Skip to content

Commit cbe74f0

Browse files
nevermarineIsteb4kuniversal-itengineer
authored
chore(ci): update 3p versions for cve fixes (#1572)
Signed-off-by: Maksim Fedotov <[email protected]> Signed-off-by: Isteb4k <[email protected]> Signed-off-by: Nikita Korolev <[email protected]> Co-authored-by: Dmitry Rakitin <[email protected]> Co-authored-by: Nikita Korolev <[email protected]>
1 parent 89ba368 commit cbe74f0

File tree

7 files changed

+24
-51
lines changed

7 files changed

+24
-51
lines changed

‎build/components/versions.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ firmware:
33
libvirt: v10.9.0
44
edk2: stable202411
55
core:
6-
3p-kubevirt: v1.3.1-v12n.16
7-
3p-containerized-data-importer: v1.60.3-v12n.10
6+
3p-kubevirt: v1.3.1-v12n.17
7+
3p-containerized-data-importer: v1.60.3-v12n.11
88
distribution: 2.8.3
99
package:
1010
acl: v2.3.1

‎images/cdi-artifact/werf.inc.yaml‎

Lines changed: 3 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -35,8 +35,8 @@ secrets:
3535
shell:
3636
install:
3737
- |
38-
echo "Git clone CDI repository..."
39-
git clone --depth 1 --branch {{ $version }} $(cat /run/secrets/SOURCE_REPO)/{{ $gitRepoUrl }} /src/containerized-data-importer
38+
echo "Git clone {{ $gitRepoName }} repository..."
39+
git clone --depth=1 --branch {{ $version }} $(cat /run/secrets/SOURCE_REPO)/{{ $gitRepoUrl }} /src/containerized-data-importer
4040
4141
rm -rf /src/containerized-data-importer/.git
4242
@@ -81,19 +81,8 @@ shell:
8181
cd /containerized-data-importer
8282
go mod download
8383
84-
echo Update modules to mitigate CVEs...
85-
86-
# CVE-2024-45337,CVE-2025-22869
87-
go get golang.org/x/[email protected]
88-
# CVE-2025-22870, CVE-2025-22872
89-
go get golang.org/x/[email protected]
90-
# CVE-2025-27144
91-
go get github.com/go-jose/go-jose/[email protected]
92-
# CVE-2025-22868
93-
go get golang.org/x/[email protected]
94-
95-
go mod tidy
9684
go mod vendor
85+
9786
# Apply patch for json-patch from 3p-cdi repo
9887
git apply --ignore-space-change --ignore-whitespace patches/replace-op-for-evanphx-json-patch-v5-lib.patch
9988

‎images/dvcr-artifact/go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -40,7 +40,7 @@ require (
4040
github.com/containers/storage v1.55.0 // indirect
4141
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
4242
github.com/docker/distribution v2.8.3+incompatible // indirect
43-
github.com/docker/docker v27.1.1+incompatible // indirect
43+
github.com/docker/docker v28.0.0+incompatible // indirect
4444
github.com/docker/docker-credential-helpers v0.8.2 // indirect
4545
github.com/docker/go-connections v0.5.0 // indirect
4646
github.com/docker/go-units v0.5.0 // indirect
@@ -97,7 +97,7 @@ require (
9797
github.com/sirupsen/logrus v1.9.3 // indirect
9898
github.com/spf13/pflag v1.0.5 // indirect
9999
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 // indirect
100-
github.com/ulikunitz/xz v0.5.12 // indirect
100+
github.com/ulikunitz/xz v0.5.15 // indirect
101101
github.com/vbatts/tar-split v0.11.5 // indirect
102102
github.com/vmware/govmomi v0.23.1 // indirect
103103
go.opencensus.io v0.24.0 // indirect

