This repository has been archived by the owner on Mar 16, 2024. It is now read-only.
Update module github.com/moby/buildkit to v0.11.4 [SECURITY] - abandoned #1331
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
![renovate[bot]](https://avatars.githubusercontent.com/in/2740?s=60&v=4){kind=small}
⚠ Artifact update problemRenovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is. ♻ Renovate will retry this branch, including artifacts, only when one of the following happens:
The artifact failure details are included below: File name: go.sum |
Deploying with
|
| Latest commit: |
3812f71
|
| Status: | ✅ Deploy successful! |
| Preview URL: | https://df89bae4.acorn.pages.dev |
| Branch Preview URL: | https://renovate-go-github-com-moby.acorn.pages.dev |
jacobdonenfeld
force-pushed
the
renovate/go-github.com/moby/buildkit-vulnerability
branch
from
3f057fd
to
f6fbbde
Compare
Edited/Blocked NotificationRenovate will not automatically rebase this PR, because it does not recognize the last commit author and assumes somebody else may have edited the PR. You can manually request rebase by checking the rebase/retry box above. ⚠ Warning: custom changes will be lost. |
Signed-off-by: jacobdonenfeld <[email protected]>
jacobdonenfeld
force-pushed
the
renovate/go-github.com/moby/buildkit-vulnerability
branch
from
f6fbbde
to
3812f71
Compare
|
Ran go mod tidy and pushed a new commit to get other tests to pass |
renovate
bot
changed the title
Autoclosing SkippedThis PR has been flagged for autoclosing. However, it is being skipped due to the branch being already modified. Please close/delete it manually or report a bug if you think this is in error. |
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This PR contains the following updates:
v0.10.6->v0.11.4⚠ Dependency Lookup Warnings ⚠
Warnings were logged while processing this repo. Please check the Dependency Dashboard for more information.
GitHub Vulnerability Alerts
CVE-2023-26054
When the user sends a build request that contains a Git URL that contains credentials and the build creates a provenance attestation describing that build, these credentials could be visible from the provenance attestation.
Git URL can be passed in two ways:
Equivalent in
docker buildxwould be.git/configfile.Thanks to Oscar Alberto Tovar for discovering the issue.
Impact
When a build is performed under specific conditions where credentials were passed to BuildKit they may be visible to everyone who has access to provenance attestation.
Provenance attestations and VCS info hints were added in version v0.11.0. Previous versions are not vulnerable.
In v0.10, when building directly from Git URL, the same URL could be visible in
BuildInfostructure that is a predecessor of Provenance attestations. Previous versions are not vulnerable.Note: Docker Build-push Github action builds from Git URLs by default but is not affected by this issue even when working with private repositories because the credentials are passed with build secrets and not with URLs.
Patches
Bug is fixed in v0.11.4 .
Workarounds
It is recommended to pass credentials with build secrets when building directly from Git URL as a more secure alternative than modifying the URL.
In Docker Buildx, VCS info hint can be disabled by setting
BUILDX_GIT_INFO=0.buildctldoes not set VCS hints based on.gitdirectory, and values would need to be passed manually with--opt.References
Release Notes
moby/buildkit
v0.11.4Compare Source
https://hub.docker.com/r/moby/buildkit
Notable changes:
This release contains two security fixes.
Fix the issue where credentials inlined to Git URLs could end up in provenance attestation GHSA-gc89-7gcr-jxqc
Containerd has been updated to 1.6.18 , fixing issue with supplementary groups not being set up properly GHSA-hmfx-3pcx-653p #3651
Other updates
v0.11.3Compare Source
Welcome to the 0.11.3 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Notable Changes
SOURCE_DATE_EPOCH#3559Dependency Changes
1709cfe-> v1.6.16Previous release can be found at v0.11.2
v0.11.2Compare Source
Welcome to the 0.11.2 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Notable changes
Dependency Changes
1709cfePrevious release can be found at v0.11.1
v0.11.1Compare Source
Welcome to the 0.11.1 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Notable changes
v0.11.0Compare Source
Welcome to the 0.11.0 release of buildkit!
Please try out the release binaries and report any issues at
https://github.com/moby/buildkit/issues.
