Fix CVE 2023 2975

.github/workflows/release_containers.yml

@@ -16,9 +16,9 @@ jobs:
           - name: badrobot
             file: ./Dockerfile
             suffix: ""
-          - name: badrobot scratch
-            file: ./Dockerfile.scratch
-            suffix: -scratch
+          - name: badrobot alpine
+            file: ./Dockerfile.alpine
+            suffix: -alpine
 
     steps:
       - name: Cache container layers

.github/workflows/security_analysis.yml

@@ -25,26 +25,15 @@ jobs:
       - name: Perform CodeQL Analysis
         uses: github/codeql-action/analyze@v2
 
-  trivy:
-    name: Trivy
+  govulncheck:
+    name: govulncheck
     runs-on: ubuntu-latest
     steps:
-      - name: Checkout code
+      - name: Checkout repository
         uses: actions/checkout@v3
 
-      - name: Build an image from Dockerfile
-        run: |
-          docker build . -t badrobot:${{ github.sha }}
-
-      - name: Run Trivy
-        uses: aquasecurity/trivy-action@master
-        with:
-          image-ref: badrobot:${{ github.sha }}
-          format: template
-          template: "@/contrib/sarif.tpl"
-          output: trivy-results.sarif
-
-      - name: Upload Trivy results to the Security tab
-        uses: github/codeql-action/upload-sarif@v2
+      - name: Vulnerability Scan Go Code
+        uses: Templum/[email protected]
         with:
-          sarif_file: trivy-results.sarif
+           go-version: 1.20.6
+           vulncheck-version: v1.0.0

Dockerfile

@@ -1,27 +1,21 @@
 FROM golang:1.20.6-alpine AS builder
-ARG VERSION=unknown
-ARG COMMIT=unknown
 
+RUN echo "badrobot:x:25000:25000:badrobot:/home/badrobot:/sbin/nologin" > /passwd && \
+    echo "badrobot:x:25000:" > /group
 WORKDIR /badrobot
-
+RUN apk add --no-cache ca-certificates
 COPY . .
-
 RUN CGO_ENABLED=0 GOOS=linux go build \
     -ldflags="-s -w -X github.com/controlplaneio/badrobot/cmd.version=$VERSION -X github.com/controlplaneio/badrobot/cmd.commit=$COMMIT" \
     -o badrobot .
 
 # ===
 
-FROM alpine:3.18.2
-
-RUN addgroup -S badrobot \
-    && adduser -S -g badrobot badrobot \
-    && apk --no-cache add ca-certificates
-
+FROM scratch
 WORKDIR /home/badrobot
-
+COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
+COPY --from=builder /passwd /group /etc/
 COPY --from=builder /badrobot/badrobot /bin/badrobot
-
 USER badrobot
 
 ENTRYPOINT ["/bin/badrobot"]

Dockerfile.scratch → Dockerfile.alpine

@@ -1,21 +1,27 @@
 FROM golang:1.20.6-alpine AS builder
+ARG VERSION=unknown
+ARG COMMIT=unknown
 
-RUN echo "badrobot:x:25000:25000:badrobot:/home/badrobot:/sbin/nologin" > /passwd && \
-    echo "badrobot:x:25000:" > /group
 WORKDIR /badrobot
-RUN apk add --no-cache ca-certificates
+
 COPY . .
+
 RUN CGO_ENABLED=0 GOOS=linux go build \
     -ldflags="-s -w -X github.com/controlplaneio/badrobot/cmd.version=$VERSION -X github.com/controlplaneio/badrobot/cmd.commit=$COMMIT" \
     -o badrobot .
 
 # ===
 
-FROM scratch
+FROM alpine:3.18.2
+
+RUN addgroup -S badrobot \
+    && adduser -S -g badrobot badrobot \
+    && apk --no-cache add ca-certificates
+
 WORKDIR /home/badrobot
-COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/
-COPY --from=builder /passwd /group /etc/
+
 COPY --from=builder /badrobot/badrobot /bin/badrobot
+
 USER badrobot
 
 ENTRYPOINT ["/bin/badrobot"]

go.mod

@@ -1,6 +1,6 @@
 module github.com/controlplaneio/badrobot
 
-go 1.19
+go 1.20
 
 require (
 	github.com/ghodss/yaml v1.0.0
@@ -27,7 +27,7 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	k8s.io/apimachinery v0.27.4 // indirect
 	k8s.io/klog/v2 v2.100.1 // indirect
-	k8s.io/utils v0.0.0-20230209194617-a36077c30491 // indirect
+	k8s.io/utils v0.0.0-20230726121419-3b25d923346b // indirect
 	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
 	sigs.k8s.io/structured-merge-diff/v4 v4.3.0 // indirect
 )

go.sum

@@ -97,6 +97,8 @@ k8s.io/klog/v2 v2.100.1 h1:7WCHKK6K8fNhTqfBhISHQ97KrnJNFZMcQvKp7gP/tmg=
 k8s.io/klog/v2 v2.100.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
 k8s.io/utils v0.0.0-20230209194617-a36077c30491 h1:r0BAOLElQnnFhE/ApUsg3iHdVYYPBjNSSOMowRZxxsY=
 k8s.io/utils v0.0.0-20230209194617-a36077c30491/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
+k8s.io/utils v0.0.0-20230726121419-3b25d923346b h1:sgn3ZU783SCgtaSJjpcVVlRqd6GSnlTLKgpAAttJvpI=
+k8s.io/utils v0.0.0-20230726121419-3b25d923346b/go.mod h1:OLgZIPagt7ERELqWJFomSt595RzquPNLL48iOWgYOg0=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd h1:EDPBXCAspyGV4jQlpZSudPeMmr1bNJefnuqLsRAsHZo=
 sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
 sigs.k8s.io/structured-merge-diff/v4 v4.3.0 h1:UZbZAZfX0wV2zr7YZorDz6GXROfDFj6LvqCRm4VUVKk=