mirror of
https://github.com/distribution/distribution.git
synced 2026-10-28 10:15:27 +08:00
Pujitha Paladugu
a22d72fb43
Motivation: the Dockerfiles pin GO_VERSION=1.26.8, so release and edge
images are built with a Go toolchain that predates the 1.26.9 and 1.26.10
security releases (including a mime/multipart memory limit bypass and
crypto/x509 intermediate certificate distrust). Rebuilds still produce
go1.26.8 binaries because of the pin.
Approach: bump the GO_VERSION ARG from 1.26.8 to 1.26.10 in Dockerfile and
dockerfiles/{docs,git,lint,vendor}.Dockerfile, as was done for the previous
bump. The CI matrix in build.yml uses 1.26.x and needs no change. No source
changes. This does not cut a patch release; that is a maintainer decision.
Validation: Docker is not available on this machine, so I did not build the
images. I confirmed the golang:1.26.10-alpine tag exists on Docker Hub and
grepped that no other 1.26.8 pin remains. The change only alters a base
image tag; no Go code or tests are affected.
Report: https://github.com/distribution/distribution/issues/5040
Signed-off-by: Pujitha Paladugu <10557236+pujitha24@users.noreply.github.com>
Assisted-by: claude-sonnet-5-5 (via Claude Code)
31 lines
1.1 KiB
Docker
31 lines
1.1 KiB
Docker
# syntax=docker/dockerfile:1
|
|
|
|
# GO_VERSION sets the version of the golang base image to use.
|
|
# It must be a supported tag in the docker.io/library/golang image repository.
|
|
ARG GO_VERSION=1.26.10
|
|
|
|
# ALPINE_VERSION sets the version of the alpine base image to use, including for the golang image.
|
|
# It must be a supported tag in the docker.io/library/alpine image repository
|
|
# that's also available as alpine image variant for the Golang version used.
|
|
ARG ALPINE_VERSION=3.24
|
|
|
|
# GOLANGCI_LINT_VERSION sets the version of the golangci/golangci-lint image to use.
|
|
ARG GOLANGCI_LINT_VERSION=v2.9
|
|
ARG BUILDTAGS=""
|
|
|
|
FROM golangci/golangci-lint:${GOLANGCI_LINT_VERSION}-alpine AS golangci-lint
|
|
|
|
FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base
|
|
RUN apk add --no-cache gcc musl-dev
|
|
WORKDIR /src
|
|
|
|
FROM base
|
|
ENV GOFLAGS="-buildvcs=false"
|
|
ARG TIMEOUT="5m"
|
|
ARG BUILDTAGS
|
|
RUN --mount=type=bind,target=. \
|
|
--mount=type=cache,target=/root/.cache \
|
|
--mount=from=golangci-lint,source=/usr/bin/golangci-lint,target=/usr/bin/golangci-lint \
|
|
golangci-lint config verify && \
|
|
golangci-lint --timeout "${TIMEOUT}" --build-tags "${BUILDTAGS}" run
|