Notable Changes
Builtin Dockerfile frontend has been updated to v1.5.0 https://github.com/moby/buildkit/releases/tag/dockerfile%2F1.5.0
BuildKit and compatible frontends can now produce SBOM (Software Bill of Materials) attestations for the build results to show the dependencies of the build. These attestations can be added to images and locally exported files. Using Dockerfiles, SBOM information can be configured to be produced also based on files in intermediate build stages or build context, or run processes that manually define the SBOM dependencies. When exporting an image, layer mapping is also produced that allows tracing a SBOM package to a specific build step. #3258 #3290 #3249 #2983 #3358 #3312 #3407 #3408 #3410 #3414 #3422 Read documentation
BuildKit can now produce a Provenance attestation for the build result in SLSA format. Provenance attestations describe how a build was produced, and what sources/parameters were used. In addition to fields part of the SLSA specification, Buildkit's provenance also exports BuildKit-specific metadata like LLB steps with their source- and layer mapping. Provenance attestation will capture all the build sources visible to BuildKit, for example, not only the Git repository where the project's source is coming from but also the digests of all the container images used during the build. #3240 #3428 #3428 #3462 Read documentation
BuildKit now supports reproducible builds by setting
SOURCE_DATE_EPOCHbuild argument orsource-date-epochexporter attribute. This deterministic date will be used in image metadata instead of the current time. #2918 #3262 #3152 Read documentationOCI annotations can now be set to build results exported as images or OCI layouts. Annotations can be set on both image manifests and indexes, as well as descriptors to them. #3283 #3061 #2975 #2879 Read documentation
New Build History API allows listening to events about builds starting and completing, and streaming progress of active builds. New commands
buildctl debug monitor,buildctl debug logsandbuildctl debug gethave been added to use this API. Build records also keep OpenTelemetry traces, provenance attestations, and image manifests if they were created by the build. #3294 #3339 #3440Build results exported with image, local or tar exporters now support attestations. In addition to builtin SBOM and Provenance attestations, frontends can produce custom attestations in in-toto format #3197 #3070 #3129 #3073 #3063 #2935 #3289 #3389 #3321 #3342 #3461 Read documentation
New Source type
oci-layout://allows builds to import images from OCI directory structure on the client side. This allows using local versions of the image. #3112 #3300 #3122 #3034 #2971 #2827 #3397Build requests now support sending a Source policy definition. A policy can be used to deny access to specific sources (e.g. images or URLs) or only allow access to specific image namespaces. Policies can also be used to modify sources when they are requested by the build, for example, pin a tag requested by the build to a specific digest even if it has already changed in the registry. #3332
New remote cache backend: Azure Blob Storage #3010
New remote cache backend: S3 #2824 #3065
BuildKit now supports Nydus compression type #2581
OCI exporter now supports attribute
tar=falseto export OCI layout into a directory instead of downloading a tarball. #3162Setting multiple cache exporters for a single build is now supported #3024 #3271
Cache exporters can now be configured to ignore exporting errors #3430
Remote cache import/export to client-side local files now supports tag parameter for scoping cache #3111
CNI network namespaces are now provisioned from a pool for increased performance #3107
New Info service has been added to control API for asking BuildKit daemon's version #2725
Gateway API now has a new
Evaluatemethod to control the lazy solve behavior #3137Allow mounting secrets with empty contents #3081
New RemoveMountStubsRecursive option has been added to LLB ExecOp to control the cleanup behavior of mounts. By default, empty mount stubs are now cleaned up recursively in new frontends. #3314
LLB Image source now allows pulling partial layer chains from image #2795
Allow hostname to be set by network provider (K8S_POD_NAME) #3044
Improve handling and logging of API health checks #2998
RegistryToken auth from Docker config is now allowed as authentication input #2868
Image exporter with containerd worker now allows skipping adding image to containerd image store with
store=false. If not set then images stored images are now guaranteed to be unlazied and unpacked. #2800buildctlnow loads Github runtime environment when using GHA remote cache #2707Support for
conflistwhen configuring CNI networking #3029Platform info has been added to the build result descriptor metadata #2993
Allow sourcemaps to link single LLB vertex to multiple source locations #2859
Support for SSH connection helper #2843
Empty stub paths created by mount points when build container runs are now cleaned up and do not remain in the final image. #3307 #3149
Improve performance on BoltDB commits #3261
Indentation of some of the image manifests has been fixed to use double spaces #3259
Fix caching checksum error on copying files with custom UID/GID #3295
Fix cases where copy operation left behind nondeterministic timestamps for better support for reproducible builds #3298
Fix SSH forwarding incompatibility with OpenSSH >= 8.9 #3274
Stargz has been updated to v0.13.0 #3280
Embedded QEMU emulators have been updated to v7.1.0 with new patches for path handling. #3386
Fix unpacking images with no layers #3251
Fix possible nil pointer exception in LLB bridge #3233 #3169 #3066
Fix cleanup of containerd tasks if a start fails #3253
Fix handling Windows paths in content checksums #3227
Fix possible missing newline in progress output #3072
Fix possible early EOF on SSH forwarding #3431
Fix possible panic in concurrent OpenTelemetry access #3058
Previously deprecated old cache options have been removed #2982
Daemonless script has been updated to handle already stopped process #3005
Fix closing session if shared by multiple clients #2995
buildctl ducommand now supports JSON formatting #2992Registry push errors now show additional context #2981
Improve default description of FileOp vertexes #2932
Make sure progress from exporting is properly keyed on parallel requests #2953
Terminal colors are now configurable #2954
Build errors now always print stacktraces to daemon logs in debug mode #2903
Contributors
Dependency Changes
5ff8fce-> v1.6.14d132b28-> v0.3.061404de-> v23.0.0-rc.1c5a74bc->02efb9a8907843newce105d0newd6f5855new9ed6126->fb433845770296-> v0.2.0fe4d628-> v0.4.0036812b-> v0.1.0da31bd3-> v0.3.01f47c86-> v0.1.03a66f56->7780775Previous release can be found at v0.10.6
Configuration
📅 Schedule: Branch creation - "" (UTC), Automerge - At any time (no schedule defined).
🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.
♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.
🔕 Ignore: Close this PR and you won't be reminded about this update again.
This PR has been generated by Mend Renovate. View repository job log here.