://mcr.microsoft.com/azurelinux/distroless/minimal:3.0 --format "{{.Name}}@{{.Digest}}"
10-
FROM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:c9a1ed9515e033bca0c0b3171eccec41790bfcb9e47f05130cddc0a458de46ba AS azurelinux-distroless
10+
FROM mcr.microsoft.com/azurelinux/distroless/minimal@sha256:22810fd97d6ad5ec7d5bdd5b00233a3050be01d9e26b47b16cb6f1a7f178834b AS azurelinux-distroless
1111

1212
# build stages
1313

‎controller/Dockerfile.gogen‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.26.0-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:0a0df8a0d91137926313f5eaa77de14edb89254cef8ef4a07208e1119c6067ef
2+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:260a109ea287bda2ef2db8d8e95da817c33b8661bd04deeaf66d42b8c419952f
33

44
# Default linux/architecture.
55
ARG GOOS=linux

‎controller/Dockerfile.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.26.0-azurelinux3.0 --format "{{.Name}}@{{.Digest}}"
2-
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:0a0df8a0d91137926313f5eaa77de14edb89254cef8ef4a07208e1119c6067ef
2+
FROM --platform=$BUILDPLATFORM mcr.microsoft.com/oss/go/microsoft/golang@sha256:260a109ea287bda2ef2db8d8e95da817c33b8661bd04deeaf66d42b8c419952f
33

44
LABEL Name=retina-builder Version=0.0.1
55

‎controller/Dockerfile.windows-2022‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
# pinned base image
22
# skopeo inspect docker://mcr.microsoft.com/windows/servercore:ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}"
3-
FROM mcr.microsoft.com/windows/servercore@sha256:a264df8cd8c329eed3fd1e0cafcd4f3dc453e2c72a277f9bb140fd6f10a2eefc AS ltsc2022
3+
FROM mcr.microsoft.com/windows/servercore@sha256:d4c6d1a8a1a306b12691c3b2e5e3a8bfad786cbd6b7831cd74a9a6a99eab08ad AS ltsc2022
44

55
FROM ltsc2022 AS agent-win
66
ARG GOARCH=amd64 # default to amd64

‎controller/Dockerfile.windows-cgo‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.26.0-windowsservercore-ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}"
2-
FROM --platform=windows/amd64 mcr.microsoft.com/oss/go/microsoft/golang@sha256:179ddfa34eda50f58ea0011202f559585ade9668a298fe81ac01cebdc9bef15c AS cgo
2+
FROM --platform=windows/amd64 mcr.microsoft.com/oss/go/microsoft/golang@sha256:d55d6f4a4eba98feb762758d7b92f893368d46fd43d7fab7bb0333995492bb50 AS cgo
33

44
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'SilentlyContinue';"]
55

‎controller/Dockerfile.windows-native‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44
# Maybe one day: https://github.com/moby/buildkit/issues/616
55
ARG BUILDER_IMAGE
66
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.26.0-windowsservercore-ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}"
7-
FROM --platform=windows/amd64 mcr.microsoft.com/oss/go/microsoft/golang@sha256:179ddfa34eda50f58ea0011202f559585ade9668a298fe81ac01cebdc9bef15c AS builder
7+
FROM --platform=windows/amd64 mcr.microsoft.com/oss/go/microsoft/golang@sha256:d55d6f4a4eba98feb762758d7b92f893368d46fd43d7fab7bb0333995492bb50 AS builder
88
WORKDIR C:\\retina
99
COPY go.mod .
1010
COPY go.sum .
@@ -24,7 +24,7 @@ FROM --platform=windows/amd64 ${BUILDER_IMAGE} as pktmon-builder
2424
WORKDIR C:\\retina
2525

2626
# skopeo inspect docker://mcr.microsoft.com/windows/nanoserver:ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}"
27-
FROM --platform=windows/amd64 mcr.microsoft.com/windows/nanoserver@sha256:60612a30303eb5a15ce7f53fa2eecf70bca41d72657de0482fbde601ae5f3403 AS final
27+
FROM --platform=windows/amd64 mcr.microsoft.com/windows/nanoserver@sha256:be41510eb214c55def9162ef1fb5e71f1b71ce4d64d91bc963199f2383e034ea AS final
2828
ADD https://github.com/microsoft/etl2pcapng/releases/download/v1.10.0/etl2pcapng.exe /etl2pcapng.exe
2929
SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop'; $ProgressPreference = 'Continue';"]
3030
COPY --from=builder C:\\retina\\windows\\kubeconfigtemplate.yaml kubeconfigtemplate.yaml

‎controller/Dockerfile.windows-retina-oss-build‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ ARG OS_VERSION=ltsc2022
33
# pinned base images
44

