Skip to content

Commit ba41338

Browse files
kylos101codex
kylos101
and
codex
authored
Update images digests (#21611)
* Update images digests Co-authored-by: Codex <noreply@openai.com> * fix: restore fetchable Caddy runtime image digest Co-authored-by: Codex <noreply@openai.com> * fix: restore fetchable dashboard Caddy image digest Co-authored-by: Codex <noreply@openai.com> * fix: patch dependencies in custom Caddy builds Co-authored-by: Codex <noreply@openai.com> * docs: identify Grype findings fixed by Caddy overrides Co-authored-by: Codex <noreply@openai.com> --------- Co-authored-by: Codex <noreply@openai.com>
1 parent 95fd9de commit ba41338

29 files changed

Lines changed: 64 additions & 35 deletions

File tree

‎components/blobserve/leeway.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed
66

77
# Ensure latest packages are present, like security updates.
88
RUN apk upgrade --no-cache \

‎components/content-service/leeway.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed
66

77
# Ensure latest packages are present, like security updates.
88
RUN apk upgrade --no-cache \

‎components/dashboard/leeway.Dockerfile‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042 as compress
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed as compress
66

77
RUN apk add brotli gzip
88

@@ -18,10 +18,19 @@ RUN find . -type f \( -name '*.html' -o -name '*.js' -o -name '*.css' -o -name '
1818

1919
COPY components-gitpod-protocol--gitpod-schema/gitpod-schema.json /www/static/schemas/gitpod-schema.json
2020

21-
# Build Caddy from source with smallstep/certificates pinned to v0.30.1 (fixes GHSA-q4r8-xm5f-56gw)
21+
# Patch dependencies reported by Grype:
22+
# golang.org/x/crypto: GO-2026-6303, GO-2026-6354, GO-2026-6355
23+
# golang.org/x/net: GO-2026-5942
24+
# golang.org/x/text: GO-2026-5970
25+
# google.golang.org/grpc: GHSA-2v4p-qf9q-27wj, GHSA-hrxh-6v49-42gf, GHSA-vp52-pcj8-j9qc
26+
# Retain the smallstep/certificates fix for GHSA-q4r8-xm5f-56gw.
2227
FROM caddy:2.11.4-builder AS caddy-builder
2328
RUN xcaddy build v2.11.4 \
2429
--replace github.com/smallstep/certificates=github.com/smallstep/certificates@v0.30.1 \
30+
--replace golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
31+
--replace golang.org/x/net=golang.org/x/net@v0.58.0 \
32+
--replace golang.org/x/text=golang.org/x/text@v0.41.0 \
33+
--replace google.golang.org/grpc=google.golang.org/grpc@v1.83.2 \
2534
--output /caddy
2635

2736
FROM caddy/caddy:2.11.4-alpine@sha256:ef2ad799652965da62f0548e15e00ebcef221dd6f29623d3455df6273ca39f46

‎components/ee/agent-smith/leeway.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@
44

55

66

7-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042
7+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed
88

99
RUN apk add --no-cache git bash ca-certificates
1010
COPY components-ee-agent-smith--app/agent-smith /app/

‎components/ide-metrics/leeway.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed
66

77
# Ensure latest packages are present, like security updates.
88
RUN apk upgrade --no-cache \

‎components/ide-proxy/Dockerfile‎

Lines changed: 11 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042 as compress
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed as compress
66

77
RUN apk add brotli gzip curl
88

@@ -17,10 +17,19 @@ RUN for FILE in `ls /app-bin/gitpod-local-companion*`;do \
1717
RUN mkdir -p static/code
1818
RUN curl -o static/code/marketplace.json "https://raw.githubusercontent.com/EclipseFdn/publish-extensions/d9a7cc2d486ca881e9df310324f9752f48156283/extension-control/extensions.json"
1919

20-
# Build Caddy from source with smallstep/certificates pinned to v0.30.1 (fixes GHSA-q4r8-xm5f-56gw)
20+
# Patch dependencies reported by Grype:
21+
# golang.org/x/crypto: GO-2026-6303, GO-2026-6354, GO-2026-6355
22+
# golang.org/x/net: GO-2026-5942
23+
# golang.org/x/text: GO-2026-5970
24+
# google.golang.org/grpc: GHSA-2v4p-qf9q-27wj, GHSA-hrxh-6v49-42gf, GHSA-vp52-pcj8-j9qc
25+
# Retain the smallstep/certificates fix for GHSA-q4r8-xm5f-56gw.
2126
FROM caddy:2.11.4-builder AS caddy-builder
2227
RUN xcaddy build v2.11.4 \
2328
--replace github.com/smallstep/certificates=github.com/smallstep/certificates@v0.30.1 \
29+
--replace golang.org/x/crypto=golang.org/x/crypto@v0.56.0 \
30+
--replace golang.org/x/net=golang.org/x/net@v0.58.0 \
31+
--replace golang.org/x/text=golang.org/x/text@v0.41.0 \
32+
--replace google.golang.org/grpc=google.golang.org/grpc@v1.83.2 \
2433
--output /caddy
2534

2635
FROM caddy/caddy:2.11.4-alpine@sha256:ef2ad799652965da62f0548e15e00ebcef221dd6f29623d3455df6273ca39f46

‎components/ide-service/leeway.Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed
66

77
# Ensure latest packages are present, like security updates.
88
RUN apk upgrade --no-cache \

‎components/ide/jetbrains/backend-plugin/leeway.Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042 as base_builder
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed as base_builder
66
RUN mkdir /ide-desktop-plugins
77

88
# for debugging
9-
# FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042
9+
# FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed
1010
FROM scratch
1111
ARG JETBRAINS_BACKEND_QUALIFIER
1212
# ensures right permissions for /ide-desktop-plugins

‎components/ide/jetbrains/image/leeway.Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042 as base_builder
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed as base_builder
66
ARG JETBRAINS_DOWNLOAD_QUALIFIER
77
ARG SUPERVISOR_IDE_CONFIG
88
ARG JETBRAINS_BACKEND_VERSION
@@ -19,7 +19,7 @@ RUN mkdir /ide-desktop \
1919
&& cp /tmp/supervisor-ide-config.json /ide-desktop/${JETBRAINS_DOWNLOAD_QUALIFIER}/supervisor-ide-config.json
2020

2121
# for debugging
22-
# FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042
22+
# FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed
2323
FROM scratch
2424
ARG JETBRAINS_BACKEND_VERSION
2525
ARG JETBRAINS_DOWNLOAD_QUALIFIER

‎components/ide/jetbrains/launcher/leeway.Dockerfile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -2,11 +2,11 @@
22
# Licensed under the GNU Affero General Public License (AGPL).
33
# See License.AGPL.txt in the project root for license information.
44

5-
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042 as base_builder
5+
FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed as base_builder
66
RUN mkdir /ide-desktop
77

88
# for debugging
9-
# FROM cgr.dev/chainguard/wolfi-base:latest@sha256:918a593b8268c222afd4e2c4f06860ac984e60719b4697e4c71d796bc8fcd042
9+
# FROM cgr.dev/chainguard/wolfi-base:latest@sha256:ac3269eb506fccbf26c73e837f54f44dbeab0cd8338a9292bb5fef0036a4a6ed
1010
FROM scratch
1111
ARG JETBRAINS_BACKEND_VERSION
1212
# ensures right permissions for /ide-desktop

0 commit comments

Comments
 (0)