From 9ca26075e5c27f5d6718493fd0e34ba1e4b70f82 Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Fri, 17 Jul 2026 08:51:33 +0530 Subject: [PATCH 1/3] security: Go 1.26.5 builder + apt upgrade the release stage (15 CVEs) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Trivy on ghcr.io/nudgebee/forager:main-cca8173 shows 2 CRITICAL / 4 HIGH / 9 MEDIUM fixable: - 13 are stale debian packages in the pinned bookworm-slim release stage (libgnutls30 x11 incl. the 2 CRITICALs, libgcrypt20, liblzma5) — the digest snapshot drifts behind bookworm security releases and nothing re-upgraded it. Add apt-get upgrade behind a committed OS_PKG_EPOCH cache-bust (same pattern as the nudgebee service images). - 2 are the Go 1.26.4 stdlib pair (CVE-2026-39822 HIGH os.Root symlink traversal / CVE-2026-42505 crypto/tls ECH) in the forager binary. Pin the builder to golang:1.26.5-bookworm (digest) with GOTOOLCHAIN=local. Residual after this is the bookworm NOFIX floor only (no upstream fix published; shrinks via the same upgrade on rebuilds as debian publishes). --- Dockerfile | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/Dockerfile b/Dockerfile index f86071a..7188103 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,4 +1,8 @@ -FROM golang:1.26-bookworm@sha256:5d2b868674b57c9e48cdd39e891acce4196b6926ca6d11e9c270a8f85106203d AS build-stage +# golang 1.26.5: fixes the Go stdlib pair CVE-2026-39822 (HIGH, os.Root symlink +# traversal) / CVE-2026-42505 (crypto/tls ECH) that 1.26.4 builds carry. +FROM golang:1.26.5-bookworm@sha256:1ecb7edf62a0408027bd5729dfd6b1b8766e578e8df93995b225dfd0944eb651 AS build-stage +# Always compile with the base image's Go, never an auto-downloaded toolchain. +ENV GOTOOLCHAIN=local WORKDIR /app @@ -38,7 +42,15 @@ RUN chmod +x /app/nudgebee-forager FROM debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f2068983107a6f6c21eeb AS release-stage -RUN apt-get update && apt-get install -y --no-install-recommends \ +# apt-get upgrade patches the base packages to the latest bookworm security +# releases — the pinned digest snapshot drifts behind (Trivy flagged 13 fixable +# C/H/M: libgnutls30 incl. 2 CRITICAL, libgcrypt20, liblzma5). +# OS-package cache-bust: bumping OS_PKG_EPOCH (ISO week) changes this layer's +# cache key so a registry/build cache can't serve a stale package layer; bump it +# when a scan flags a stale package. +ARG OS_PKG_EPOCH=2026-W29 +RUN echo "os-pkg-epoch: ${OS_PKG_EPOCH}" && \ + apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \ ca-certificates libaio1 && \ rm -rf /var/lib/apt/lists/* From 06c7ef98533b841a9bcbf00254aeb09d8a8b36ed Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Fri, 17 Jul 2026 09:02:48 +0530 Subject: [PATCH 2/3] chore: DEBIAN_FRONTEND=noninteractive + apt-get clean in release stage (review) --- Dockerfile | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/Dockerfile b/Dockerfile index 7188103..abb6c03 100644 --- a/Dockerfile +++ b/Dockerfile @@ -48,10 +48,15 @@ FROM debian:bookworm-slim@sha256:0104b334637a5f19aa9c983a91b54c89887c0984081f206 # OS-package cache-bust: bumping OS_PKG_EPOCH (ISO week) changes this layer's # cache key so a registry/build cache can't serve a stale package layer; bump it # when a scan flags a stale package. +# DEBIAN_FRONTEND=noninteractive keeps upgraded packages from opening debconf +# prompts and hanging the non-TTY CI build; scoped via `export` so it does not +# persist into the image. ARG OS_PKG_EPOCH=2026-W29 RUN echo "os-pkg-epoch: ${OS_PKG_EPOCH}" && \ + export DEBIAN_FRONTEND=noninteractive && \ apt-get update && apt-get upgrade -y && apt-get install -y --no-install-recommends \ ca-certificates libaio1 && \ + apt-get clean && \ rm -rf /var/lib/apt/lists/* WORKDIR /app From 99c89be7f5ece5bb5dc909f097d1fb61c0efa64d Mon Sep 17 00:00:00 2001 From: mayankpande88 Date: Fri, 17 Jul 2026 09:58:43 +0530 Subject: [PATCH 3/3] security: go directive 1.25.11 -> 1.25.12 (govulncheck toolchain) CI's vuln job resolves its Go toolchain from go.mod (setup-go go-version-file), so govulncheck was analyzing with the 1.25.11 stdlib and flagging the crypto/tls CVE fixed in 1.25.12. The Docker builder already compiles with 1.26.5; this aligns the analysis toolchain onto a patched stdlib as well. --- go.mod | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/go.mod b/go.mod index bce68c9..16c74f3 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module nudgebee/forager -go 1.25.11 +go 1.25.12 require ( cloud.google.com/go/auth v0.20.0