9bcc88611f
- https://github.com/golang/go/issues?q=milestone%3AGo1.24.5+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.24.4...go1.24.5 This minor releases include 1 security fixes following the security policy: - cmd/go: unexpected command execution in untrusted VCS repositories Various uses of the Go toolchain in untrusted VCS repositories can result in unexpected code execution. When using the Go toolchain in directories fetched using various VCS tools (such as directly cloning Git or Mercurial repositories) can cause the toolchain to execute unexpected commands, if said directory contains multiple VCS configuration metadata (such as a '.hg' directory in a Git repository). This is due to how the Go toolchain attempts to resolve which VCS is being used in order to embed build information in binaries and determine module versions. The toolchain will now abort attempting to resolve which VCS is being used if it detects multiple VCS configuration metadata in a module directory or nested VCS configuration metadata (such as a '.git' directoy in a parent directory and a '.hg' directory in a child directory). This will not prevent the toolchain from building modules, but will result in binaries omitting VCS related build information. If this behavior is expected by the user, the old behavior can be re-enabled by setting GODEBUG=allowmultiplevcs=1. This should only be done in trusted repositories. Thanks to RyotaK (https://ryotak.net) of GMO Flatt Security Inc for reporting this issue. This is CVE-2025-4674 and https://go.dev/issue/74380. View the release notes for more information: https://go.dev/doc/devel/release#go1.24.5 Signed-off-by: Paweł Gronowski <pawel.gronowski@docker.com>
44 lines
1.1 KiB
Docker
44 lines
1.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
ARG GO_VERSION=1.24.5
|
|
ARG ALPINE_VERSION=3.21
|
|
ARG MODOUTDATED_VERSION=v0.8.0
|
|
|
|
FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
|
|
ENV GOTOOLCHAIN=local
|
|
RUN apk add --no-cache bash git rsync
|
|
WORKDIR /src
|
|
|
|
FROM base AS vendored
|
|
ENV GOPROXY=https://proxy.golang.org|direct
|
|
RUN --mount=target=/context \
|
|
--mount=target=.,type=tmpfs \
|
|
--mount=target=/go/pkg/mod,type=cache <<EOT
|
|
set -e
|
|
rsync -a /context/. .
|
|
./scripts/with-go-mod.sh ./scripts/vendor update
|
|
mkdir /out
|
|
cp -r vendor.mod vendor.sum vendor /out
|
|
EOT
|
|
|
|
FROM scratch AS update
|
|
COPY --from=vendored /out /out
|
|
|
|
FROM vendored AS validate
|
|
RUN --mount=target=/context \
|
|
--mount=target=.,type=tmpfs <<EOT
|
|
set -e
|
|
rsync -a /context/. .
|
|
git add -A
|
|
rm -rf vendor
|
|
cp -rf /out/* .
|
|
./scripts/with-go-mod.sh ./scripts/vendor validate
|
|
EOT
|
|
|
|
FROM psampaz/go-mod-outdated:${MODOUTDATED_VERSION} AS go-mod-outdated
|
|
FROM base AS outdated
|
|
RUN --mount=target=.,rw \
|
|
--mount=target=/go/pkg/mod,type=cache \
|
|
--mount=from=go-mod-outdated,source=/home/go-mod-outdated,target=/usr/bin/go-mod-outdated \
|
|
./scripts/with-go-mod.sh ./scripts/vendor outdated
|