Skip to content

Commit 4581db6

Browse files
authored
[backport v1.6] fix: bumping Go version to 1.24.13 (#4342)
fix: backport Go 1.24.13 CVE fix and signed pipeline to release/v1.6 Cherry-picked from commit 2fb956f (PR #4289) with adaptations for v1.6: CVE Fix (Go 1.24.13): - azure-ipam/Dockerfile: Go 1.23.2 → 1.24.13 (cbl-mariner2.0) - cni/Dockerfile: Go 1.23 → 1.24.13 (cbl-mariner2.0) - cns/Dockerfile: Go 1.23 → 1.24.13 (cbl-mariner2.0) - bpf-prog/ipv6-hp-bpf/linux.Dockerfile: Go 1.23.2 → 1.24.13 (Debian) - build/images.mk: GO_IMG tag 1.23 → 1.24 Signed Binary Pipeline: - binary.steps.yaml: Replace GoTool@0 with install-go.sh - images.jobs.yaml: Add install-crane.sh + install-go.sh tasks - install-crane.sh: New script to install crane for image extraction - install-go.sh: New script to extract Go from msft-go container (Uses cbl-mariner2.0 SHA: b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2) CVE Impact: - Fixes 5 stdlib CVEs including CRITICAL CVE-2025-68121 (crypto/tls) Note: v1.6 uses direct Dockerfiles (no template system), so cni/cns Dockerfiles were updated directly instead of via .tmpl files.
1 parent 902f2f6 commit 4581db6

9 files changed

Lines changed: 103 additions & 23 deletions

File tree

.pipelines/build/binary.steps.yaml

Lines changed: 12 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -10,34 +10,37 @@ parameters:
1010

1111

1212
steps:
13-
- task: GoTool@0
13+
- task: ShellScript@2
14+
displayName: "Install msft-go"
1415
inputs:
15-
version: '$(GOVERSION)'
16+
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-go.sh
17+
env:
18+
name: $(name)
1619

1720
- bash: |
1821
# Ubuntu
1922
if [[ -f /etc/debian_version ]];then
2023
sudo apt-get update -y
2124
if [[ $GOARCH =~ amd64 ]]; then
2225
sudo apt-get install -y llvm clang linux-libc-dev linux-headers-generic libbpf-dev libc6-dev nftables iproute2 gcc-multilib tree
23-
for dir in /usr/include/x86_64-linux-gnu/*; do
24-
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
26+
for dir in /usr/include/x86_64-linux-gnu/*; do
27+
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
2528
done
26-
29+
2730
elif [[ $GOARCH =~ arm64 ]]; then
2831
sudo apt-get install -y llvm clang linux-libc-dev linux-headers-generic libbpf-dev libc6-dev nftables iproute2 gcc-aarch64-linux-gnu tree
29-
for dir in /usr/include/aarch64-linux-gnu/*; do
32+
for dir in /usr/include/aarch64-linux-gnu/*; do
3033
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
3134
done
3235
fi
3336
# Mariner
3437
else
3538
sudo tdnf install -y llvm clang libbpf-devel nftables tree
36-
for dir in /usr/include/aarch64-linux-gnu/*; do
39+
for dir in /usr/include/aarch64-linux-gnu/*; do
3740
if [[ -d $dir ]]; then
38-
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
41+
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
3942
elif [[ -f "$dir" ]]; then
40-
sudo ln -Tsfn "$dir" /usr/include/$(basename "$dir")
43+
sudo ln -Tsfn "$dir" /usr/include/$(basename "$dir")
4144
fi
4245
done
4346
fi

.pipelines/build/images.jobs.yaml

Lines changed: 13 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -49,9 +49,17 @@ jobs:
4949
targetPath: $(REPO_ROOT)
5050
artifact: '${{ job_data.templateContext.repositoryArtifact }}'
5151

52-
- task: GoTool@0
52+
- task: ShellScript@2
53+
displayName: "Install crane"
54+
inputs:
55+
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-crane.sh
56+
57+
- task: ShellScript@2
58+
displayName: "Install msft-go"
5359
inputs:
54-
version: '$(GOVERSION)'
60+
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-go.sh
61+
env:
62+
name: $(name)
5563

