Skip to content

Address image CVE burden: float bases, trim runtime, unify Go toolchain #4

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
anthonytwh wants to merge 19 commits into
base: main
Choose a base branch
from
+27,928 −54,782
Open

Address image CVE burden: float bases, trim runtime, unify Go toolchain #4

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
19 commits
Select commit Hold shift + click to select a range
145611e
docs: add CVE remediation plan for forklift image builds
anthonytwh Sep 1, 2026
1b4ed90
Address image CVE burden: float bases, trim runtime, unify Go toolchain
anthonytwh Sep 1, 2026
29cd75e
Bump golang.org/x/oauth2 and stop CI pinning Go by hand
anthonytwh Sep 2, 2026
c5b868c
Address review: revert weak-deps regression in fssupport, bump setup-go
anthonytwh Sep 3, 2026
6c525c4
Drop CI-only changes: revert .github/workflows and Konflux pipeline i…
anthonytwh Sep 3, 2026
f79fba5
Add push-all-images-gcr target
anthonytwh Sep 3, 2026
ba172c1
Drop per-user path from push-all-images-gcr
anthonytwh Sep 3, 2026
a28c108
Namespace GCR pushes under tigera-forklift/
anthonytwh Sep 3, 2026
ba3e386
Fix submodule vendoring break and scope weak-deps to where it measura…
anthonytwh Sep 3, 2026
fdbe044
Add build-all-images-tigera and rename the push target to match
anthonytwh Sep 3, 2026
8bff162
Exclude the operator index from the tigera image targets
anthonytwh Sep 3, 2026
7b0165d
Pin every UBI base to latest and add updates to shipped runtime stages
anthonytwh Sep 3, 2026
2bb8ea0
Enable package updates in the forklift-operator images
anthonytwh Sep 3, 2026
31bda38
Disable the unused virt-v2v fedora variant
anthonytwh Sep 3, 2026
f4d43cf
Add push-all-images-quay target
anthonytwh Sep 4, 2026
7e94bf2
Normalise weak-deps spelling and ignore stray Go binaries
anthonytwh Sep 9, 2026
3f1954a
Scope the CVE claims to images this fork builds
anthonytwh Sep 17, 2026
c3f19ac
Restore the update on the operator-index builder stage
anthonytwh Sep 17, 2026
c1fb04d
Restore /var/log/nginx ownership after the nginx RPM update
aaaaaaaalex Sep 25, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
5 changes: 5 additions & 0 deletions .gitignore
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,11 @@
*.dylib
bin

# Go binaries named after their directory, produced by `go build ./...` inside a
# module. These are local artifacts and must never be committed.
cmd/kubectl-mtv/kubectl-mtv
cmd/vsphere-copy-offload-populator/vsphere-copy-offload-populator

# Test binary, build with `go test -c`
*.test

Expand Down
64 changes: 32 additions & 32 deletions .konflux/validation/go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,19 +1,19 @@
module github.com/kubev2v/forklift

