openso/crowdsec-agent
Watch
1
0
Fork
You've already forked crowdsec-agent
 0
Code Issues Pull requests Packages 1 Activity Actions

Pin yq rebuild with patched x/net, x/text, x/sys; document image usage #1

Merged
MHE merged 1 commit from review-readme-reference-projects into main 2026-11-01 13:50:33 +01:00
Conversation 0 Commits 1 Files changed 4 +156 -9
MHE commented 2026-11-01 13:45:37 +01:00
Owner
Copy link

What changed

  • Dockerfile: adds a yq build stage that rebuilds the v4.50.1 tag with Go 1.26.10, pinning golang.org/x/net v0.60.0, golang.org/x/text v0.42.0, and golang.org/x/sys v0.49.0. The built binary is copied to /usr/local/bin/yq and verified with yq --version and go version -m.
  • .forgejo/actionlint.yaml: declares the docker self-hosted runner label so actionlint accepts it.
  • AGENTS.md: records the yq module pins and states that a version bump is the CrowdSec digest, YQ_VERSION, or those module pins.
  • README.md: rewritten to document the image tags, a hardened compose example, the required and optional environment variables, the startup sequence, and the build/pin policy.

Why

The upstream crowdsecurity/crowdsec 1.8.2 image ships yq built against golang.org/x/net v0.48.0 and golang.org/x/text v0.32.0, which carry fixed HIGH findings in the image scan. Rebuilding that tag with patched modules clears those findings without introducing a second image.

Notes for reviewers

  • The yq stage uses GOTOOLCHAIN=local and a pinned Alpine/Go base, so no floating tag is resolved at build time.
  • Please confirm the docker runner label matches the Forgejo runner configuration before merging.
## What changed - **Dockerfile**: adds a `yq` build stage that rebuilds the `v4.50.1` tag with Go `1.26.10`, pinning `golang.org/x/net` `v0.60.0`, `golang.org/x/text` `v0.42.0`, and `golang.org/x/sys` `v0.49.0`. The built binary is copied to `/usr/local/bin/yq` and verified with `yq --version` and `go version -m`. - **.forgejo/actionlint.yaml**: declares the `docker` self-hosted runner label so actionlint accepts it. - **AGENTS.md**: records the yq module pins and states that a version bump is the CrowdSec digest, `YQ_VERSION`, or those module pins. - **README.md**: rewritten to document the image tags, a hardened compose example, the required and optional environment variables, the startup sequence, and the build/pin policy. ## Why The upstream `crowdsecurity/crowdsec` 1.8.2 image ships `yq` built against `golang.org/x/net` v0.48.0 and `golang.org/x/text` v0.32.0, which carry fixed HIGH findings in the image scan. Rebuilding that tag with patched modules clears those findings without introducing a second image. ## Notes for reviewers - The `yq` stage uses `GOTOOLCHAIN=local` and a pinned Alpine/Go base, so no floating tag is resolved at build time. - Please confirm the `docker` runner label matches the Forgejo runner configuration before merging.
Add yq rebuild stage with pinned Go modules and update docs
All checks were successful
ci / compose (pull_request) Successful in 13s
Details
ci / shellcheck (pull_request) Successful in 2s
Details
ci / conventions (pull_request) Successful in 2s
Details
ci / image (pull_request) Successful in 1m7s
Details
dea123b76b
MHE merged commit a86db2e05e into main 2026-11-01 13:50:33 +01:00
MHE deleted branch review-readme-reference-projects 2026-11-01 13:51:00 +01:00
Sign in to join this conversation.
Reviewers
No reviewers
Labels
Clear labels
No items
No labels
Milestone
Clear milestone
No items
No milestone
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
openso/crowdsec-agent!1
No description provided.