mirror of
https://github.com/docker/docker-credential-helpers.git
synced 2026-06-14 00:11:28 +05:30
Sebastiaan van Stijn
62deeb49c1
go1.25.7 (released 2026-02-04) includes security fixes to the go command and the crypto/tls package, as well as bug fixes to the compiler and the crypto/x509 package. See the Go 1.25.7 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.25.7+label%3ACherryPickApproved full diff: https://github.com/golang/go/compare/go1.25.6...go1.25.7 From the security mailing list: > Hello gophers, > > We have just released Go versions 1.25.7 and 1.24.13, minor point releases. > > These releases include 2 security fixes following the security policy: > > - cmd/cgo: remove user-content from doc strings in cgo ASTs > > A discrepancy between how Go and C/C++ comments > were parsed allowed for code smuggling into the > resulting cgo binary. > > To prevent this behavior, the cgo compiler > will no longer parse user-provided doc > comments. > > Thank you to RyotaK (https://ryotak.net) of > GMO Flatt Security Inc. for reporting this issue. > > This is CVE-2025-61732 and https://go.dev/issue/76697. > > - crypto/tls: unexpected session resumption when using Config.GetConfigForClient > > Config.GetConfigForClient is documented to use the original Config's session > ticket keys unless explicitly overridden. This can cause unexpected behavior if > the returned Config modifies authentication parameters, like ClientCAs: a > connection initially established with the parent (or a sibling) Config can be > resumed, bypassing the modified authentication requirements. > > If ClientAuth is VerifyClientCertIfGiven or RequireAndVerifyClientCert (on the > server) or InsecureSkipVerify is false (on the client), crypto/tls now checks > that the root of the previously-verified chain is still in ClientCAs/RootCAs > when resuming a connection. > > Go 1.26 Release Candidate 2, Go 1.25.6, and Go 1.24.12 had fixed a similar issue > related to session ticket keys being implicitly shared by Config.Clone. Since > this fix is broader, the Config.Clone behavior change has been reverted. > > Note that VerifyPeerCertificate still behaves as documented: it does not apply > to resumed connections. Applications that use Config.GetConfigForClient or > Config.Clone and do not wish to blindly resume connections established with the > original Config must use VerifyConnection instead (or SetSessionTicketKeys or > SessionTicketsDisabled). > > Thanks to Coia Prant (github.com/rbqvq) for reporting this issue. > > This updates CVE-2025-68121 and Go issue https://go.dev/issue/77217. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
36 lines
739 B
Docker
36 lines
739 B
Docker
# syntax=docker/dockerfile:1
|
|
|
|
ARG GO_VERSION=1.25.7
|
|
ARG DISTRO=ubuntu
|
|
ARG SUITE=jammy
|
|
|
|
FROM golang:${GO_VERSION}-bookworm AS golang
|
|
|
|
FROM ${DISTRO}:${SUITE}
|
|
RUN apt-get update && apt-get install -yy debhelper dh-make libsecret-1-dev
|
|
RUN mkdir -p /build
|
|
|
|
WORKDIR /build
|
|
ENV GOPROXY=https://proxy.golang.org|direct
|
|
ENV GO111MODULE=off
|
|
ENV GOPATH=/build
|
|
ENV PATH=$PATH:/usr/local/go/bin:$GOPATH/bin
|
|
COPY --from=golang /usr/local/go /usr/local/go
|
|
|
|
COPY Makefile .
|
|
COPY credentials credentials
|
|
COPY secretservice secretservice
|
|
COPY pass pass
|
|
COPY deb/debian ./debian
|
|
COPY deb/build-deb .
|
|
|
|
ARG VERSION
|
|
ENV VERSION=${VERSION}
|
|
ARG REVISION
|
|
ENV REVISION=${REVISION}
|
|
ARG DISTRO
|
|
ENV DISTRO=${DISTRO}
|
|
ARG SUITE
|
|
ENV SUITE=${SUITE}
|
|
RUN /build/build-deb
|