go 1.24.6
go 1.26.3

require github.com/open-policy-agent/opa v1.8.0

require (
github.com/agnivade/levenshtein v1.2.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bytecodealliance/wasmtime-go/v3 v3.0.2 // indirect
github.com/cenkalti/backoff/v5 v5.0.2 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/containerd/containerd/v2 v2.1.4 // indirect
github.com/containerd/containerd/v2 v2.3.4 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v1.0.0-rc.1 // indirect
github.com/containerd/platforms v1.0.0-rc.4 // indirect
github.com/containerd/typeurl/v2 v2.2.3 // indirect
github.com/decred/dcrd/dcrec/secp256k1/v4 v4.4.0 // indirect
github.com/dgraph-io/badger/v4 v4.8.0 // indirect
Expand All @@ -30,9 +30,9 @@ require (
github.com/gogo/protobuf v1.3.2 // indirect
github.com/google/flatbuffers v25.2.10+incompatible // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.1 // indirect
github.com/grpc-ecosystem/grpc-gateway/v2 v2.28.0 // indirect
github.com/inconshreveable/mousetrap v1.1.0 // indirect
github.com/klauspost/compress v1.18.0 // indirect
github.com/klauspost/compress v1.18.5 // indirect
github.com/lestrrat-go/blackmagic v1.0.4 // indirect
github.com/lestrrat-go/httpcc v1.0.1 // indirect
github.com/lestrrat-go/httprc/v3 v3.0.0 // indirect
Expand All @@ -45,18 +45,18 @@ require (
github.com/olekukonko/tablewriter v0.0.5 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.1.1 // indirect
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
github.com/pelletier/go-toml/v2 v2.3.0 // indirect
github.com/peterh/liner v1.2.2 // indirect
github.com/prometheus/client_golang v1.23.0 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
github.com/prometheus/common v0.65.0 // indirect
github.com/prometheus/procfs v0.16.1 // indirect
github.com/prometheus/common v0.67.5 // indirect
github.com/prometheus/procfs v0.19.2 // indirect
github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
github.com/rivo/uniseg v0.2.0 // indirect
github.com/sagikazarmark/locafero v0.7.0 // indirect
github.com/segmentio/asm v1.2.0 // indirect
github.com/sergi/go-diff v1.4.0 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/sirupsen/logrus v1.9.4 // indirect
github.com/sourcegraph/conc v0.3.0 // indirect
github.com/spf13/afero v1.12.0 // indirect
github.com/spf13/cast v1.7.1 // indirect
Expand All @@ -70,30 +70,30 @@ require (
github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
github.com/yashtewari/glob-intersection v0.2.0 // indirect
go.opentelemetry.io/auto/sdk v1.1.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.62.0 // indirect
go.opentelemetry.io/otel v1.37.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.37.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.37.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.37.0 // indirect
go.opentelemetry.io/otel/metric v1.37.0 // indirect
go.opentelemetry.io/otel/sdk v1.37.0 // indirect
go.opentelemetry.io/otel/trace v1.37.0 // indirect
go.opentelemetry.io/proto/otlp v1.7.0 // indirect
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.68.0 // indirect
go.opentelemetry.io/otel v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.43.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.43.0 // indirect
go.opentelemetry.io/otel/metric v1.43.0 // indirect
go.opentelemetry.io/otel/sdk v1.43.0 // indirect
go.opentelemetry.io/otel/trace v1.43.0 // indirect
go.opentelemetry.io/proto/otlp v1.10.0 // indirect
go.uber.org/atomic v1.9.0 // indirect
go.uber.org/automaxprocs v1.6.0 // indirect
go.uber.org/multierr v1.9.0 // indirect
go.yaml.in/yaml/v2 v2.4.2 // indirect
golang.org/x/crypto v0.40.0 // indirect
golang.org/x/net v0.42.0 // indirect
golang.org/x/sync v0.16.0 // indirect
golang.org/x/sys v0.34.0 // indirect
golang.org/x/text v0.27.0 // indirect
golang.org/x/time v0.12.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20250603155806-513f23925822 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20250603155806-513f23925822 // indirect
google.golang.org/grpc v1.74.2 // indirect
google.golang.org/protobuf v1.36.6 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
golang.org/x/crypto v0.55.0 // indirect
golang.org/x/net v0.58.0 // indirect
golang.org/x/sync v0.22.0 // indirect
golang.org/x/sys v0.47.0 // indirect
golang.org/x/text v0.41.0 // indirect
golang.org/x/time v0.15.0 // indirect
google.golang.org/genproto/googleapis/api v0.0.0-20260401024825-9d38bb4040a9 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20260406210006-6f92a3bedf2d // indirect
google.golang.org/grpc v1.80.0 // indirect
google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
gopkg.in/yaml.v3 v3.0.1 // indirect
oras.land/oras-go/v2 v2.6.0 // indirect
sigs.k8s.io/yaml v1.6.0 // indirect
Expand Down
Loading
Loading