From 6b230e0844cbc559702476e60658078fe7af6176 Mon Sep 17 00:00:00 2001 From: Xore Date: Fri, 25 Sep 2026 12:53:26 +0200 Subject: [PATCH] fix(containers): repin golang:1.27-alpine to a live digest The pinned digest sha256:4c9fe6... no longer resolves in Docker Hub (HTTP 404), which surfaced in CI as an opaque 'failed to solve: lease ... not found' during the golang build stage. Repin the tag's current digest sha256:8a5910f3... across all 14 Dockerfiles that referenced the dead one. --- .../honeypot-cisco-asa-honeypot/cisco-asa-honeypot/Dockerfile | 2 +- arcane/home/honeypot-citrix-honeypot/citrix-honeypot/Dockerfile | 2 +- arcane/home/honeypot-dicompot/dicompot/Dockerfile | 2 +- arcane/home/honeypot-dionaea/tftp-relay/Dockerfile | 2 +- arcane/home/honeypot-dnp3/dnp3-honeypot/Dockerfile | 2 +- arcane/home/honeypot-dns-honeypot/dns-honeypot/Dockerfile | 2 +- arcane/home/honeypot-endlessh/endlessh-honeypot/Dockerfile | 2 +- arcane/home/honeypot-http/http-honeypot/Dockerfile | 2 +- arcane/home/honeypot-multipot/multipot/Dockerfile | 2 +- arcane/home/honeypot-rdp-honeypot/rdp-honeypot/Dockerfile | 2 +- .../honeypot-sonicwall-sma/sonicwall-sma-honeypot/Dockerfile | 2 +- arcane/home/honeypot-utilities/reporter/Dockerfile | 2 +- portbridge/Dockerfile | 2 +- vps/portbridge/Dockerfile | 2 +- 14 files changed, 14 insertions(+), 14 deletions(-) diff --git a/arcane/home/honeypot-cisco-asa-honeypot/cisco-asa-honeypot/Dockerfile b/arcane/home/honeypot-cisco-asa-honeypot/cisco-asa-honeypot/Dockerfile index 5c061cfca..3ea733344 100644 --- a/arcane/home/honeypot-cisco-asa-honeypot/cisco-asa-honeypot/Dockerfile +++ b/arcane/home/honeypot-cisco-asa-honeypot/cisco-asa-honeypot/Dockerfile @@ -1,7 +1,7 @@ # Cisco ASA WebVPN + IKE decoy (CVE-2018-0101), Go port of # t3chn0m4g3/ciscoasa_honeypot (#238, #414) -- see main.go/ike.go's own # doc comments for the real (not vendored-as-is) behavior this reproduces. -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go ./ diff --git a/arcane/home/honeypot-citrix-honeypot/citrix-honeypot/Dockerfile b/arcane/home/honeypot-citrix-honeypot/citrix-honeypot/Dockerfile index 570ed6e4f..ebe60174c 100644 --- a/arcane/home/honeypot-citrix-honeypot/citrix-honeypot/Dockerfile +++ b/arcane/home/honeypot-citrix-honeypot/citrix-honeypot/Dockerfile @@ -1,6 +1,6 @@ # Citrix ADC/NetScaler Gateway decoy (CVE-2019-19781), Go port of # t3chn0m4g3/CitrixHoneypot (#238, #414) -- see main.go's own doc comment. -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go ./ diff --git a/arcane/home/honeypot-dicompot/dicompot/Dockerfile b/arcane/home/honeypot-dicompot/dicompot/Dockerfile index 7aef50a18..947931404 100644 --- a/arcane/home/honeypot-dicompot/dicompot/Dockerfile +++ b/arcane/home/honeypot-dicompot/dicompot/Dockerfile @@ -20,7 +20,7 @@ # pin itself lives in go.mod/go.sum (committed, like every other Go # sensor's), not as a rebuild-time ARG -- that's what lets CI's `go test` # and `go build` run against the exact same resolved deps this image builds. -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod go.sum ./ RUN go mod download diff --git a/arcane/home/honeypot-dionaea/tftp-relay/Dockerfile b/arcane/home/honeypot-dionaea/tftp-relay/Dockerfile index 6f33406ff..4644634fb 100644 --- a/arcane/home/honeypot-dionaea/tftp-relay/Dockerfile +++ b/arcane/home/honeypot-dionaea/tftp-relay/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod main.go ./ RUN CGO_ENABLED=0 go build -trimpath -ldflags="-s -w" -o /tftp-relay . diff --git a/arcane/home/honeypot-dnp3/dnp3-honeypot/Dockerfile b/arcane/home/honeypot-dnp3/dnp3-honeypot/Dockerfile index 620984b60..f1c30eb1b 100644 --- a/arcane/home/honeypot-dnp3/dnp3-honeypot/Dockerfile +++ b/arcane/home/honeypot-dnp3/dnp3-honeypot/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go . diff --git a/arcane/home/honeypot-dns-honeypot/dns-honeypot/Dockerfile b/arcane/home/honeypot-dns-honeypot/dns-honeypot/Dockerfile index d96fb46a6..74877f80b 100644 --- a/arcane/home/honeypot-dns-honeypot/dns-honeypot/Dockerfile +++ b/arcane/home/honeypot-dns-honeypot/dns-honeypot/Dockerfile @@ -8,7 +8,7 @@ # length -- a UDP reflector that never returns more bytes than it received # cannot be an amplification vector, by definition, independent of any # particular request/response shape. -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go ./ diff --git a/arcane/home/honeypot-endlessh/endlessh-honeypot/Dockerfile b/arcane/home/honeypot-endlessh/endlessh-honeypot/Dockerfile index 81e7fa7d9..85082b138 100644 --- a/arcane/home/honeypot-endlessh/endlessh-honeypot/Dockerfile +++ b/arcane/home/honeypot-endlessh/endlessh-honeypot/Dockerfile @@ -1,4 +1,4 @@ -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go . diff --git a/arcane/home/honeypot-http/http-honeypot/Dockerfile b/arcane/home/honeypot-http/http-honeypot/Dockerfile index 562f41035..5007af675 100644 --- a/arcane/home/honeypot-http/http-honeypot/Dockerfile +++ b/arcane/home/honeypot-http/http-honeypot/Dockerfile @@ -1,5 +1,5 @@ # Static Go binary in a scratch image (~8 MB, no shell/libc). -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go . diff --git a/arcane/home/honeypot-multipot/multipot/Dockerfile b/arcane/home/honeypot-multipot/multipot/Dockerfile index 7607fb9c7..7e4a1f354 100644 --- a/arcane/home/honeypot-multipot/multipot/Dockerfile +++ b/arcane/home/honeypot-multipot/multipot/Dockerfile @@ -1,5 +1,5 @@ # Static Go binary in a scratch image (~8 MB, no shell/libc). -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go . diff --git a/arcane/home/honeypot-rdp-honeypot/rdp-honeypot/Dockerfile b/arcane/home/honeypot-rdp-honeypot/rdp-honeypot/Dockerfile index 4819b74d6..781b158ef 100644 --- a/arcane/home/honeypot-rdp-honeypot/rdp-honeypot/Dockerfile +++ b/arcane/home/honeypot-rdp-honeypot/rdp-honeypot/Dockerfile @@ -2,7 +2,7 @@ # #412) -- see main.go's own doc comment for why this is genuinely simple # despite RDP's reputation, and why that reverses #238's original "vendor, # don't port" call. -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go ./ diff --git a/arcane/home/honeypot-sonicwall-sma/sonicwall-sma-honeypot/Dockerfile b/arcane/home/honeypot-sonicwall-sma/sonicwall-sma-honeypot/Dockerfile index c47f89d22..3262bda83 100644 --- a/arcane/home/honeypot-sonicwall-sma/sonicwall-sma-honeypot/Dockerfile +++ b/arcane/home/honeypot-sonicwall-sma/sonicwall-sma-honeypot/Dockerfile @@ -1,6 +1,6 @@ # SonicWall SMA1000 Work Place/AMC decoy for the CVE-2026-83548/83549 # SSRF+RCE chain (#3033) -- see main.go's own doc comment. -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY *.go ./ diff --git a/arcane/home/honeypot-utilities/reporter/Dockerfile b/arcane/home/honeypot-utilities/reporter/Dockerfile index f9d5847d6..857cc30f5 100644 --- a/arcane/home/honeypot-utilities/reporter/Dockerfile +++ b/arcane/home/honeypot-utilities/reporter/Dockerfile @@ -1,7 +1,7 @@ # Static Go binary in a scratch image, same pattern as multipot/http-honeypot. # modernc.org/sqlite is pure Go (no cgo), so CGO_ENABLED=0 still holds despite # the SQLite dependency -- see dedup.go's import comment. -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod go.sum . RUN go mod download diff --git a/portbridge/Dockerfile b/portbridge/Dockerfile index 0c3e58223..fffb21fa3 100644 --- a/portbridge/Dockerfile +++ b/portbridge/Dockerfile @@ -1,5 +1,5 @@ # Static Go binary in a scratch image (~5 MB). -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . COPY main.go . diff --git a/vps/portbridge/Dockerfile b/vps/portbridge/Dockerfile index 2a78b5248..f21e10d4e 100644 --- a/vps/portbridge/Dockerfile +++ b/vps/portbridge/Dockerfile @@ -1,5 +1,5 @@ # Static Go binary in a scratch image (~5 MB). -FROM golang:1.27-alpine@sha256:4c9fe60190a2a3350ddc51de80d0224b8a6698d12bdfc999fee45ea9d6c46dbc AS build +FROM golang:1.27-alpine@sha256:8a5910f31396cd4d89662f56c68b3ae31d374308270a1c3bd96672ee5ed43414 AS build WORKDIR /src COPY go.mod . # Every non-test .go file, not a hand-maintained list. The enumerated form