From 5029a86743fbe3f33c5ad6b6502a11347325959f Mon Sep 17 00:00:00 2001 From: George Palade Date: Thu, 4 Jun 2026 11:10:33 +0300 Subject: [PATCH 1/3] security fixes --- .github/workflows/ci.yml | 2 +- .github/workflows/release.yml | 2 +- docker/Dockerfile | 4 ---- go.mod | 12 ++++++------ go.sum | 20 ++++++++++---------- 5 files changed, 18 insertions(+), 22 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index f5a624a..df08f07 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -17,7 +17,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v2 with: - go-version: '1.26.2' + go-version: '1.26.4' - name: Build run: make build-linux diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index 3068074..a5e43c5 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -33,7 +33,7 @@ jobs: - name: Set up Go uses: actions/setup-go@v2 with: - go-version: '1.26.2' + go-version: '1.26.4' - name: Set release version run: echo "RELEASE_VERSION=${GITHUB_REF#refs/*/v}" >> $GITHUB_ENV diff --git a/docker/Dockerfile b/docker/Dockerfile index 2a2fada..2a0820c 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,7 +1,5 @@ FROM alpine:latest as builder RUN apk add -U --no-cache ca-certificates curl -RUN curl -fsSL https://get.pulumi.com | sh -#RUN /root/.pulumi/bin/pulumi plugin install resource azure-native 1.60.0 FROM alpine:latest ARG PKG_FILES @@ -13,7 +11,5 @@ RUN addgroup -g 1300 -S nonroot \ && adduser -u 1300 -S nonroot -G nonroot COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ -COPY --from=builder --chown=nonroot /root/.pulumi/ /home/nonroot/.pulumi/ COPY --chown=nonroot /$PKG_FILES / -ENV PATH="/home/nonroot/.pulumi/bin:${PATH}" USER nonroot diff --git a/go.mod b/go.mod index 5b792cd..5f305bd 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module totalsoft.ro/platform-controllers -go 1.26.2 +go 1.26.4 require ( dario.cat/mergo v1.0.2 @@ -162,15 +162,15 @@ require ( go.uber.org/multierr v1.11.0 // indirect go.yaml.in/yaml/v2 v2.4.3 // indirect go.yaml.in/yaml/v3 v3.0.4 // indirect - golang.org/x/crypto v0.50.0 // indirect + golang.org/x/crypto v0.52.0 // indirect golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f // indirect golang.org/x/mod v0.35.0 // indirect - golang.org/x/net v0.53.0 // indirect + golang.org/x/net v0.55.0 // indirect golang.org/x/oauth2 v0.36.0 // indirect golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.43.0 // indirect - golang.org/x/term v0.42.0 // indirect - golang.org/x/text v0.36.0 // indirect + golang.org/x/sys v0.45.0 // indirect + golang.org/x/term v0.43.0 // indirect + golang.org/x/text v0.37.0 // indirect golang.org/x/time v0.14.0 // indirect golang.org/x/tools v0.44.0 // indirect google.golang.org/genproto/googleapis/api v0.0.0-20260311181403-84a4fc48630c // indirect diff --git a/go.sum b/go.sum index 2f707fa..b1ac48f 100644 --- a/go.sum +++ b/go.sum @@ -403,8 +403,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d/go.mod h1:IxCIyHEi3zRg3s0A5j5BB6A9Jmi73HwBIUl50j+osU4= -golang.org/x/crypto v0.50.0 h1:zO47/JPrL6vsNkINmLoo/PH1gcxpls50DNogFvB5ZGI= -golang.org/x/crypto v0.50.0/go.mod h1:3muZ7vA7PBCE6xgPX7nkzzjiUq87kRItoJQM1Yo8S+Q= +golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= +golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f h1:W3F4c+6OLc6H2lb//N1q4WpJkhzJCK5J6kUi1NTVXfM= golang.org/x/exp v0.0.0-20260410095643-746e56fc9e2f/go.mod h1:J1xhfL/vlindoeF/aINzNzt2Bket5bjo9sdOYzOsU80= golang.org/x/lint v0.0.0-20200302205851-738671d3881b/go.mod h1:3xt1FjdF8hUf6vQPIChWIBhFzV8gjjsPE/fR3IyQdNY= @@ -419,8 +419,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200421231249-e086a090c8fd/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= golang.org/x/net v0.0.0-20211112202133-69e39bad7dc2/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= -golang.org/x/net v0.53.0 h1:d+qAbo5L0orcWAr0a9JweQpjXF19LMXJE8Ey7hwOdUA= -golang.org/x/net v0.53.0/go.mod h1:JvMuJH7rrdiCfbeHoo3fCQU24Lf5JJwT9W3sJFulfgs= +golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= +golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -442,16 +442,16 @@ golang.org/x/sys v0.0.0-20210615035016-665e8c7367d1/go.mod h1:oPkhp1MJrh7nUepCBc golang.org/x/sys v0.0.0-20210809222454-d867a43fc93e/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.43.0 h1:Rlag2XtaFTxp19wS8MXlJwTvoh8ArU6ezoyFsMyCTNI= -golang.org/x/sys v0.43.