Skip to content

Commit 9531b88

Browse files
cwayne18Copilot
cwayne18
and
Copilot
authored
Add go.mod CVE override mechanism to the Helm build (fix x/net CVEs) (#137)
* Add go.mod CVE override mechanism to Helm build Bring the declarative go.mod override mechanism (from rancher/image-build-base) into klipper-helm so we can pin CVE-affected transitive deps in the upstream Helm module even before Helm bumps them. klipper-helm builds Helm on upstream golang:alpine (not hardened-build-base), so this carries a local copy of scripts/go-mod-overrides.sh alongside a go-mod-overrides file, and runs it against the cloned Helm source before go build. Initial entry pins golang.org/x/net to v0.55.0 to remediate CVE-2026-33814 and CVE-2026-39821, which are unfixed in Helm v4.1.4 (x/net v0.49.0). Verified: go mod tidy and go build ./cmd/helm both pass with the override applied. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: cwayne18 <cwayne18@users.noreply.github.com> * Apply go.mod CVE overrides to helm plugins build The helm-set-status and helm-mapkubeapis plugins are built from their own upstream modules in the plugins stage and both compile in golang.org/x/net v0.49.0 (vulnerable to CVE-2026-33814 and CVE-2026-39821). Run the same go-mod-overrides.sh wrapper for each plugin so they pick up the tracked x/net@v0.55.0 pin, matching the helm binary build. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: cwayne18 <cwayne18@users.noreply.github.com> * Address review feedback - Trim go-mod-overrides header comment that duplicated the script docs - Copy overrides file once to /src and reference it from both build stages instead of writing to the filesystem root - Drop "Rancher images" wording from the script header Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Signed-off-by: cwayne18 <cwayne18@users.noreply.github.com> --------- Signed-off-by: cwayne18 <cwayne18@users.noreply.github.com> Co-authored-by: cwayne18 <cwayne18@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
1 parent de25159 commit 9531b88

3 files changed

Lines changed: 69 additions & 2 deletions

File tree

‎Dockerfile‎

Lines changed: 14 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,13 @@ ARG TARGETVARIANT
2020
ARG TARGETPLATFORM
2121
ARG HELM_VERSION
2222
COPY --from=helm-src /src/helm /src/helm
23+
# Apply tracked go.mod CVE overrides on top of the upstream Helm module before
24+
# building. See go-mod-overrides / scripts/go-mod-overrides.sh.
25+
COPY scripts/go-mod-overrides.sh /usr/local/bin/go-mod-overrides.sh
26+
COPY go-mod-overrides /src/go-mod-overrides
27+
RUN chmod +x /usr/local/bin/go-mod-overrides.sh && \
28+
cd /src/helm && \
29+
go-mod-overrides.sh /src/go-mod-overrides
2330
RUN case "${TARGETARCH}${TARGETVARIANT:+/${TARGETVARIANT}}" in \
2431
arm/v7|arm) export GOARCH="arm" GOARM="7" ;; \
2532
arm64) export GOARCH="arm64" ;; \
@@ -53,14 +60,19 @@ ARG HELM_VERSION
5360
COPY --from=helm /usr/bin/helm /usr/bin/helm
5461
RUN apk add -U --no-cache curl ca-certificates make git
5562
RUN go version
63+
# The plugins are built from their own upstream modules, so apply the same
64+
# tracked go.mod CVE overrides to each before building.
65+
COPY scripts/go-mod-overrides.sh /usr/local/bin/go-mod-overrides.sh
66+
COPY go-mod-overrides /src/go-mod-overrides
67+
RUN chmod +x /usr/local/bin/go-mod-overrides.sh
5668
RUN mkdir -p /go/src/github.com/k3s-io/helm-set-status && \
5769
cd /tmp && \
5870
curl -fsSL https://github.com/k3s-io/helm-set-status/archive/aa683c2b38a34bbd7261c5cd59e8d7c02e9d5c6e/helm-set-status.tar.gz -o helm-set-status.tar.gz && \
5971
tar xzf helm-set-status.tar.gz --strip-components=1 -C /go/src/github.com/k3s-io/helm-set-status && \
6072
rm -f /tmp/helm-set-status.tar.gz && \
6173
cd /go/src/github.com/k3s-io/helm-set-status && \
6274
go mod edit --replace helm.sh/helm/v4=helm.sh/helm/v4@"${HELM_VERSION}" && \
63-
go mod tidy && \
75+
go-mod-overrides.sh /src/go-mod-overrides && \
6476
make CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" HELM_PLUGIN_PATH=/root/.local/share/helm/plugins/helm-set-status install
6577
RUN mkdir -p /go/src/github.com/helm/helm-mapkubeapis && \
6678
cd /tmp && \
@@ -69,7 +81,7 @@ RUN mkdir -p /go/src/github.com/helm/helm-mapkubeapis && \
6981
rm -f /tmp/helm-mapkubeapis.tar.gz && \
7082
cd /go/src/github.com/helm/helm-mapkubeapis && \
7183
go mod edit --replace helm.sh/helm/v4=helm.sh/helm/v4@"${HELM_VERSION}" && \
72-
go mod tidy && \
84+
go-mod-overrides.sh /src/go-mod-overrides && \
7385
make CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" build && \
7486
mkdir -p /root/.local/share/helm/plugins/helm-mapkubeapis && \
7587
cp -vr /go/src/github.com/helm/helm-mapkubeapis/plugin.yaml \