5664
- task: ShellScript@2
5765
inputs:
@@ -76,15 +84,15 @@ jobs:
7684
- task: ShellScript@2
7785
displayName: "Package with DropGZ"
7886
condition: and(
79-
succeeded(),
87+
succeeded(),
8088
eq(variables.packageWithDropGZ, 'True'))
8189
inputs:
8290
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/dropgz.sh
8391

8492
- ${{ if not(contains(job_data.job, 'linux')) }}:
8593
- task: onebranch.pipeline.signing@1
8694
condition: and(
87-
succeeded(),
95+
succeeded(),
8896
eq(variables.packageWithDropGZ, 'True'))
8997
inputs:
9098
command: 'sign'
@@ -94,7 +102,7 @@ jobs:
94102

95103
# OneBranch artifacts are stored on a Windows machine which obliterates
96104
# Linux file permissions.
97-
# This task is added (along with ob_extract_root_artifact in jobs that
105+
# This task is added (along with ob_extract_root_artifact in jobs that
98106
# download the artifact) to protect those file permissions from changing
99107
# during image build time.
100108
#
Lines changed: 13 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,13 @@
1+
#!/bin/bash
2+
set -eux
3+
4+
# Install crane (google/go-containerregistry) for daemonless container image extraction.
5+
# crane can pull and export image filesystems without a Docker daemon.
6+
# Go is pre-installed in the build container, so we use go install.
7+
# Rely on go install for supply chain security and reproducibility
8+
if ! command -v crane &> /dev/null; then
9+
go install github.com/google/go-containerregistry/cmd/crane@v0.21.3
10+
sudo mv "$(go env GOPATH)/bin/crane" /usr/local/bin/crane
11+
fi
12+
13+
crane version
Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
#!/bin/bash
2+
set -euxo pipefail
3+
4+
# Install Go by extracting it from the msft-go container image.
5+
# The golang image reference is read directly from the source Dockerfile for the
6+
# current image (identified by $name), keeping the pipeline in sync with the build.
7+
#
8+
# Priority:
9+
# 1. MSFT_GO_IMAGE env var (explicit override)
10+
# 2. Parsed from the source Dockerfile for $name
11+
# 3. Hardcoded fallback digest below
12+
#
13+
# To update the fallback, run:
14+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0 --format "{{.Name}}@{{.Digest}}"
15+
DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang@sha256:b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2"
16+
17+
# Resolves the golang image from the source Dockerfile for the given $name.
18+
# Echoes the image reference, or empty string if it cannot be determined.
19+
resolve_go_image() {
20+
if [[ "${name:-}" == "npm" ]]; then
21+
# npm uses OS-specific Dockerfiles with a tag-based reference.
22+
# The image may be field 2 (no --platform) or field 3 (with --platform),
23+
# so extract the mcr.* token directly.
24+
# e.g. FROM mcr.../golang:1.25.5 AS builder
25+
# e.g. FROM --platform=linux/amd64 mcr.../golang:1.25.5 AS builder
26+
local buildfile="${REPO_ROOT}/npm/${OS:-linux}.Dockerfile"
27+
grep -m1 '^FROM.*golang' "${buildfile}" 2>/dev/null | grep -o 'mcr[^ ]*' || true
28+
29+
else
30+
# All other images use a digest-pinned reference and always have --platform,
31+
# making the image consistently field 3: FROM --platform=X IMAGE AS alias
32+
local buildfile
33+
if [[ "${name:-}" == "ipv6-hp-bpf" ]]; then
34+
buildfile="${REPO_ROOT}/bpf-prog/ipv6-hp-bpf/linux.Dockerfile"
35+
elif [[ -n "${name:-}" ]]; then
36+
buildfile="${REPO_ROOT}/${name}/Dockerfile"
37+
fi
38+
39+
if [[ -n "${buildfile:-}" && -f "${buildfile}" ]]; then
40+
grep -m1 '^FROM.*golang' "${buildfile}" | awk '{print $3}' || true
41+
fi
42+
fi
43+
}
44+
45+
if [[ -z "${MSFT_GO_IMAGE:-}" ]]; then
46+
MSFT_GO_IMAGE="$(resolve_go_image)"
47+
MSFT_GO_IMAGE="${MSFT_GO_IMAGE:-$DEFAULT_IMAGE}"
48+
fi
49+
50+
ARCH="${ARCH:-amd64}"
51+
52+
# Extract /usr/local/go from the image without needing a Docker daemon.
53+
# crane export streams the full image filesystem; we extract just usr/local/go.
54+
crane export --platform "linux/${ARCH}" "$MSFT_GO_IMAGE" - | sudo tar -xf - -C / usr/local/go
55+
56+
echo "##vso[task.prependpath]/usr/local/go/bin"

