Fix critical CVEs: build go-replace from source with Go 1.22+ instead of pre-built Go 1.19.1 binary

[Copilot]

The bundled go-replace binary (v22.10.0) was compiled with Go 1.19.1, exposing all images that include it to three critical CVEs in html/template and net/netip (CVE-2023-24538, CVE-2023-24540, CVE-2024-24790). No newer pre-built release exists, so the fix is to compile from source with the current Go toolchain.

Changes

• template/Dockerfile/tools.jinja2 — Rewrites the goreplace macro to build from source using Alpine's go package (1.22+ on alpine:latest) with a virtual build dep that is removed post-install, rather than downloading a pre-built binary:

{% macro goreplace(path="/usr/local/bin", version="22.10.0") -%}
    ## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
    && apk add --no-cache --virtual .build-deps-go go \
    && GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@{{ version }}" \
    && (mv "/tmp/go-build/bin/linux_${TARGETARCH}/go-replace" "{{ path }}/go-replace" 2>/dev/null || mv /tmp/go-build/bin/go-replace "{{ path }}/go-replace") \
    && apk del .build-deps-go \
    && rm -rf /tmp/go-build /tmp/go-cache \
    && chmod +x "{{ path }}/go-replace" \
    && "{{ path }}/go-replace" --version
{%- endmacro %}

The binary path fallback (linux_${TARGETARCH} → generic) handles both cross-compilation and native builds correctly.

• docker/toolbox/latest/Dockerfile — Regenerated to reflect the updated macro output.

[sonarqubecloud]

Quality Gate passed

Issues
2 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud