mirror of
https://github.com/safedep/pmg.git
synced 2026-08-03 07:24:09 +02:00
Sahil BansalandGitHub
d9240eed82
* fix(deps): update golang.org/x modules to latest on the Go 1.25 line Clears the x/crypto, x/net, x/sys and x/text vulnerability findings reported against the pmg binary by image scanners. Deliberately kept back: the go directive stays 1.25.1 because the Go 1.26 move is blocked on goproxy URL parsing (see #390), and grpc stays pinned at v1.81.0 due to the trailers regression with v1.82.x. * fix(container): move runtime base to debian 13 and refresh builder pin The bullseye runtime base and the stale golang:1.25-bookworm digest (go1.25.5) accounted for most of the vulnerability findings in the published image. debian:13-slim is current stable and the refreshed golang digest carries go1.25.12, covering every flagged stdlib CVE.
32 lines
899 B
Docker
32 lines
899 B
Docker
FROM --platform=$BUILDPLATFORM golang:1.25-bookworm@sha256:ea341baa9bd5ba6784f6d7161ace70544349a6242d54d34a0fbfd2c4d51c9d58 AS build
|
|
# Original: golang:1.25-bookworm
|
|
|
|
WORKDIR /build
|
|
|
|
COPY go.mod go.sum ./
|
|
|
|
RUN go mod download
|
|
|
|
COPY . .
|
|
|
|
ARG TARGETOS TARGETARCH
|
|
|
|
RUN CGO_ENABLED=0 GOOS=${TARGETOS} GOARCH=${TARGETARCH} make
|
|
|
|
FROM debian:13-slim@sha256:020c0d20b9880058cbe785a9db107156c3c75c2ac944a6aa7ab59f2add76a7bd
|
|
# Original: debian:13-slim
|
|
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
ca-certificates \
|
|
&& rm -rf /var/lib/apt/lists/*
|
|
|
|
ARG TARGETPLATFORM
|
|
|
|
LABEL org.opencontainers.image.source=https://github.com/safedep/pmg
|
|
LABEL org.opencontainers.image.description="Package Manager Guard to protect against malicious open source packages"
|
|
LABEL org.opencontainers.image.licenses=Apache-2.0
|
|
|
|
COPY --from=build /build/bin/pmg /usr/local/bin/pmg
|
|
|
|
ENTRYPOINT ["pmg"]
|