Skip to content

Update custom-mirror with released security fixes and Go 1.26.9 #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
kylos101 wants to merge 2 commits into from
Closed

Update custom-mirror with released security fixes and Go 1.26.9 #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
63b1d54
Carry published gitpod.8 security fixes onto custom-mirror
kylos101 Oct 20, 2026
1e0d572
Rebuild Gitpod BuildKit with Go 1.26.9 and patched HTTP/2 dependencies
kylos101 Oct 20, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
2 changes: 1 addition & 1 deletion .github/workflows/.test.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,7 +27,7 @@ on:
type: string

env:
GO_VERSION: "1.23"
GO_VERSION: "1.26.9"
SETUP_BUILDX_VERSION: "edge"
SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"

Expand Down
2 changes: 1 addition & 1 deletion .github/workflows/buildkit.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -19,7 +19,7 @@ on:
- 'frontend/dockerfile/docs/**'

env:
GO_VERSION: "1.23"
GO_VERSION: "1.26.9"
SETUP_BUILDX_VERSION: "edge"
SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
IMAGE_NAME: "ghcr.io/gitpod-io/buildkit"
Expand Down
25 changes: 25 additions & 0 deletions .vex/v0.20.1-gitpod.8.openvex.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,25 @@
{
"@context": "https://openvex.dev/ns/v0.2.0",
"@id": "https://github.com/gitpod-io/buildkit/security/vex/v0.20.1-gitpod.8",
"author": "Gitpod",
"timestamp": "2026-06-08T00:00:00Z",
"version": 1,
"statements": [
{
"vulnerability": {
"name": "GO-2026-4858",
"aliases": [
"GHSA-4c29-8rgm-jvjj"
]
},
"timestamp": "2026-06-08T00:00:00Z",
"products": [
{
"@id": "pkg:golang/github.com/moby/buildkit@v0.20.1-gitpod.8"
}
],
"status": "fixed",
"action_statement": "Fixed by backporting upstream BuildKit git subdir normalization and checkout validation from 45b038cd0b2ec2d34013ce0f085522276f7ee0d8."
}
]
}
35 changes: 24 additions & 11 deletions Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,7 +7,9 @@ ARG CONTAINERD_ALT_VERSION_17=v1.7.25
ARG CONTAINERD_ALT_VERSION_16=v1.6.36
ARG REGISTRY_VERSION=v2.8.3
ARG ROOTLESSKIT_VERSION=v2.3.2
ARG CNI_VERSION=v1.5.1
ARG CNI_VERSION=v1.9.1
ARG CNI_X_NET_VERSION=v0.60.0
ARG RUNC_X_NET_VERSION=v0.60.0
ARG STARGZ_SNAPSHOTTER_VERSION=v0.15.1
ARG NERDCTL_VERSION=v1.6.2
ARG DNSNAME_VERSION=v1.3.1
Expand All @@ -18,8 +20,8 @@ ARG AZURITE_VERSION=3.33.0
ARG GOTESTSUM_VERSION=v1.9.0
ARG DELVE_VERSION=v1.23.1

ARG GO_VERSION=1.23
ARG ALPINE_VERSION=3.22
ARG GO_VERSION=1.26.9
ARG ALPINE_VERSION=3.23
ARG XX_VERSION=1.6.1
ARG BUILDKIT_DEBUG
ARG EXPORT_BASE=alpine
Expand All @@ -44,6 +46,8 @@ FROM gobuild-base AS runc
WORKDIR $GOPATH/src/github.com/opencontainers/runc
ARG RUNC_VERSION
ADD --keep-git-dir=true "https://github.com/opencontainers/runc.git#$RUNC_VERSION" .
ARG RUNC_X_NET_VERSION
RUN go get "golang.org/x/net@${RUNC_X_NET_VERSION}" && go mod tidy && go mod vendor
ARG TARGETPLATFORM
# gcc is only installed for libgcc
# lld has issues building static binaries for ppc so prefer ld for it
Expand Down Expand Up @@ -140,16 +144,24 @@ RUN --mount=target=/root/.cache,type=cache \
CGO_ENABLED=0 xx-go build -o /usr/bin/dnsname ./plugins/meta/dnsname && \
xx-verify --static /usr/bin/dnsname

FROM --platform=$BUILDPLATFORM alpine:${ALPINE_VERSION} AS cni-plugins
RUN apk add --no-cache curl
COPY --from=xx / /
FROM gobuild-base AS cni-plugins
WORKDIR $GOPATH/src/github.com/containernetworking/plugins
ARG CNI_VERSION
ARG TARGETOS
ARG TARGETARCH
ARG TARGETPLATFORM
ARG CNI_X_NET_VERSION
ADD --keep-git-dir=true "https://github.com/containernetworking/plugins.git#$CNI_VERSION" .
RUN go get "golang.org/x/net@${CNI_X_NET_VERSION}" && go mod tidy && go mod vendor
WORKDIR /opt/cni/bin
RUN curl -Ls https://github.com/containernetworking/plugins/releases/download/${CNI_VERSION}/cni-plugins-${TARGETOS}-${TARGETARCH}-${CNI_VERSION}.tgz | tar xzv
RUN xx-verify --static bridge loopback host-local
ARG TARGETPLATFORM
RUN --mount=target=/root/.cache,type=cache <<EOT
set -ex
cd /go/src/github.com/containernetworking/plugins
CGO_ENABLED=0 xx-go build -mod=vendor -o /opt/cni/bin/bridge ./plugins/main/bridge
CGO_ENABLED=0 xx-go build -mod=vendor -o /opt/cni/bin/loopback ./plugins/main/loopback
CGO_ENABLED=0 xx-go build -mod=vendor -o /opt/cni/bin/host-local ./plugins/ipam/host-local
CGO_ENABLED=0 xx-go build -mod=vendor -o /opt/cni/bin/firewall ./plugins/meta/firewall
cd /opt/cni/bin
xx-verify --static bridge loopback host-local firewall
EOT
COPY --link --from=dnsname /usr/bin/dnsname /opt/cni/bin/

FROM scratch AS cni-plugins-export
Expand Down Expand Up @@ -374,6 +386,7 @@ EOT

FROM buildkit-export AS buildkit-linux
COPY --link --from=binaries / /usr/bin/
COPY --link .vex /usr/share/buildkit/vex
ENV BUILDKIT_SETUP_CGROUPV2_ROOT=1
ENTRYPOINT ["buildkitd"]

Expand Down
4 changes: 2 additions & 2 deletions frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,7 +1,7 @@
# syntax=docker/dockerfile-upstream:master

ARG GO_VERSION=1.23
ARG ALPINE_VERSION=3.21
ARG GO_VERSION=1.26.9
ARG ALPINE_VERSION=3.23
ARG XX_VERSION=1.6.1

# xx is a helper for cross-compilation
Expand Down
43 changes: 23 additions & 20 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,8 @@
module github.com/moby/buildkit

go 1.22.0
go 1.26.0

toolchain go1.26.9

require (
github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0
Expand Down Expand Up @@ -38,7 +40,7 @@ require (
github.com/docker/go-units v0.5.0
github.com/gofrs/flock v0.12.1
github.com/golang/protobuf v1.5.4
github.com/google/go-cmp v0.6.0
github.com/google/go-cmp v0.7.0
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
github.com/hashicorp/go-cleanhttp v0.5.2
github.com/hashicorp/go-immutable-radix/v2 v2.1.0
Expand Down Expand Up @@ -70,7 +72,7 @@ require (
github.com/serialx/hashring v0.0.0-20200727003509-22c0c7ab6b1b
github.com/sirupsen/logrus v1.9.3
github.com/spdx/tools-golang v0.5.3
github.com/stretchr/testify v1.10.0
github.com/stretchr/testify v1.11.1
github.com/tonistiigi/dchapes-mode v0.0.0-20241001053921-ca0759fec205
github.com/tonistiigi/fsutil v0.0.0-20250113203817-b14e27f4135a
github.com/tonistiigi/go-actions-cache v0.0.0-20250228231703-3e9a6642607f
Expand All @@ -81,32 +83,32 @@ require (
github.com/urfave/cli v1.22.16
github.com/vishvananda/netlink v1.3.1-0.20240922070040-084abd93d350
go.etcd.io/bbolt v1.3.11
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.56.0
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.66.0
go.opentelemetry.io/contrib/instrumentation/net/http/httptrace/otelhttptrace v0.56.0
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.56.0
go.opentelemetry.io/otel v1.31.0
go.opentelemetry.io/otel v1.41.0
go.opentelemetry.io/otel/exporters/jaeger v1.17.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetricgrpc v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlpmetric/otlpmetrichttp v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.31.0
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.31.0
go.opentelemetry.io/otel/exporters/prometheus v0.42.0
go.opentelemetry.io/otel/sdk v1.31.0
go.opentelemetry.io/otel/sdk/metric v1.31.0
go.opentelemetry.io/otel/trace v1.31.0
go.opentelemetry.io/otel/sdk v1.41.0
go.opentelemetry.io/otel/sdk/metric v1.41.0
go.opentelemetry.io/otel/trace v1.41.0
go.opentelemetry.io/proto/otlp v1.3.1
golang.org/x/crypto v0.31.0
golang.org/x/crypto v0.57.0
golang.org/x/exp v0.0.0-20241108190413-2d47ceb2692f
golang.org/x/mod v0.22.0
golang.org/x/net v0.33.0
golang.org/x/sync v0.10.0
golang.org/x/sys v0.29.0
golang.org/x/mod v0.41.0
golang.org/x/net v0.60.0
golang.org/x/sync v0.23.0
golang.org/x/sys v0.48.0
golang.org/x/time v0.6.0
google.golang.org/genproto/googleapis/rpc v0.0.0-20241021214115-324edc3d5d38
google.golang.org/grpc v1.69.4
google.golang.org/genproto/googleapis/rpc v0.0.0-20260209200024-4cfbd4190f57
google.golang.org/grpc v1.79.3
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
google.golang.org/protobuf v1.35.2
google.golang.org/protobuf v1.36.11
kernel.org/pub/linux/libs/security/libcap/cap v1.2.73
tags.cncf.io/container-device-interface v0.8.1
)
Expand Down Expand Up @@ -148,7 +150,7 @@ require (
github.com/felixge/fgprof v0.9.3 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/fsnotify/fsnotify v1.7.0 // indirect
github.com/go-logr/logr v1.4.2 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang-jwt/jwt/v5 v5.2.1 // indirect
Expand Down Expand Up @@ -178,9 +180,10 @@ require (
github.com/vbatts/tar-split v0.11.6 // indirect
github.com/vishvananda/netns v0.0.5 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/otel/metric v1.31.0 // indirect
golang.org/x/text v0.21.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20241021214115-324edc3d5d38 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/otel/metric v1.41.0 // indirect
golang.org/x/text v0.42.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
kernel.org/pub/linux/libs/security/libcap/psx v1.2.73 // indirect
sigs.k8s.io/yaml v1.4.0 // indirect
Expand Down
Loading
Loading