coredns/1.12.0-r1: cve remediation

[octo-sts]

coredns/1.12.0-r1: fix GHSA-v778-237x-gjrc

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/coredns.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: "go.mod requires go >= 1.23.4 (running go 1.23.3; GOTOOLCHAIN=go1.23.3)"

• Error Category: Version

• Failure Point: make gen command in the kuma-coredns subpackage pipeline

• Root Cause Analysis: There's a version mismatch between the Go toolchain version available in the build environment (1.23.3) and the version required by the project's go.mod file (1.23.4)

• Suggested Fix:
Update the environment section in the melange YAML to specify the correct Go version:

environment:
  contents:
    packages:
      - libcap-utils
      - make
      - go-1.23=1.23.4-r0  # Explicitly specify the required Go version

• Explanation:
The build is failing because the Go toolchain version available (1.23.3) is older than what's required by the project (1.23.4). By explicitly specifying go-1.23=1.23.4-r0 in the environment packages, we ensure the correct Go version is available during the build process.

• Additional Notes:

• This issue commonly occurs when the Go version requirements in go.mod don't match the available toolchain
• The error is in the subpackage build step, but fixing the Go version in the main environment will resolve it
• It's important to keep the Go toolchain version aligned with the project's requirements

• References:

• Go Release Notes: https://golang.org/doc/devel/release#go1.23.4
• Wolfi OS Package Repository: https://packages.wolfi.dev/os
• Go Modules Reference: https://golang.org/ref/mod#go-mod-file-go

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: "go: go.mod requires go >= 1.23.4 (running go 1.23.3; GOTOOLCHAIN=go1.23.3)"

• Error Category: Version

• Failure Point: make gen command during subpackage kuma-coredns build

• Root Cause Analysis: The Go toolchain version mismatch - the package requires Go 1.23.4, but the system is using Go 1.23.3

• Suggested Fix:

1. Update the go-1.23 package version in the environment section:

environment:
  contents:
    packages:
      - go-1.23=1.23.4-r0
      - libcap-utils
      - make

• Explanation: The error occurs because CoreDNS's go.mod requires Go 1.23.4 or higher, but the build environment is using Go 1.23.3. By explicitly specifying the correct Go version in the package dependencies, we ensure the build environment has the required toolchain version.

• Additional Notes:

• Always specify exact Go versions to prevent toolchain mismatches
• The go-1.23 package in Wolfi provides Go 1.23.4
• This is a common issue when packages require specific minimum Go versions

• References:

• Go Toolchain Requirements: https://go.dev/doc/toolchain
• CoreDNS Build Requirements: https://github.com/coredns/coredns#compilation
• Wolfi Go Package Documentation: https://packages.wolfi.dev/os/x86_64/go-1.23

[hbh7]

Not sure why this isn't picking up the latest version...

HTTP_AUTH=$(chainctl auth token --audience apk.cgr.dev) wolfi-package-status | grep go-1.23
go-1.23 version 1.23.0-r0 (4 months ago - 2024-08-14 23:51:41 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.0-r0 (4 months ago - 2024-08-14 23:51:41 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.0-r1 (3 months ago - 2024-09-03 05:16:32 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.0-r1 (3 months ago - 2024-09-03 05:16:32 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.1-r0 (3 months ago - 2024-09-06 00:34:41 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.1-r0 (3 months ago - 2024-09-06 00:34:41 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.2-r0 (2 months ago - 2024-10-01 18:04:32 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.2-r0 (2 months ago - 2024-10-01 18:04:32 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.3-r0 (1 month ago - 2024-11-06 23:03:49 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.3-r0 (1 month ago - 2024-11-06 23:03:49 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.3-r1 (4 weeks ago - 2024-11-14 00:05:34 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.3-r1 (4 weeks ago - 2024-11-14 00:05:34 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.4-r0 (1 week ago - 2024-12-03 19:03:20 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.4-r0 (1 week ago - 2024-12-03 19:03:20 +0000 UTC) in wolfi os repository

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: "go: go.mod requires go >= 1.23.4 (running go 1.23.3; GOTOOLCHAIN=go1.23.3)"

• Error Category: Version/Configuration

• Failure Point: The 'make gen' command during the build of kuma-coredns subpackage

• Root Cause Analysis: There's a version mismatch between the Go version required by the project (1.23.4) and the Go version available in the build environment (1.23.3).