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= +golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= -golang.org/x/term v0.42.0 h1:UiKe+zDFmJobeJ5ggPwOshJIVt6/Ft0rcfrXZDLWAWY= -golang.org/x/term v0.42.0/go.mod h1:Dq/D+snpsbazcBG5+F9Q1n2rXV8Ma+71xEjTRufARgY= +golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= +golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.36.0 h1:JfKh3XmcRPqZPKevfXVpI1wXPTqbkE5f7JA92a55Yxg= -golang.org/x/text v0.36.0/go.mod h1:NIdBknypM8iqVmPiuco0Dh6P5Jcdk8lJL0CUebqK164= +golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= +golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= golang.org/x/time v0.14.0 h1:MRx4UaLrDotUKUdCIqzPC48t1Y9hANFKIRpNx+Te8PI= golang.org/x/time v0.14.0/go.mod h1:eL/Oa2bBBK0TkX57Fyni+NgnyQQN4LitPmob2Hjnqw4= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= From 8d328b7c9340ba3843946a7d967fcc88e1c0dc77 Mon Sep 17 00:00:00 2001 From: George Palade Date: Thu, 4 Jun 2026 11:24:48 +0300 Subject: [PATCH 2/3] update --- docker/Dockerfile | 6 +++++- go.mod | 6 ++++-- 2 files changed, 9 insertions(+), 3 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index 2a0820c..b394e81 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -1,5 +1,7 @@ FROM alpine:latest as builder RUN apk add -U --no-cache ca-certificates curl +RUN curl -fsSL https://get.pulumi.com | sh +#RUN /root/.pulumi/bin/pulumi plugin install resource azure-native 1.60.0 FROM alpine:latest ARG PKG_FILES @@ -11,5 +13,7 @@ RUN addgroup -g 1300 -S nonroot \ && adduser -u 1300 -S nonroot -G nonroot COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ +COPY --from=builder --chown=nonroot /root/.pulumi/ /home/nonroot/.pulumi/ COPY --chown=nonroot /$PKG_FILES / -USER nonroot +ENV PATH="/home/nonroot/.pulumi/bin:${PATH}" +USER nonroot \ No newline at end of file diff --git a/go.mod b/go.mod index 5f305bd..61c6217 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,8 @@ module totalsoft.ro/platform-controllers -go 1.26.4 +go 1.26.0 + +toolchain go1.26.4 require ( dario.cat/mergo v1.0.2 @@ -20,6 +22,7 @@ require ( github.com/pulumi/pulumi-azure-native-sdk/storage/v2 v2.92.2 github.com/pulumi/pulumi-azuread/sdk/v5 v5.53.8 github.com/pulumi/pulumi-command/sdk v1.2.1 + github.com/pulumi/pulumi-keycloak/sdk/v6 v6.11.0 github.com/pulumi/pulumi-kubernetes/sdk/v4 v4.31.1 github.com/pulumi/pulumi-minio/sdk v0.17.0 github.com/pulumi/pulumi-random/sdk/v4 v4.21.0 @@ -132,7 +135,6 @@ require ( github.com/pulumi/appdash v0.0.0-20231130102222-75f619a67231 // indirect github.com/pulumi/esc v0.24.0 // indirect github.com/pulumi/pulumi-azure-native-sdk/v2 v2.92.2 // indirect - github.com/pulumi/pulumi-keycloak/sdk/v6 v6.11.0 // indirect github.com/rivo/uniseg v0.4.7 // indirect github.com/rogpeppe/go-internal v1.14.1 // indirect github.com/ryanuber/go-glob v1.0.0 // indirect From 0f7e9041d9437f2576843eaf0d1092d5978369f2 Mon Sep 17 00:00:00 2001 From: George Palade Date: Thu, 4 Jun 2026 12:43:26 +0300 Subject: [PATCH 3/3] update --- docker/Dockerfile | 2 +- go.mod | 4 +--- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/docker/Dockerfile b/docker/Dockerfile index b394e81..2a2fada 100644 --- a/docker/Dockerfile +++ b/docker/Dockerfile @@ -16,4 +16,4 @@ COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ COPY --from=builder --chown=nonroot /root/.pulumi/ /home/nonroot/.pulumi/ COPY --chown=nonroot /$PKG_FILES / ENV PATH="/home/nonroot/.pulumi/bin:${PATH}" -USER nonroot \ No newline at end of file +USER nonroot diff --git a/go.mod b/go.mod index 61c6217..dc1991e 100644 --- a/go.mod +++ b/go.mod @@ -1,8 +1,6 @@ module totalsoft.ro/platform-controllers -go 1.26.0 - -toolchain go1.26.4 +go 1.26.4 require ( dario.cat/mergo v1.0.2