From 6be03b3d8c91c2b4e62f132ac3c995f48867a291 Mon Sep 17 00:00:00 2001 From: Sopho Merkviladze Date: Tue, 7 Jul 2026 13:45:52 +0200 Subject: [PATCH 1/2] vendor: replace buildkit with Mirantis fork v0.13.0-beta1-m.1 Point github.com/moby/buildkit at the Mirantis/buildkit fork tag v0.13.0-beta1-m.1, which backports the path-traversal and git option injection fixes onto the v0.13.0-beta1 base. Fixes CVE-2026-33747, CVE-2026-33748. Signed-off-by: Sopho Merkviladze --- go.mod | 2 ++ go.sum | 4 ++-- .../session/secrets/secretsprovider/secretsprovider.go | 2 +- vendor/github.com/moby/buildkit/solver/errdefs/source.go | 2 +- .../moby/buildkit/util/grpcerrors/grpcerrors.go | 8 ++++---- vendor/github.com/moby/buildkit/util/stack/stack.go | 8 ++++---- .../moby/buildkit/util/testutil/integration/sandbox.go | 2 +- vendor/modules.txt | 5 +++-- 8 files changed, 18 insertions(+), 15 deletions(-) diff --git a/go.mod b/go.mod index 776c94eea3d2..fa7a333704ef 100644 --- a/go.mod +++ b/go.mod @@ -164,3 +164,5 @@ require ( sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect sigs.k8s.io/yaml v1.3.0 // indirect ) + +replace github.com/moby/buildkit => github.com/Mirantis/buildkit v0.13.0-beta1-m.1 diff --git a/go.sum b/go.sum index 4035cc93fc1b..6481570b82d9 100644 --- a/go.sum +++ b/go.sum @@ -51,6 +51,8 @@ github.com/Microsoft/go-winio v0.6.1 h1:9/kr64B9VUZrLm5YYwbGtUJnMgqWVOdUAXu6Migc github.com/Microsoft/go-winio v0.6.1/go.mod h1:LRdKpFKfdobln8UmuiYcKPot9D2v6svN5+sAH+4kjUM= github.com/Microsoft/hcsshim v0.11.1 h1:hJ3s7GbWlGK4YVV92sO88BQSyF4ZLVy7/awqOlPxFbA= github.com/Microsoft/hcsshim v0.11.1/go.mod h1:nFJmaO4Zr5Y7eADdFOpYswDDlNVbvcIJJNJLECr5JQg= +github.com/Mirantis/buildkit v0.13.0-beta1-m.1 h1:1wdugBmXwAm9Npe05FNtaegGqC3eqSsrVd4Yi2f0DpU= +github.com/Mirantis/buildkit v0.13.0-beta1-m.1/go.mod h1:PrxtkfstT0ZDl/0lcHxTQ6v/yocMY4JiKPi2+OaXkB0= github.com/OneOfOne/xxhash v1.2.2/go.mod h1:HSdplMjZKSmBqAxg5vPj2TmRDmfkzw+cTzAElWljhcU= github.com/Shopify/logrus-bugsnag v0.0.0-20170309145241-6dbc35f2c30d/go.mod h1:HI8ITrYtUY+O+ZhtlqUnD8+KwNPOyugEhfP9fdUIaEQ= github.com/Shopify/logrus-bugsnag v0.0.0-20171204204709-577dee27f20d h1:UrqY+r/OJnIp5u0s1SbQ8dVfLCZJsnvazdBP5hS4iRs= @@ -404,8 +406,6 @@ github.com/mitchellh/go-wordwrap v0.0.0-20150314170334-ad45545899c7/go.mod h1:ZX github.com/mitchellh/mapstructure v0.0.0-20150613213606-2caf8efc9366/go.mod h1:FVVH3fgwuzCH5S8UJGiWEs2h04kUh9fWfEaFds41c1Y= github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY= github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo= -github.com/moby/buildkit v0.13.0-beta1.0.20231023114302-d5c1d785b042 h1:1J+fRIucIeyl1gvSYOlTcN0gmsZ8SMlLdkwB01PEn94= -github.com/moby/buildkit v0.13.0-beta1.0.20231023114302-d5c1d785b042/go.mod h1:3sbzGMUHhpx+6++efVlHhvcarzusX1+QbGTR/S4y9gI= github.com/moby/locker v1.0.1 h1:fOXqR41zeveg4fFODix+1Ch4mj/gT0NE1XJbp/epuBg= github.com/moby/locker v1.0.1/go.mod h1:S7SDdo5zpBK84bzzVlKr2V0hz+7x9hWbYC/kq7oQppc= github.com/moby/patternmatcher v0.6.0 h1:GmP9lR19aU5GqSSFko+5pRqHi+Ohk1O69aFiKkVGiPk= diff --git a/vendor/github.com/moby/buildkit/session/secrets/secretsprovider/secretsprovider.go b/vendor/github.com/moby/buildkit/session/secrets/secretsprovider/secretsprovider.go index ea203bf02efd..71b00f893b5e 100644 --- a/vendor/github.com/moby/buildkit/session/secrets/secretsprovider/secretsprovider.go +++ b/vendor/github.com/moby/buildkit/session/secrets/secretsprovider/secretsprovider.go @@ -32,7 +32,7 @@ func (sp *secretProvider) GetSecret(ctx context.Context, req *secrets.GetSecretR dt, err := sp.store.GetSecret(ctx, req.ID) if err != nil { if errors.Is(err, secrets.ErrNotFound) { - return nil, status.Errorf(codes.NotFound, err.Error()) + return nil, status.Error(codes.NotFound, err.Error()) } return nil, err } diff --git a/vendor/github.com/moby/buildkit/solver/errdefs/source.go b/vendor/github.com/moby/buildkit/solver/errdefs/source.go index 6c1f36495732..11c38a5942fe 100644 --- a/vendor/github.com/moby/buildkit/solver/errdefs/source.go +++ b/vendor/github.com/moby/buildkit/solver/errdefs/source.go @@ -17,7 +17,7 @@ func WithSource(err error, src Source) error { return &ErrorSource{Source: src, error: err} } -type ErrorSource struct { +type ErrorSource struct { //nolint:errname Source error } diff --git a/vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go b/vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go index 710bc1ec8b5a..baed977f1aad 100644 --- a/vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go +++ b/vendor/github.com/moby/buildkit/util/grpcerrors/grpcerrors.go @@ -118,7 +118,7 @@ func Code(err error) codes.Code { } func WrapCode(err error, code codes.Code) error { - return &withCode{error: err, code: code} + return &withCodeError{error: err, code: code} } func AsGRPCStatus(err error) (*status.Status, bool) { @@ -227,16 +227,16 @@ func (e *grpcStatusError) GRPCStatus() *status.Status { return e.st } -type withCode struct { +type withCodeError struct { code codes.Code error } -func (e *withCode) Code() codes.Code { +func (e *withCodeError) Code() codes.Code { return e.code } -func (e *withCode) Unwrap() error { +func (e *withCodeError) Unwrap() error { return e.error } diff --git a/vendor/github.com/moby/buildkit/util/stack/stack.go b/vendor/github.com/moby/buildkit/util/stack/stack.go index fb9fc3ddf54c..ee8c55f7182e 100644 --- a/vendor/github.com/moby/buildkit/util/stack/stack.go +++ b/vendor/github.com/moby/buildkit/util/stack/stack.go @@ -80,7 +80,7 @@ func Enable(err error) error { } func Wrap(err error, s *Stack) error { - return &withStack{stack: s, error: err} + return &withStackError{stack: s, error: err} } func hasLocalStackTrace(err error) bool { @@ -168,15 +168,15 @@ func convertStack(s errors.StackTrace) *Stack { return &out } -type withStack struct { +type withStackError struct { stack *Stack error } -func (e *withStack) Unwrap() error { +func (e *withStackError) Unwrap() error { return e.error } -func (e *withStack) StackTrace() *Stack { +func (e *withStackError) StackTrace() *Stack { return e.stack } diff --git a/vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go b/vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go index d7f1dfff2734..59fa187fa9f3 100644 --- a/vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go +++ b/vendor/github.com/moby/buildkit/util/testutil/integration/sandbox.go @@ -146,7 +146,7 @@ func FormatLogs(m map[string]*bytes.Buffer) string { func CheckFeatureCompat(t *testing.T, sb Sandbox, features map[string]struct{}, reason ...string) { t.Helper() if err := HasFeatureCompat(t, sb, features, reason...); err != nil { - t.Skipf(err.Error()) + t.Skip(err.Error()) } } diff --git a/vendor/modules.txt b/vendor/modules.txt index 45cfbea775db..659ee03b041d 100644 --- a/vendor/modules.txt +++ b/vendor/modules.txt @@ -476,8 +476,8 @@ github.com/mitchellh/go-wordwrap # github.com/mitchellh/mapstructure v1.5.0 ## explicit; go 1.14 github.com/mitchellh/mapstructure -# github.com/moby/buildkit v0.13.0-beta1.0.20231023114302-d5c1d785b042 -## explicit; go 1.20 +# github.com/moby/buildkit v0.13.0-beta1.0.20231023114302-d5c1d785b042 => github.com/Mirantis/buildkit v0.13.0-beta1-m.1 +## explicit; go 1.24.0 github.com/moby/buildkit/api/services/control github.com/moby/buildkit/api/types github.com/moby/buildkit/client @@ -1241,3 +1241,4 @@ sigs.k8s.io/structured-merge-diff/v4/value # sigs.k8s.io/yaml v1.3.0 ## explicit; go 1.12 sigs.k8s.io/yaml +# github.com/moby/buildkit => github.com/Mirantis/buildkit v0.13.0-beta1-m.1 From 2c0d9e42e404e7ab9675fb366875667e655b4ddf Mon Sep 17 00:00:00 2001 From: Sopho Merkviladze Date: Tue, 7 Jul 2026 17:17:34 +0200 Subject: [PATCH 2/2] Dockerfile: bump xx to 1.6.1 (fix windows/arm64 xx-verify) Signed-off-by: Sopho Merkviladze --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 23e8759e937a..db6d892c7c05 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,7 +1,7 @@ # syntax=docker/dockerfile:1 ARG GO_VERSION=1.26.4 -ARG XX_VERSION=1.2.1 +ARG XX_VERSION=1.6.1 ARG DOCKER_VERSION=24.0.6 ARG GOTESTSUM_VERSION=v1.13.0