55
# skopeo inspect docker://mcr.microsoft.com/windows/servercore:ltsc2022 --override-os windows --format "{{.Name}}@{{.Digest}}"
6-
FROM mcr.microsoft.com/windows/servercore@sha256:a264df8cd8c329eed3fd1e0cafcd4f3dc453e2c72a277f9bb140fd6f10a2eefc AS ltsc2022
6+
FROM mcr.microsoft.com/windows/servercore@sha256:d4c6d1a8a1a306b12691c3b2e5e3a8bfad786cbd6b7831cd74a9a6a99eab08ad AS ltsc2022
77

88
FROM ${OS_VERSION} AS agent-win
99
ARG GOARCH=amd64 # default to amd64

‎go.mod‎

Lines changed: 19 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/microsoft/retina
22

3-
go 1.24.11
3+
go 1.24.13
44

55
require (
66
github.com/go-chi/chi/v5 v5.2.4
@@ -19,7 +19,7 @@ retract (
1919
)
2020

2121
require (
22-
cel.dev/expr v0.24.0 // indirect
22+
cel.dev/expr v0.25.1 // indirect
2323
code.cloudfoundry.org/clock v1.0.0 // indirect
2424
github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
2525
github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 // indirect
@@ -67,7 +67,7 @@ require (
6767
github.com/cilium/dns v1.1.51-0.20240603182237-af788769786a // indirect
6868
github.com/cilium/lumberjack/v2 v2.4.1 // indirect
6969
github.com/cilium/stream v0.0.0-20241203114243-53c3e5d79744 // indirect
70-
github.com/cncf/xds/go v0.0.0-20250501225837-2ac532fd4443 // indirect
70+
github.com/cncf/xds/go v0.0.0-20251210132809-ee656c7534f5 // indirect
7171
github.com/containerd/cgroups/v3 v3.0.3 // indirect
7272
github.com/containerd/containerd v1.7.29 // indirect
7373
github.com/containerd/continuity v0.4.4 // indirect
@@ -91,7 +91,7 @@ require (
9191
github.com/docker/go-metrics v0.0.1 // indirect
9292
github.com/docker/go-units v0.5.0 // indirect
9393
github.com/emicklei/go-restful/v3 v3.12.2 // indirect
94-
github.com/envoyproxy/protoc-gen-validate v1.2.1 // indirect
94+
github.com/envoyproxy/protoc-gen-validate v1.3.0 // indirect
9595
github.com/evanphx/json-patch v5.9.11+incompatible // indirect
9696
github.com/evanphx/json-patch/v5 v5.9.11 // indirect
9797
github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
@@ -187,7 +187,7 @@ require (
187187
github.com/sourcegraph/conc v0.3.0 // indirect
188188
github.com/spf13/afero v1.14.0 // indirect
189189
github.com/spf13/cast v1.7.1 // indirect
190-
github.com/spiffe/go-spiffe/v2 v2.5.0 // indirect
190+
github.com/spiffe/go-spiffe/v2 v2.6.0 // indirect
191191
github.com/spiffe/spire-api-sdk v1.12.0 // indirect
192192
github.com/subosito/gotenv v1.6.0 // indirect
193193
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
@@ -200,7 +200,6 @@ require (
200200
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
201201
github.com/xeipuuv/gojsonschema v1.2.0 // indirect
202202
github.com/xlab/treeprint v1.2.0 // indirect
203-
github.com/zeebo/errs v1.4.0 // indirect
204203
go.etcd.io/etcd/api/v3 v3.5.21 // indirect
205204
go.etcd.io/etcd/client/pkg/v3 v3.5.21 // indirect
206205
go.etcd.io/etcd/client/v3 v3.5.21 // indirect
@@ -216,8 +215,8 @@ require (
216215
golang.org/x/tools v0.39.0 // indirect
217216
gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
218217
google.golang.org/genproto v0.0.0-20241118233622-e639e219e697 // indirect
219-
google.golang.org/genproto/googleapis/api v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
220-
google.golang.org/genproto/googleapis/rpc v0.0.0-20250707201910-8d1bb00bc6a7 // indirect
218+
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
219+
google.golang.org/genproto/googleapis/rpc v0.0.0-20251202230838-ff82c1b0f217 // indirect
221220
gopkg.in/inf.v0 v0.9.1 // indirect
222221
k8s.io/apiserver v0.32.3 // indirect
223222
k8s.io/component-base v0.32.3 // indirect
@@ -302,12 +301,12 @@ require (
302301
github.com/sirupsen/logrus v1.9.3
303302
github.com/spf13/viper v1.20.1
304303
github.com/vishvananda/netlink v1.3.1
305-
go.opentelemetry.io/otel v1.37.0