‎images/dvcr-artifact/go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -65,8 +65,8 @@ github.com/docker/cli v27.1.1+incompatible h1:goaZxOqs4QKxznZjjBWKONQci/MywhtRv2
6565
github.com/docker/cli v27.1.1+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
6666
github.com/docker/distribution v2.8.3+incompatible h1:AtKxIZ36LoNK51+Z6RpzLpddBirtxJnzDrHLEKxTAYk=
6767
github.com/docker/distribution v2.8.3+incompatible/go.mod h1:J2gT2udsDAN96Uj4KfcMRqY0/ypR+oyYUYmja8H+y+w=
68-
github.com/docker/docker v27.1.1+incompatible h1:hO/M4MtV36kzKldqnA37IWhebRA+LnqqcqDja6kVaKY=
69-
github.com/docker/docker v27.1.1+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
68+
github.com/docker/docker v28.0.0+incompatible h1:Olh0KS820sJ7nPsBKChVhk5pzqcwDR15fumfAd/p9hM=
69+
github.com/docker/docker v28.0.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
7070
github.com/docker/docker-credential-helpers v0.8.2 h1:bX3YxiGzFP5sOXWc3bTPEXdEaZSeVMrFgOr3T+zrFAo=
7171
github.com/docker/docker-credential-helpers v0.8.2/go.mod h1:P3ci7E3lwkZg6XiHdRKft1KckHiO9a2rNtyFbZ/ry9M=
7272
github.com/docker/go-connections v0.5.0 h1:USnMq7hx7gwdVZq1L49hLXaFtUdTADjXGp+uj1Br63c=
@@ -390,8 +390,8 @@ github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsT
390390
github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
391391
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
392392
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635/go.mod h1:hkRG7XYTFWNJGYcbNJQlaLq0fg1yr4J4t/NcTQtrfww=
393-
github.com/ulikunitz/xz v0.5.12 h1:37Nm15o69RwBkXM0J6A5OlE67RZTfzUxTj8fB3dfcsc=
394-
github.com/ulikunitz/xz v0.5.12/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
393+
github.com/ulikunitz/xz v0.5.15 h1:9DNdB5s+SgV3bQ2ApL10xRc35ck0DuIX/isZvIk+ubY=
394+
github.com/ulikunitz/xz v0.5.15/go.mod h1:nbz6k7qbPmH4IRqmfOplQw/tblSgqTqBwxkY0oWt/14=
395395
github.com/vbatts/tar-split v0.11.5 h1:3bHCTIheBm1qFTcgh9oPu+nNBtX+XJIupG/vacinCts=
396396
github.com/vbatts/tar-split v0.11.5/go.mod h1:yZbwRsSeGjusneWgA781EKej9HF8vme8okylkAeNKLk=
397397
github.com/vmware/govmomi v0.23.1 h1:vU09hxnNR/I7e+4zCJvW+5vHu5dO64Aoe2Lw7Yi/KRg=

‎images/virt-artifact/werf.inc.yaml‎

Lines changed: 7 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,11 @@
11
---
22
# Source https://github.com/kubevirt/kubevirt/blob/v1.3.1/hack/dockerized#L15
33
{{- $gitRepoName := "3p-kubevirt" }}
4+
{{- $gitRepoUrl := (printf "%s/%s" "deckhouse" $gitRepoName) }}
45
{{- $tag := get $.Core $gitRepoName }}
56
{{- $version := (split "-" $tag)._0 }}
67

8+
79
---
810
image: {{ .ModuleNamePrefix }}{{ .ImageName }}-src-artifact
911
final: false
@@ -13,7 +15,11 @@ secrets:
1315
value: {{ $.SOURCE_REPO }}
1416
shell:
1517
install:
16-
- git clone --depth=1 $(cat /run/secrets/SOURCE_REPO)/deckhouse/3p-kubevirt --branch {{ $tag }} /src/kubevirt
18+
- |
19+
echo "Git clone {{ $gitRepoName }} repository..."
20+
git clone --depth=1 $(cat /run/secrets/SOURCE_REPO)/{{ $gitRepoUrl }} --branch {{ $tag }} /src/kubevirt
21+
22+
rm -rf /src/kubevirt/.git
1723
1824
---
1925

@@ -79,30 +85,8 @@ shell:
7985
export GOPROXY=$(cat /run/secrets/GOPROXY)
8086
mkdir -p ~/.ssh && echo "StrictHostKeyChecking accept-new" > ~/.ssh/config
8187
cd /kubevirt
82-
go mod download
83-
go get github.com/opencontainers/[email protected]
84-
go get github.com/containers/[email protected]
8588
86-
- |
87-
echo Download Go modules.
8889
go mod download
89-
90-
echo Update modules to mitigate CVEs...
91-
go get github.com/opencontainers/[email protected]
92-
go get github.com/containers/[email protected]
93-
94-
go get github.com/go-openapi/[email protected]
95-
go get github.com/onsi/gomega/matchers/support/goraph/[email protected]
96-
go get github.com/cilium/ebpf/[email protected]
97-
go get github.com/cilium/ebpf/[email protected]
98-
99-
# CVE-2024-45337,CVE-2025-22869
100-
go get golang.org/x/[email protected]
101-
# CVE-2025-22870, CVE-2025-22872
102-
go get golang.org/x/[email protected]
103-
# CVE-2025-22868
104-
go get golang.org/x/[email protected]
105-
10690
go mod vendor
10791
10892
setup:

