[kylos101]

Description

Update custom-mirror, the branch of the long-running Gitpod fork PR #1, so the next manually published Gitpod BuildKit image includes the critical vulnerability fixes.

This branch starts at custom-mirror commit 93509e16a and targets custom-mirror. The long-running PR remains open; this change does not merge the fork back to master.

There are two commits:

1. Carry the security fixes already shipped in v0.20.1-gitpod.8 back onto custom-mirror: patched gRPC/dependencies, the Git source subdirectory validation backport and its VEX statement, Alpine 3.23, and rebuilt helper binaries. Unrelated development-container additions are excluded.
2. Upgrade Go to 1.26.9 and golang.org/x/net to 0.60.0, including the CNI/runc pins and required supporting dependencies. Align the build/test workflow and Dockerfile frontend toolchains. These address GO-2026-6604 (CVE-2026-56857) and GO-2026-6612 (CVE-2026-78663).

Most changed files are the generated vendor tree: custom-mirror still had Go 1.23 / x/net 0.33.0 and older gRPC. The existing mirror patches and fork build process are preserved.

Related changes and publication

Supersedes #3, which targeted the release branch.

Required by gitpod-io/gitpod#21636. After review, the maintainer will merge into custom-mirror and manually upload the new version to Gitpod Core Dev. The Gitpod consumer then needs a small image-reference update and a fresh production scan. No merge, tag, or image publication is performed by this PR.

How to test

Completed locally on native Linux amd64 with Go 1.26.9:

• GO_VERSION=1.26.9 docker buildx bake binaries --set binaries.platform=linux/amd64 --progress plain passes.
• SKIP_INTEGRATION_TESTS=1 go test -timeout 10m ./cmd/buildctl/... ./session/... ./util/resolver/... ./source/git/... ./util/gitutil/... passes.
• go mod tidy -diff and git diff --check pass.
• Grype 0.121.0, using the October 20, 2026 vulnerability database, reports zero critical findings in dir:./bin/build.

The scan covers rebuilt binaries, not a published image or the complete Gitpod production build. Full integration tests and a scan of the manually published image remain outstanding. Local unit tests use the repository's integration-test exclusion switch because the CLI integration tests require an external registry.