From d4d816fb5c25f7d073222f0d036f8be98239c570 Mon Sep 17 00:00:00 2001 From: Wei Fu Date: Fri, 23 Oct 2026 14:10:14 +0000 Subject: [PATCH] fix: remediate eMudhra CA compromise - upgrade the Go toolchain to 1.26.10 - pin distroless static to the CA-fixed image digest Signed-off-by: Wei Fu cherry-picked-from: 42c931af8f6b95ac6287a08075183de4daa32cab Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: c72022b7-b813-4972-898e-a3fb18f6dae5 --- docker/eno-controller/Dockerfile | 2 +- docker/eno-reconciler/Dockerfile | 2 +- examples/03-helm-shim/Dockerfile | 2 +- examples/03-helm-shim/go.mod | 2 +- examples/05-crd/Dockerfile | 2 +- go.mod | 2 +- go.work | 2 +- pkg/helmshim/go.mod | 2 +- pkg/kclshim/go.mod | 2 +- 9 files changed, 9 insertions(+), 9 deletions(-) diff --git a/docker/eno-controller/Dockerfile b/docker/eno-controller/Dockerfile index 555cebf0..7e469d42 100644 --- a/docker/eno-controller/Dockerfile +++ b/docker/eno-controller/Dockerfile @@ -14,7 +14,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build go mod download COPY . . RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -ldflags="-s -w" ./cmd/eno-controller -FROM gcr.io/distroless/static +FROM gcr.io/distroless/static@sha256:034df5c1737e8241f6ed6423a12e720ee0f6d6f088609ee172f98f6f2166ef5d # https://github.com/GoogleContainerTools/distroless/blob/16dc4a6a33838006fe956e4c19f049ece9c18a8d/common/variables.bzl#L18 USER 65532:65532 diff --git a/docker/eno-reconciler/Dockerfile b/docker/eno-reconciler/Dockerfile index f93bb8f4..0b1c6875 100644 --- a/docker/eno-reconciler/Dockerfile +++ b/docker/eno-reconciler/Dockerfile @@ -14,7 +14,7 @@ RUN --mount=type=cache,target=/root/.cache/go-build go mod download COPY . . RUN --mount=type=cache,target=/root/.cache/go-build CGO_ENABLED=0 go build -ldflags="-s -w" ./cmd/eno-reconciler -FROM gcr.io/distroless/static +FROM gcr.io/distroless/static@sha256:034df5c1737e8241f6ed6423a12e720ee0f6d6f088609ee172f98f6f2166ef5d # https://github.com/GoogleContainerTools/distroless/blob/16dc4a6a33838006fe956e4c19f049ece9c18a8d/common/variables.bzl#L18 USER 65532:65532 diff --git a/examples/03-helm-shim/Dockerfile b/examples/03-helm-shim/Dockerfile index 00f1f920..5350a660 100644 --- a/examples/03-helm-shim/Dockerfile +++ b/examples/03-helm-shim/Dockerfile @@ -6,7 +6,7 @@ WORKDIR /app COPY . . RUN --mount=type=cache,target=/root/.cache/go-build cd examples/03-helm-shim && CGO_ENABLED=0 go build -o /app/helm-shim . -FROM gcr.io/distroless/static +FROM gcr.io/distroless/static@sha256:034df5c1737e8241f6ed6423a12e720ee0f6d6f088609ee172f98f6f2166ef5d # https://github.com/GoogleContainerTools/distroless/blob/16dc4a6a33838006fe956e4c19f049ece9c18a8d/common/variables.bzl#L18 USER 65532:65532 diff --git a/examples/03-helm-shim/go.mod b/examples/03-helm-shim/go.mod index d38ab9f1..8d4b3e70 100644 --- a/examples/03-helm-shim/go.mod +++ b/examples/03-helm-shim/go.mod @@ -2,7 +2,7 @@ module github.com/Azure/eno/examples/helm-shim go 1.25.0 -toolchain go1.25.9 +toolchain go1.26.10 replace github.com/Azure/eno/pkg/helmshim => ../../pkg/helmshim diff --git a/examples/05-crd/Dockerfile b/examples/05-crd/Dockerfile index 4f2a7ed8..687fc45f 100644 --- a/examples/05-crd/Dockerfile +++ b/examples/05-crd/Dockerfile @@ -20,4 +20,4 @@ FROM scratch USER 65532:65532 COPY --from=builder /app/crd-synthesizer /bin/synthesize -COPY examples/05-crd/config /config \ No newline at end of file +COPY examples/05-crd/config /config diff --git a/go.mod b/go.mod index 17a83d1d..db5b1c1a 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/Azure/eno go 1.25.0 -toolchain go1.25.13 +toolchain go1.26.10 require ( github.com/Azure/go-workflow v0.1.13 diff --git a/go.work b/go.work index be8a3828..46507cf1 100644 --- a/go.work +++ b/go.work @@ -1,6 +1,6 @@ go 1.25.0 -toolchain go1.25.9 +toolchain go1.26.10 use ( . diff --git a/pkg/helmshim/go.mod b/pkg/helmshim/go.mod index 25c8d8d4..a6af3524 100644 --- a/pkg/helmshim/go.mod +++ b/pkg/helmshim/go.mod @@ -2,7 +2,7 @@ module github.com/Azure/eno/pkg/helmshim go 1.25.0 -toolchain go1.25.9 +toolchain go1.26.10 replace github.com/imdario/mergo => github.com/imdario/mergo v0.3.16 diff --git a/pkg/kclshim/go.mod b/pkg/kclshim/go.mod index fb07b44a..78440270 100644 --- a/pkg/kclshim/go.mod +++ b/pkg/kclshim/go.mod @@ -2,7 +2,7 @@ module github.com/Azure/eno/pkg/kclshim go 1.25.0 -toolchain go1.25.9 +toolchain go1.26.10 require ( k8s.io/apimachinery v0.35.1