2022-03-17 05:37:08 -04:00
|
|
|
# syntax=docker/dockerfile:1
|
2021-07-22 08:48:09 -04:00
|
|
|
|
update to go1.19.4
Includes security fixes for net/http (CVE-2022-41717, CVE-2022-41720),
and os (CVE-2022-41720).
These minor releases include 2 security fixes following the security policy:
- os, net/http: avoid escapes from os.DirFS and http.Dir on Windows
The os.DirFS function and http.Dir type provide access to a tree of files
rooted at a given directory. These functions permitted access to Windows
device files under that root. For example, os.DirFS("C:/tmp").Open("COM1")
would open the COM1 device.
Both os.DirFS and http.Dir only provide read-only filesystem access.
In addition, on Windows, an os.DirFS for the directory \(the root of the
current drive) can permit a maliciously crafted path to escape from the
drive and access any path on the system.
The behavior of os.DirFS("") has changed. Previously, an empty root was
treated equivalently to "/", so os.DirFS("").Open("tmp") would open the
path "/tmp". This now returns an error.
This is CVE-2022-41720 and Go issue https://go.dev/issue/56694.
- net/http: limit canonical header cache by bytes, not entries
An attacker can cause excessive memory growth in a Go server accepting
HTTP/2 requests.
HTTP/2 server connections contain a cache of HTTP header keys sent by
the client. While the total number of entries in this cache is capped,
an attacker sending very large keys can cause the server to allocate
approximately 64 MiB per open connection.
This issue is also fixed in golang.org/x/net/http2 vX.Y.Z, for users
manually configuring HTTP/2.
Thanks to Josselin Costanzi for reporting this issue.
This is CVE-2022-41717 and Go issue https://go.dev/issue/56350.
View the release notes for more information:
https://go.dev/doc/devel/release#go1.19.4
And the milestone on the issue tracker:
https://github.com/golang/go/issues?q=milestone%3AGo1.19.4+label%3ACherryPickApproved
Full diff: https://github.com/golang/go/compare/go1.19.3...go1.19.4
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-12-06 17:03:41 -05:00
|
|
|
ARG GO_VERSION=1.19.4
|
2022-12-04 08:01:30 -05:00
|
|
|
ARG ALPINE_VERSION=3.16
|
2019-07-18 05:13:45 -04:00
|
|
|
|
2022-12-06 08:25:04 -05:00
|
|
|
ARG BUILDX_VERSION=0.9.1
|
2022-02-03 04:37:55 -05:00
|
|
|
FROM docker/buildx-bin:${BUILDX_VERSION} AS buildx
|
|
|
|
|
2022-12-04 08:01:30 -05:00
|
|
|
FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golang
|
2020-08-28 07:12:07 -04:00
|
|
|
ENV CGO_ENABLED=0
|
|
|
|
|
Use gofumpt if available, and enable gofumpt linter
gofumpt provides a supserset of gofmt / go fmt, but not every developer may have
it installed, so for situations where it's not available, fall back to gofmt.
As our code has been formatted with gofumpt already, in most cases contributions
will follow those formatting rules, but in some cases there may be a difference,
which would already be flagged by manual code review, but let's also enable the
gofumpt linter.
With this change, `make fmt` will use gofumpt is available; gofumpt has been
added to the dev-container, so `make -f docker.Makefile fmt` will always use it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-09-30 07:10:53 -04:00
|
|
|
FROM golang AS gofumpt
|
|
|
|
ARG GOFUMPT_VERSION=v0.4.0
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
--mount=type=tmpfs,target=/go/src/ \
|
|
|
|
GO111MODULE=on go install "mvdan.cc/gofumpt@${GOFUMPT_VERSION}" \
|
|
|
|
&& gofumpt --version
|
|
|
|
|
2020-08-28 07:12:07 -04:00
|
|
|
FROM golang AS gotestsum
|
2022-11-17 11:10:59 -05:00
|
|
|
ARG GOTESTSUM_VERSION=v1.8.2
|
2020-08-28 07:20:11 -04:00
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
--mount=type=tmpfs,target=/go/src/ \
|
2021-07-15 09:15:38 -04:00
|
|
|
GO111MODULE=on go install gotest.tools/gotestsum@${GOTESTSUM_VERSION}
|
2020-08-28 07:12:07 -04:00
|
|
|
|
2021-10-11 10:54:09 -04:00
|
|
|
FROM golang AS goversioninfo
|
|
|
|
ARG GOVERSIONINFO_VERSION=v1.3.0
|
|
|
|
RUN --mount=type=cache,target=/root/.cache/go-build \
|
|
|
|
--mount=type=cache,target=/go/pkg/mod \
|
|
|
|
--mount=type=tmpfs,target=/go/src/ \
|
|
|
|
GO111MODULE=on go install github.com/josephspurrier/goversioninfo/cmd/goversioninfo@${GOVERSIONINFO_VERSION}
|
|
|
|
|
2020-08-28 07:12:07 -04:00
|
|
|
FROM golang AS dev
|
|
|
|
RUN apk add --no-cache \
|
|
|
|
bash \
|
|
|
|
build-base \
|
|
|
|
ca-certificates \
|
|
|
|
coreutils \
|
|
|
|
curl \
|
2022-04-06 12:54:32 -04:00
|
|
|
git \
|
|
|
|
jq \
|
|
|
|
nano
|
2020-08-28 07:12:07 -04:00
|
|
|
|
2022-04-06 12:54:32 -04:00
|
|
|
RUN echo -e "\nYou are now in a development container. Run '\e\033[1mmake help\e\033[0m' to learn about\navailable make targets.\n" > /etc/motd \
|
|
|
|
&& echo -e "cat /etc/motd\nPS1=\"\e[0;32m\u@docker-cli-dev\\$ \e[0m\"" >> /root/.bashrc
|
2020-08-28 07:19:09 -04:00
|
|
|
CMD bash
|
2020-08-28 07:12:07 -04:00
|
|
|
ENV DISABLE_WARN_OUTSIDE_CONTAINER=1
|
|
|
|
ENV PATH=$PATH:/go/src/github.com/docker/cli/build
|
|
|
|
|
2022-02-03 04:37:55 -05:00
|
|
|
COPY --from=buildx /buildx /usr/libexec/docker/cli-plugins/docker-buildx
|
Use gofumpt if available, and enable gofumpt linter
gofumpt provides a supserset of gofmt / go fmt, but not every developer may have
it installed, so for situations where it's not available, fall back to gofmt.
As our code has been formatted with gofumpt already, in most cases contributions
will follow those formatting rules, but in some cases there may be a difference,
which would already be flagged by manual code review, but let's also enable the
gofumpt linter.
With this change, `make fmt` will use gofumpt is available; gofumpt has been
added to the dev-container, so `make -f docker.Makefile fmt` will always use it.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-09-30 07:10:53 -04:00
|
|
|
COPY --from=gofumpt /go/bin/* /go/bin/
|
2021-10-11 10:54:09 -04:00
|
|
|
COPY --from=gotestsum /go/bin/* /go/bin/
|
|
|
|
COPY --from=goversioninfo /go/bin/* /go/bin/
|
2020-08-28 07:12:07 -04:00
|
|
|
|
2017-04-18 19:12:24 -04:00
|
|
|
WORKDIR /go/src/github.com/docker/cli
|
2021-07-15 09:15:38 -04:00
|
|
|
ENV GO111MODULE=auto
|
2020-08-28 07:12:07 -04:00
|
|
|
COPY . .
|