Address image CVE burden: float bases, trim runtime, unify Go toolchain - #4

Open

anthonytwh wants to merge 19 commits into

mainfrom

cve/image-build-hardening

Commits on Sep 1, 2026

docs: add CVE remediation plan for forklift image builds
anthonytwh
committed
145611e
Address image CVE burden: float bases, trim runtime, unify Go toolchain
anthonytwh
committed
1b4ed90

Commits on Sep 2, 2026

Bump golang.org/x/oauth2 and stop CI pinning Go by hand
anthonytwh
committed
29cd75e

Commits on Sep 3, 2026

Address review: revert weak-deps regression in fssupport, bump setup-go
anthonytwh
committed
c5b868c
Drop CI-only changes: revert .github/workflows and Konflux pipeline inputs
anthonytwh
committed
6c525c4
Add push-all-images-gcr target
anthonytwh
committed
f79fba5
Drop per-user path from push-all-images-gcr
anthonytwh
committed
ba172c1
Namespace GCR pushes under tigera-forklift/
anthonytwh
committed
a28c108
Fix submodule vendoring break and scope weak-deps to where it measurably helps
anthonytwh
committed
ba3e386
Add build-all-images-tigera and rename the push target to match
anthonytwh
committed
fdbe044
Exclude the operator index from the tigera image targets
anthonytwh
committed
8bff162
Pin every UBI base to latest and add updates to shipped runtime stages
anthonytwh
committed
7b0165d
Enable package updates in the forklift-operator images
anthonytwh
committed
2bb8ea0
Disable the unused virt-v2v fedora variant
anthonytwh
committed
31bda38

Commits on Sep 4, 2026

Add push-all-images-quay target
anthonytwh
committed
f4d43cf

Commits on Sep 9, 2026

Normalise weak-deps spelling and ignore stray Go binaries
anthonytwh
committed
7e94bf2

Commits on Sep 17, 2026

Scope the CVE claims to images this fork builds
anthonytwh
committed
3f1954a
Restore the update on the operator-index builder stage
anthonytwh
committed
c3f19ac

Commits on Sep 25, 2026

Restore /var/log/nginx ownership after the nginx RPM update

aaaaaaaalex
and
claude
committed
c1fb04d