d544885316
These releases include 2 security fixes following the security policy:
- crypto/x509: excessive resource consumption in printing error string for host certificate validation
Within HostnameError.Error(), when constructing an error string, there is no limit to the number of hosts that will be printed out.
Furthermore, the error string is constructed by repeated string concatenation, leading to quadratic runtime.
Therefore, a certificate provided by a malicious actor can result in excessive resource consumption.
HostnameError.Error() now limits the number of hosts and utilizes strings.Builder when constructing an error string.
Thanks to Philippe Antoine (Catena cyber) for reporting this issue.
This is CVE-2025-61729 and Go issue https://go.dev/issue/76445.
- crypto/x509: excluded subdomain constraint does not restrict wildcard SANs
An excluded subdomain constraint in a certificate chain does not restrict the
usage of wildcard SANs in the leaf certificate. For example a constraint that
excludes the subdomain test.example.com does not prevent a leaf certificate from
claiming the SAN *.example.com.
This is CVE-2025-61727 and Go issue https://go.dev/issue/76442.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.25.5
Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
93 lines
3.0 KiB
Docker
93 lines
3.0 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
ARG GO_VERSION=1.25.5
|
|
|
|
# ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
|
|
# It must be a supported tag in the docker.io/library/alpine image repository
|
|
# that's also available as alpine image variant for the Golang version used.
|
|
ARG ALPINE_VERSION=3.22
|
|
|
|
# BUILDX_VERSION sets the version of buildx to install in the dev container.
|
|
# It must be a valid tag in the docker.io/docker/buildx-bin image repository
|
|
# on Docker Hub.
|
|
ARG BUILDX_VERSION=0.29.1
|
|
FROM docker/buildx-bin:${BUILDX_VERSION} AS buildx
|
|
|
|
FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golang
|
|
ENV GOTOOLCHAIN=local
|
|
ENV CGO_ENABLED=0
|
|
|
|
FROM golang AS gofumpt
|
|
ARG GOFUMPT_VERSION=v0.7.0
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=tmpfs,target=/go/src/ \
|
|
GO111MODULE=on go install "mvdan.cc/gofumpt@${GOFUMPT_VERSION}" \
|
|
&& gofumpt --version
|
|
|
|
FROM golang AS gotestsum
|
|
# GOTESTSUM_VERSION sets the version of gotestsum to install in the dev container.
|
|
# It must be a valid tag in the https://github.com/gotestyourself/gotestsum repository.
|
|
ARG GOTESTSUM_VERSION=v1.13.0
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=tmpfs,target=/go/src/ \
|
|
GO111MODULE=on go install gotest.tools/gotestsum@${GOTESTSUM_VERSION}
|
|
|
|
FROM golang AS goversioninfo
|
|
# GOVERSIONINFO_VERSION is the version of GoVersionInfo to install.
|
|
# It must be a valid tag from https://github.com/josephspurrier/goversioninfo
|
|
ARG GOVERSIONINFO_VERSION=v1.5.0
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
--mount=type=tmpfs,target=/go/src/ \
|
|
GO111MODULE=on go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@${GOVERSIONINFO_VERSION}
|
|
|
|
FROM golang AS dev
|
|
RUN apk add --no-cache \
|
|
bash \
|
|
bash-completion \
|
|
build-base \
|
|
ca-certificates \
|
|
coreutils \
|
|
curl \
|
|
git \
|
|
git-daemon \
|
|
jq \
|
|
nano
|
|
|
|
RUN <<-'EOF'
|
|
cat > /etc/motd <<-'EOM'
|
|
\e[1;32mYou are now in a development container.\e[0m
|
|
|
|
Run \e[1;36mmake help\e[0m to see available targets.
|
|
EOM
|
|
|
|
cat >> /root/.bashrc <<-'EOB'
|
|
# print the MOTD when opening the dev-container (interactive shell only).
|
|
if [[ $- == *i* ]] && [[ -z "$MOTD_SHOWN" ]]; then
|
|
printf "%b\n" "$(cat /etc/motd)"
|
|
export MOTD_SHOWN=1
|
|
fi
|
|
|
|
# set a custom prompt to make it more visible when inside the dev-container.
|
|
PS1='\[\e[0;32m\]\u@docker-cli-dev\$ \[\e[0m\]'
|
|
|
|
# set-up bash completion for testing.
|
|
source /etc/bash/bash_completion.sh
|
|
EOB
|
|
EOF
|
|
|
|
CMD ["/bin/bash"]
|
|
ENV DISABLE_WARN_OUTSIDE_CONTAINER=1
|
|
ENV PATH=$PATH:/go/src/github.com/docker/cli/build
|
|
|
|
COPY --link --from=buildx /buildx /usr/libexec/docker/cli-plugins/docker-buildx
|
|
COPY --link --from=gofumpt /go/bin/* /go/bin/
|
|
COPY --link --from=gotestsum /go/bin/* /go/bin/
|
|
COPY --link --from=goversioninfo /go/bin/* /go/bin/
|
|
|
|
WORKDIR /go/src/github.com/docker/cli
|
|
ENV GO111MODULE=auto
|
|
COPY --link . .
|