From 86f2b5ec14751778e840eec6a5ee044d18d693e4 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 7 Jul 2026 08:14:53 +0000
Subject: [PATCH 1/3] Initial plan


From d9c5a25eb727e2bf73f95462025ba5ebb0ee56d2 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 7 Jul 2026 08:22:52 +0000
Subject: [PATCH 2/3] Fix CVEs: build go-replace from source using Alpine Go
 (1.22+) instead of pre-built binary

The pre-built go-replace binary v22.10.0 was compiled with Go v1.19.1 which contains
critical CVEs: CVE-2023-24538, CVE-2023-24540, CVE-2024-24790.

Update the goreplace macro in tools.jinja2 and the generated toolbox Dockerfile to build
go-replace from source using Alpine's Go package (1.22+ on alpine:latest), which fixes
the vulnerable stdlib by compiling with an up-to-date Go toolchain.

Closes #567
---
 docker/toolbox/latest/Dockerfile | 8 ++++++--
 template/Dockerfile/tools.jinja2 | 8 ++++++--
 2 files changed, 12 insertions(+), 4 deletions(-)

diff --git a/docker/toolbox/latest/Dockerfile b/docker/toolbox/latest/Dockerfile
index 530b6bf56..80f82b1ba 100644
--- a/docker/toolbox/latest/Dockerfile
+++ b/docker/toolbox/latest/Dockerfile
@@ -29,8 +29,12 @@ RUN apk add --no-cache \
         # Baselayout scripts
         && wget -O /tmp/baselayout-install.sh https://raw.githubusercontent.com/webdevops/Docker-Image-Baselayout/master/install.sh \
         && sh /tmp/baselayout-install.sh /baselayout \
-        ## Install go-replace
-    && wget -O "/baselayout/usr/local/bin/go-replace" "https://github.com/webdevops/go-replace/releases/download/22.10.0/go-replace.linux.$TARGETARCH" \
+        ## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
+    && apk add --no-cache --virtual .build-deps-go go \
+    && GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@22.10.0" \
+    && find /tmp/go-build/bin -name "go-replace" -exec mv {} "/baselayout/usr/local/bin/go-replace" \; \
+    && apk del .build-deps-go \
+    && rm -rf /tmp/go-build /tmp/go-cache \
     && chmod +x "/baselayout/usr/local/bin/go-replace" \
     && "/baselayout/usr/local/bin/go-replace" --version \
         && ln -s /baselayout/usr/local/bin/go-replace /usr/local/bin/ \
diff --git a/template/Dockerfile/tools.jinja2 b/template/Dockerfile/tools.jinja2
index b15ac5b8b..37e0f87ba 100644
--- a/template/Dockerfile/tools.jinja2
+++ b/template/Dockerfile/tools.jinja2
@@ -1,6 +1,10 @@
 {% macro goreplace(path="/usr/local/bin", version="22.10.0") -%}
-    ## Install go-replace
-    && wget -O "{{ path }}/go-replace" "https://github.com/webdevops/go-replace/releases/download/{{ version }}/go-replace.linux.$TARGETARCH" \
+    ## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
+    && apk add --no-cache --virtual .build-deps-go go \
+    && GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@{{ version }}" \
+    && find /tmp/go-build/bin -name "go-replace" -exec mv {} "{{ path }}/go-replace" \; \
+    && apk del .build-deps-go \
+    && rm -rf /tmp/go-build /tmp/go-cache \
     && chmod +x "{{ path }}/go-replace" \
     && "{{ path }}/go-replace" --version
 {%- endmacro %}

From 2fabe96743982ee9d1c72f21d6a276bd5452155a Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Tue, 7 Jul 2026 08:23:58 +0000
Subject: [PATCH 3/3] Improve go-replace binary path handling for
 cross-compilation

Use explicit mv with fallback for architecture-specific vs generic bin paths:
- Cross-compile (e.g., amd64 host building arm64): binary at /tmp/go-build/bin/linux_${TARGETARCH}/go-replace
- Native compile: binary at /tmp/go-build/bin/go-replace

The or-pattern (try arch-specific first, fall back to generic) handles both cases
explicitly rather than relying on find's silent failure behavior.
---
 docker/toolbox/latest/Dockerfile | 2 +-
 template/Dockerfile/tools.jinja2 | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/docker/toolbox/latest/Dockerfile b/docker/toolbox/latest/Dockerfile
index 80f82b1ba..efca5079a 100644
--- a/docker/toolbox/latest/Dockerfile
+++ b/docker/toolbox/latest/Dockerfile
@@ -32,7 +32,7 @@ RUN apk add --no-cache \
         ## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
     && apk add --no-cache --virtual .build-deps-go go \
     && GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@22.10.0" \
-    && find /tmp/go-build/bin -name "go-replace" -exec mv {} "/baselayout/usr/local/bin/go-replace" \; \
+    && (mv "/tmp/go-build/bin/linux_${TARGETARCH}/go-replace" "/baselayout/usr/local/bin/go-replace" 2>/dev/null || mv /tmp/go-build/bin/go-replace "/baselayout/usr/local/bin/go-replace") \
     && apk del .build-deps-go \
     && rm -rf /tmp/go-build /tmp/go-cache \
     && chmod +x "/baselayout/usr/local/bin/go-replace" \
diff --git a/template/Dockerfile/tools.jinja2 b/template/Dockerfile/tools.jinja2
index 37e0f87ba..8828759ee 100644
--- a/template/Dockerfile/tools.jinja2
+++ b/template/Dockerfile/tools.jinja2
@@ -2,7 +2,7 @@
     ## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
     && apk add --no-cache --virtual .build-deps-go go \
     && GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@{{ version }}" \
-    && find /tmp/go-build/bin -name "go-replace" -exec mv {} "{{ path }}/go-replace" \; \
+    && (mv "/tmp/go-build/bin/linux_${TARGETARCH}/go-replace" "{{ path }}/go-replace" 2>/dev/null || mv /tmp/go-build/bin/go-replace "{{ path }}/go-replace") \
     && apk del .build-deps-go \
     && rm -rf /tmp/go-build /tmp/go-cache \
     && chmod +x "{{ path }}/go-replace" \