fe7fc2ff7f
- https://github.com/golang/go/issues?q=milestone%3AGo1.24.4+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.3...go1.24.4 This release includes 3 security fixes following the security policy: - net/http: sensitive headers not cleared on cross-origin redirect Proxy-Authorization and Proxy-Authenticate headers persisted on cross-origin redirects potentially leaking sensitive information. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2025-4673 and Go issue https://go.dev/issue/73816. - os: inconsistent handling of O_CREATE|O_EXCL on Unix and Windows os.OpenFile(path, os.O_CREATE|O_EXCL) behaved differently on Unix and Windows systems when the target path was a dangling symlink. On Unix systems, OpenFile with O_CREATE and O_EXCL flags never follows symlinks. On Windows, when the target path was a symlink to a nonexistent location, OpenFile would create a file in that location. OpenFile now always returns an error when the O_CREATE and O_EXCL flags are both set and the target path is a symlink. Thanks to Junyoung Park and Dong-uk Kim of KAIST Hacking Lab for discovering this issue. This is CVE-2025-0913 and Go issue https://go.dev/issue/73702. - crypto/x509: usage of ExtKeyUsageAny disables policy validation Calling Verify with a VerifyOptions.KeyUsages that contains ExtKeyUsageAny unintentionally disabledpolicy validation. This only affected certificate chains which contain policy graphs, which are rather uncommon. Thanks to Krzysztof Skrzętnicki (@Tener) of Teleport for reporting this issue. This is CVE-2025-22874 and Go issue https://go.dev/issue/73612. Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
84 lines
2.4 KiB
Docker
84 lines
2.4 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
ARG GO_VERSION=1.24.4
|
|
ARG ALPINE_VERSION=3.21
|
|
|
|
# BUILDX_VERSION sets the version of buildx to install in the dev container.
|
|
# It must be a valid tag in the docker.io/docker/buildx-bin image repository
|
|
# on Docker Hub.
|
|
ARG BUILDX_VERSION=0.24.0
|
|
FROM docker/buildx-bin:${BUILDX_VERSION} AS buildx
|
|
|
|
FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golang
|
|
ENV GOTOOLCHAIN=local
|
|
ENV CGO_ENABLED=0
|
|
|
|
FROM golang AS gofumpt
|
|
ARG GOFUMPT_VERSION=v0.7.0
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=tmpfs,target=/go/src/ \
|
|
GO111MODULE=on go install "mvdan.cc/gofumpt@${GOFUMPT_VERSION}" \
|
|
&& gofumpt --version
|
|
|
|
FROM golang AS gotestsum
|
|
ARG GOTESTSUM_VERSION=v1.12.0
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=tmpfs,target=/go/src/ \
|
|
GO111MODULE=on go install gotest.tools/gotestsum@${GOTESTSUM_VERSION}
|
|
|
|
FROM golang AS goversioninfo
|
|
ARG GOVERSIONINFO_VERSION=v1.4.1
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=tmpfs,target=/go/src/ \
|
|
GO111MODULE=on go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@${GOVERSIONINFO_VERSION}
|
|
|
|
FROM golang AS dev
|
|
RUN apk add --no-cache \
|
|
bash \
|
|
bash-completion \
|
|
build-base \
|
|
ca-certificates \
|
|
coreutils \
|
|
curl \
|
|
git \
|
|
jq \
|
|
nano
|
|
|
|
RUN <<-'EOF'
|
|
cat > /etc/motd <<-'EOM'
|
|
\e[1;32mYou are now in a development container.\e[0m
|
|
|
|
Run \e[1;36mmake help\e[0m to see available targets.
|
|
EOM
|
|
|
|
cat >> /root/.bashrc <<-'EOB'
|
|
# print the MOTD when opening the dev-container (interactive shell only).
|
|
if [[ $- == *i* ]] && [[ -z "$MOTD_SHOWN" ]]; then
|
|
printf "%b\n" "$(cat /etc/motd)"
|
|
export MOTD_SHOWN=1
|
|
fi
|
|
|
|
# set a custom prompt to make it more visible when inside the dev-container.
|
|
PS1='\[\e[0;32m\]\u@docker-cli-dev\$ \[\e[0m\]'
|
|
|
|
# set-up bash completion for testing.
|
|
source /etc/bash/bash_completion.sh
|
|
EOB
|
|
EOF
|
|
|
|
CMD ["/bin/bash"]
|
|
ENV DISABLE_WARN_OUTSIDE_CONTAINER=1
|
|
ENV PATH=$PATH:/go/src/github.com/docker/cli/build
|
|
|
|
COPY --link --from=buildx /buildx /usr/libexec/docker/cli-plugins/docker-buildx
|
|
COPY --link --from=gofumpt /go/bin/* /go/bin/
|
|
COPY --link --from=gotestsum /go/bin/* /go/bin/
|
|
COPY --link --from=goversioninfo /go/bin/* /go/bin/
|
|
|
|
WORKDIR /go/src/github.com/docker/cli
|
|
ENV GO111MODULE=auto
|
|
COPY --link . .
|