Skip to content

Fix critical CVEs: build go-replace from source with Go 1.22+ instead of pre-built Go 1.19.1 binary #568

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Copilot wants to merge 3 commits into
base: master
Choose a base branch
from
+12 −4
Draft

Fix critical CVEs: build go-replace from source with Go 1.22+ instead of pre-built Go 1.19.1 binary #568

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
86f2b5e
Initial plan
Copilot Jul 7, 2026
d9c5a25
Fix CVEs: build go-replace from source using Alpine Go (1.22+) instea…
Copilot Jul 7, 2026
2fabe96
Improve go-replace binary path handling for cross-compilation
Copilot Jul 7, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions docker/toolbox/latest/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,12 @@
# Baselayout scripts
&& wget -O /tmp/baselayout-install.sh https://raw.githubusercontent.com/webdevops/Docker-Image-Baselayout/master/install.sh \
&& sh /tmp/baselayout-install.sh /baselayout \
## Install go-replace
&& wget -O "/baselayout/usr/local/bin/go-replace" "https://github.com/webdevops/go-replace/releases/download/22.10.0/go-replace.linux.$TARGETARCH" \
## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
&& apk add --no-cache --virtual .build-deps-go go \
&& GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@22.10.0" \

Check warning on line 34 in docker/toolbox/latest/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Line is too long. Split it into multiple lines using backslash continuations. 


See more on https://sonarcloud.io/project/issues?id=webdevops_Dockerfile&issues=AZ87rRoAJHU3FirzTqer&open=AZ87rRoAJHU3FirzTqer&pullRequest=568
&& (mv "/tmp/go-build/bin/linux_${TARGETARCH}/go-replace" "/baselayout/usr/local/bin/go-replace" 2>/dev/null || mv /tmp/go-build/bin/go-replace "/baselayout/usr/local/bin/go-replace") \

Check warning on line 35 in docker/toolbox/latest/Dockerfile

View check run for this annotation

SonarQubeCloud / SonarCloud Code Analysis

Line is too long. Split it into multiple lines using backslash continuations. 


See more on https://sonarcloud.io/project/issues?id=webdevops_Dockerfile&issues=AZ87ripkCfvplhAWnVzp&open=AZ87ripkCfvplhAWnVzp&pullRequest=568
&& apk del .build-deps-go \
&& rm -rf /tmp/go-build /tmp/go-cache \
&& chmod +x "/baselayout/usr/local/bin/go-replace" \
&& "/baselayout/usr/local/bin/go-replace" --version \
&& ln -s /baselayout/usr/local/bin/go-replace /usr/local/bin/ \
Expand Down
8 changes: 6 additions & 2 deletions template/Dockerfile/tools.jinja2
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,10 @@
{% macro goreplace(path="/usr/local/bin", version="22.10.0") -%}
## Install go-replace
&& wget -O "{{ path }}/go-replace" "https://github.com/webdevops/go-replace/releases/download/{{ version }}/go-replace.linux.$TARGETARCH" \
## Install go-replace (build from source to ensure up-to-date Go stdlib, fixing CVEs in pre-built binaries)
&& apk add --no-cache --virtual .build-deps-go go \
&& GOPATH=/tmp/go-build GOCACHE=/tmp/go-cache GOARCH=$TARGETARCH GOOS=linux CGO_ENABLED=0 go install "github.com/webdevops/go-replace@{{ version }}" \
&& (mv "/tmp/go-build/bin/linux_${TARGETARCH}/go-replace" "{{ path }}/go-replace" 2>/dev/null || mv /tmp/go-build/bin/go-replace "{{ path }}/go-replace") \
&& apk del .build-deps-go \
&& rm -rf /tmp/go-build /tmp/go-cache \
&& chmod +x "{{ path }}/go-replace" \
&& "{{ path }}/go-replace" --version
{%- endmacro %}
Expand Down
Loading