‎images/virtualization-artifact/go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -67,7 +67,7 @@ require (
6767
github.com/coreos/go-semver v0.3.1 // indirect
6868
github.com/coreos/go-systemd/v22 v22.5.0 // indirect
6969
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
70-
github.com/docker/docker v25.0.6+incompatible // indirect
70+
github.com/docker/docker v28.0.0+incompatible // indirect
7171
github.com/docker/docker-credential-helpers v0.8.0 // indirect
7272
github.com/emicklei/go-restful/v3 v3.11.0 // indirect
7373
github.com/evanphx/json-patch v5.6.0+incompatible // indirect
@@ -155,7 +155,7 @@ replace (
155155
k8s.io/client-go => k8s.io/client-go v0.33.3
156156
k8s.io/component-base => k8s.io/component-base v0.33.3
157157
k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20250701173324-9bd5c66d9911
158-
kubevirt.io/api => github.com/deckhouse/3p-kubevirt/staging/src/kubevirt.io/api v1.3.1-v12n.16
158+
kubevirt.io/api => github.com/deckhouse/3p-kubevirt/staging/src/kubevirt.io/api v1.3.1-v12n.17
159159
)
160160

161161
// CVE Replaces

‎images/virtualization-artifact/go.sum‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -45,16 +45,16 @@ github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSs
4545
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
4646
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
4747
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
48-
github.com/deckhouse/3p-kubevirt/staging/src/kubevirt.io/api v1.3.1-v12n.16 h1:r3aUFmNrUMZmss4eCK/5hLMdZfbAA7a2N3W4HzeTx8k=
49-
github.com/deckhouse/3p-kubevirt/staging/src/kubevirt.io/api v1.3.1-v12n.16/go.mod h1:tCn7VAZktEvymk490iPSMPCmKM9UjbbfH2OsFR/IOLU=
48+
github.com/deckhouse/3p-kubevirt/staging/src/kubevirt.io/api v1.3.1-v12n.17 h1:IQPK5oGRSONOKPH8TIuDq7vCjbFTj0NEWQzo6ZBD7uY=
49+
github.com/deckhouse/3p-kubevirt/staging/src/kubevirt.io/api v1.3.1-v12n.17/go.mod h1:tCn7VAZktEvymk490iPSMPCmKM9UjbbfH2OsFR/IOLU=
5050
github.com/deckhouse/deckhouse/pkg/log v0.0.0-20250226105106-176cd3afcdd5 h1:PsN1E0oxC/+4zdA977txrqUCuObFL3HAuu5Xnud8m8c=
5151
github.com/deckhouse/deckhouse/pkg/log v0.0.0-20250226105106-176cd3afcdd5/go.mod h1:Mk5HRzkc5pIcDIZ2JJ6DPuuqnwhXVkb3you8M8Mg+4w=
5252
github.com/distribution/reference v0.5.0 h1:/FUIFXtfc/x2gpa5/VGfiGLuOIdYa1t65IKK2OFGvA0=
5353
github.com/distribution/reference v0.5.0/go.mod h1:BbU0aIcezP1/5jX/8MP0YiH4SdvB5Y4f/wlDRiLyi3E=
5454
github.com/docker/cli v23.0.5+incompatible h1:ufWmAOuD3Vmr7JP2G5K3cyuNC4YZWiAsuDEvFVVDafE=
5555
github.com/docker/cli v23.0.5+incompatible/go.mod h1:JLrzqnKDaYBop7H2jaqPtU4hHvMKP+vjCwu2uszcLI8=
56-
github.com/docker/docker v25.0.6+incompatible h1:5cPwbwriIcsua2REJe8HqQV+6WlWc1byg2QSXzBxBGg=
57-
github.com/docker/docker v25.0.6+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
56+
github.com/docker/docker v28.0.0+incompatible h1:Olh0KS820sJ7nPsBKChVhk5pzqcwDR15fumfAd/p9hM=
57+
github.com/docker/docker v28.0.0+incompatible/go.mod h1:eEKB0N0r5NX/I1kEveEz05bcu8tLC/8azJZsviup8Sk=
5858
github.com/docker/docker-credential-helpers v0.8.0 h1:YQFtbBQb4VrpoPxhFuzEBPQ9E16qz5SpHLS+uswaCp8=
5959
github.com/docker/docker-credential-helpers v0.8.0/go.mod h1:UGFXcuoQ5TxPiB54nHOZ32AWRqQdECoh/Mg0AlEYb40=
6060
github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815/go.mod h1:WwZ+bS3ebgob9U8Nd0kOddGdZWjyMGR8Wziv+TBNwSE=

0 commit comments

Comments
 (0)