306-
go.opentelemetry.io/otel/metric v1.37.0
307-
go.opentelemetry.io/otel/trace v1.37.0
304+
go.opentelemetry.io/otel v1.39.0
305+
go.opentelemetry.io/otel/metric v1.39.0
306+
go.opentelemetry.io/otel/trace v1.39.0
308307
go.uber.org/mock v0.5.2
309308
golang.org/x/exp v0.0.0-20250305212735-054e65f0b394
310-
google.golang.org/grpc v1.75.1
309+
google.golang.org/grpc v1.79.3
311310
gopkg.in/natefinch/lumberjack.v2 v2.2.1
312311
gotest.tools v2.2.0+incompatible
313312
gotest.tools/v3 v3.5.2
@@ -326,7 +325,7 @@ require (
326325
github.com/containerd/containerd/api v1.8.0 // indirect
327326
github.com/containerd/errdefs/pkg v0.3.0 // indirect
328327
github.com/containerd/platforms v0.2.1 // indirect
329-
github.com/go-jose/go-jose/v4 v4.1.1 // indirect
328+
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
330329
github.com/google/cel-go v0.24.1 // indirect
331330
github.com/moby/sys/userns v0.1.0 // indirect
332331
github.com/stoewer/go-strcase v1.3.0 // indirect
@@ -338,7 +337,7 @@ require (
338337
cloud.google.com/go v0.116.0 // indirect
339338
cloud.google.com/go/auth v0.15.0 // indirect
340339
cloud.google.com/go/auth/oauth2adapt v0.2.7 // indirect
341-
cloud.google.com/go/compute/metadata v0.7.0 // indirect
340+
cloud.google.com/go/compute/metadata v0.9.0 // indirect
342341
cloud.google.com/go/iam v1.2.2 // indirect
343342
cloud.google.com/go/kms v1.20.1 // indirect
344343
cloud.google.com/go/longrunning v0.6.2 // indirect
@@ -365,7 +364,7 @@ require (
365364
github.com/Crocmagnon/fatcontext v0.7.1 // indirect
366365
github.com/Djarvur/go-err113 v0.0.0-20210108212216-aea10b59be24 // indirect
367366
github.com/GaijinEntertainment/go-exhaustruct/v3 v3.3.1 // indirect
368-
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.29.0 // indirect
367+
github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.30.0 // indirect
369368
github.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric v0.48.1 // indirect
370369
github.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping v0.48.1 // indirect
371370
github.com/OpenPeeDeeP/depguard/v2 v2.2.1 // indirect
@@ -436,7 +435,7 @@ require (
436435
github.com/dustin/go-humanize v1.0.1 // indirect
437436
github.com/elliotchance/orderedmap/v2 v2.2.0 // indirect
438437
github.com/emirpasic/gods v1.18.1 // indirect
439-
github.com/envoyproxy/go-control-plane/envoy v1.32.4 // indirect
438+
github.com/envoyproxy/go-control-plane/envoy v1.36.0 // indirect
440439
github.com/ettle/strcase v0.2.0 // indirect
441440
github.com/fatih/structtag v1.2.0 // indirect
442441
github.com/firefart/nonamedreturns v1.0.5 // indirect
@@ -630,14 +629,14 @@ require (
630629
gitlab.com/digitalxero/go-conventional-commit v1.0.7 // indirect
631630
go-simpler.org/musttag v0.13.0 // indirect
632631
go-simpler.org/sloglint v0.9.0 // indirect
633-
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
634-
go.opentelemetry.io/contrib/detectors/gcp v1.36.0 // indirect
632+
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
633+
go.opentelemetry.io/contrib/detectors/gcp v1.39.0 // indirect
635634
go.opentelemetry.io/contrib/exporters/autoexport v0.60.0 // indirect
636635
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.59.0 // indirect
637636
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.35.0 // indirect
638637
go.opentelemetry.io/otel/exporters/stdout/stdoutmetric v1.35.0 // indirect
639-
go.opentelemetry.io/otel/sdk v1.37.0 // indirect
640-
go.opentelemetry.io/otel/sdk/metric v1.37.0 // indirect
638+
go.opentelemetry.io/otel/sdk v1.39.0 // indirect
639+
go.opentelemetry.io/otel/sdk/metric v1.39.0 // indirect
641640
go.uber.org/atomic v1.11.0 // indirect
642641
go.uber.org/automaxprocs v1.6.0 // indirect
643642
go.yaml.in/yaml/v2 v2.4.3 // indirect

0 commit comments

Comments
 (0)