• Suggested Fix:

1. Update the Go dependency in the package.yaml:

environment:
  contents:
    packages:
      - go-1.23>=1.23.4
      - libcap-utils
      - make

• Explanation:
The build is failing because the project's go.mod requires Go 1.23.4 or higher, but the build environment is using Go 1.23.3. By explicitly requiring Go 1.23.4 or higher in the package dependencies, we ensure the correct version is available during build time.

• Additional Notes:

• The error occurs in the subpackage build phase during code generation
• The version constraint in go.mod is strict about requiring 1.23.4+
• This is a common issue when upstream projects update their Go version requirements
• The fix ensures version compatibility while maintaining the principle of using up-to-date dependencies

• References:

• Go Release Notes: https://golang.org/doc/devel/release.html#go1.23
• Wolfi Package Guidelines: https://github.com/wolfi-dev/os/blob/main/CONTRIBUTING.md

[luhring]

This fails for me locally for a different reason than in CI:

2024/12/16 20:33:38 WARN Failed to set capabilities on file '/home/build/melange-out/coredns/usr/bin/coredns': Operation not supported
2024/12/16 20:33:38 ERRO Step failed: task exited with code 1
/bin/sh -c set -ex
[ -d '/home/build' ] || mkdir -p '/home/build'
cd '/home/build'
setcap cap_net_bind_service=+ep "/home/build/melange-out/coredns/usr/bin/coredns"

[vaikas]

Looks like @luhring is working also on this, I'll go find something else and have him drive this one.

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error:
"go: go.mod requires go >= 1.23.4 (running go 1.23.3; GOTOOLCHAIN=go1.23.3)"

• Error Category: Version

• Failure Point:
The make gen command in the kuma-coredns subpackage pipeline fails due to Go version mismatch

• Root Cause Analysis:
The build is using Go 1.23.3 but the project's go.mod requires Go 1.23.4 or higher. This version mismatch causes the build to fail during code generation.

• Suggested Fix:
Update the go-1.23 package dependency in the environment section:

environment:
  contents:
    packages:
      - go-1.23=1.23.4-r0  # Ensure this specific version
      - libcap-utils
      - make

• Explanation:
The fix ensures the correct Go version (1.23.4) is available during build time. The error occurs because the code generation step requires Go 1.23.4 as specified in go.mod, but the build environment is providing Go 1.23.3. By explicitly requiring go-1.23=1.23.4-r0, we ensure version compatibility.

• Additional Notes:

• The error occurs in the subpackage build pipeline during the make gen step
• Go toolchain version requirements must match exactly with go.mod specifications
• This is a common issue when dealing with Go modules that have strict version requirements

• References:

• Go Modules Reference: https://go.dev/ref/mod#go-mod-file-go
• Wolfi OS Go Package Documentation: https://github.com/wolfi-dev/os/tree/main/go-1.23

[vaikas]

The version being used comes from this file:
https://github.com/coredns/coredns/blob/master/.go-version

From here:
https://github.com/coredns/coredns/blob/master/Makefile#L10
And then used here:
https://github.com/coredns/coredns/blob/master/Makefile#L13

You can see the repro / potential fix here:

~ # make gen
go generate coredns.go
go: go.mod requires go >= 1.23.4 (running go 1.23.3; GOTOOLCHAIN=go1.23.3)
make: *** [Makefile:31: gen] Error 1
~ # export GOLANG_VERSION=1.23.4
~ # make gen
go generate coredns.go
go get