‎go-mod-overrides‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# go.mod overrides applied at build time. See scripts/go-mod-overrides.sh.
2+
3+
# golang.org/x/net: CVE-2026-33814 (net/http2 DoS), CVE-2026-39821 (x/net/idna punycode).
4+
# Drop once upstream Helm requires golang.org/x/net >= v0.55.0.
5+
-replace golang.org/x/net=golang.org/x/net@v0.55.0

‎scripts/go-mod-overrides.sh‎

Lines changed: 50 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,50 @@
1+
#!/bin/sh
2+
# go-mod-overrides.sh — apply tracked go.mod overrides on top of an upstream
3+
# module so the built image stays CVE-free even when upstream has not yet bumped.
4+
#
5+
# The overrides file is a simple line-oriented list where each non-comment line
6+
# is passed verbatim to `go mod edit`. That keeps this a thin, dependency-free
7+
# wrapper (just `go` + `sh`) and makes every override trivially reviewable in a
8+
# PR diff.
9+
#
10+
# Usage:
11+
# go-mod-overrides.sh [OVERRIDES_FILE]
12+
#
13+
# Defaults to ./go-mod-overrides. Must be run from the module directory (the
14+
# directory containing the go.mod you want to patch).
15+
16+
set -e
17+
18+
OVERRIDES="${1:-go-mod-overrides}"
19+
20+
if [ ! -f "${OVERRIDES}" ]; then
21+
echo "go-mod-overrides: no overrides file at '${OVERRIDES}', nothing to do" >&2
22+
exit 0
23+
fi
24+
25+
if [ ! -f go.mod ]; then
26+
echo "go-mod-overrides: no go.mod found in $(pwd)" >&2
27+
exit 1
28+
fi
29+
30+
# Read line by line; strip comments and surrounding whitespace; pass the rest
31+
# straight to `go mod edit`. Module paths/versions contain no whitespace, so the
32+
# intentional word-splitting of ${line} cleanly separates the flag from its arg.
33+
while IFS= read -r line || [ -n "${line}" ]; do
34+
line="${line%%#*}"
35+
# Trim leading/trailing whitespace (pure POSIX sh; avoids external deps like sed).
36+
line=${line#"${line%%[![:space:]]*}"}
37+
line=${line%"${line##*[![:space:]]}"}
38+
[ -z "${line}" ] && continue
39+
echo "go-mod-overrides: go mod edit ${line}"
40+
# shellcheck disable=SC2086
41+
go mod edit ${line}
42+
done < "${OVERRIDES}"
43+
44+
# Reconcile the module graph and re-vendor only if upstream vendors its deps.
45+
go mod tidy
46+
if [ -d vendor ]; then
47+
go mod vendor
48+
fi
49+
50+
echo "go-mod-overrides: applied overrides from '${OVERRIDES}'"

0 commit comments

Comments
 (0)