azure-ipam/Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -3,8 +3,8 @@ ARG DROPGZ_VERSION=v0.0.12
33
ARG OS_VERSION
44
ARG OS
55

6-
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.23.2-cbl-mariner2.0 --format "{{.Name}}@{{.Digest}}"
7-
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:f8613198423d5cb702961f1547f9cb061f8da1c6ca9ce8da4824eb47db663cd7 AS go
6+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0 --format "{{.Name}}@{{.Digest}}"
7+
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2 AS go
88

99
# skopeo inspect docker://mcr.microsoft.com/cbl-mariner/base/core:2.0 --format "{{.Name}}@{{.Digest}}"
1010
FROM --platform=linux/${ARCH} mcr.microsoft.com/cbl-mariner/base/core@sha256:a490e0b0869dc570ae29782c2bc17643aaaad1be102aca83ce0b96e0d0d2d328 AS mariner-core

bpf-prog/ipv6-hp-bpf/linux.Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
ARG ARCH
2-
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.23.2 --format "{{.Name}}@{{.Digest}}"
3-
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:86c5b00bbed2a6e7157052d78bf4b45c0bf26545ed6e8fd7dbad51ac9415f534 AS builder
2+
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24 --format "{{.Name}}@{{.Digest}}"
3+
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:f3e556c9de4dd93be774dc0fa2ce3cfa76f7744d0bacada92d1624f04ce69461 AS builder
44
ARG VERSION
55
ARG DEBUG
66
ARG OS

build/images.mk

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
# Source images
2-
export GO_IMG ?= mcr.microsoft.com/oss/go/microsoft/golang:1.23-cbl-mariner2.0
2+
export GO_IMG ?= mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0
33
export MARINER_CORE_IMG ?= mcr.microsoft.com/cbl-mariner/base/core:2.0
44
export MARINER_DISTROLESS_IMG ?= mcr.microsoft.com/cbl-mariner/distroless/minimal:2.0
55
export WIN_HPC_IMG ?= mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0

cni/Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -5,8 +5,8 @@ ARG DROPGZ_VERSION=v0.0.12
55
ARG OS_VERSION
66
ARG OS
77

8-
# mcr.microsoft.com/oss/go/microsoft/golang:1.23-cbl-mariner2.0
9-
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:1d8a3fc8df13298bab0d6ea34f49ded3641fd60985c7968518717e965edaef99 AS go
8+
# mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0
9+
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2 AS go
1010

1111
# mcr.microsoft.com/cbl-mariner/base/core:2.0
1212
FROM --platform=linux/${ARCH} mcr.microsoft.com/cbl-mariner/base/core@sha256:61b8c8e5c769784be2137cba8612c3a0f0c1752a66276b3b1b5306014a1e20e0 AS mariner-core

cns/Dockerfile

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@ ARG ARCH
44
ARG OS_VERSION
55
ARG OS
66

7-
# mcr.microsoft.com/oss/go/microsoft/golang:1.23-cbl-mariner2.0
8-
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:1d8a3fc8df13298bab0d6ea34f49ded3641fd60985c7968518717e965edaef99 AS go
7+
# mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0
8+
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2 AS go
99

1010
# mcr.microsoft.com/cbl-mariner/base/core:2.0
1111
FROM mcr.microsoft.com/cbl-mariner/base/core@sha256:61b8c8e5c769784be2137cba8612c3a0f0c1752a66276b3b1b5306014a1e20e0 AS mariner-core

0 commit comments

Comments
 (0)