From 161880f29e49e8fff50c322b386eb03684ea5735 Mon Sep 17 00:00:00 2001 From: vuln-remediation-agent Date: Tue, 23 Jun 2026 12:24:51 +0000 Subject: [PATCH] =?UTF-8?q?fix:=20[CI-23242][CI-23243][CI-23231][CI-23237]?= =?UTF-8?q?:=20bump=20docker=20dind=20base=2028.1.1=E2=86=9228.5.1=20and?= =?UTF-8?q?=20cosign=202.5.3=E2=86=922.6.3=20to=20remediate=20CVEs?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit - Updates docker/docker/Dockerfile.linux.amd64 and Dockerfile.linux.arm64 - Base: docker:28.1.1-dind → docker:28.5.1-dind (Alpine 3.20 → 3.22.2); resolves bundled docker / containerd / runc / Go-stdlib CVEs surfaced in the EPIC CI-23213 RapidFort hardened image scans. - cosign: v2.5.3 → v2.6.3 (latest 2.x — same major) - Variants ecr/acr/gar inherit FROM plugins/docker:linux-{amd64,arm64} so rebuilding the docker variant cascades to all four published images (harnesssecure/docker, harnesssecure/ecr, harnesssecure/acr, harnesssecure/gar). Tickets: CI-23242, CI-23243, CI-23231, CI-23237 (parent EPIC CI-23213) --- docker/docker/Dockerfile.linux.amd64 | 4 ++-- docker/docker/Dockerfile.linux.arm64 | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/docker/docker/Dockerfile.linux.amd64 b/docker/docker/Dockerfile.linux.amd64 index 8c61c253..8773d52b 100644 --- a/docker/docker/Dockerfile.linux.amd64 +++ b/docker/docker/Dockerfile.linux.amd64 @@ -1,9 +1,9 @@ -FROM docker:28.1.1-dind +FROM docker:28.5.1-dind ENV DOCKER_HOST=unix:///var/run/docker.sock # Install cosign for container image signing -RUN wget -O /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.5.3/cosign-linux-amd64 \ +RUN wget -O /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.6.3/cosign-linux-amd64 \ && chmod +x /usr/local/bin/cosign ADD release/linux/amd64/drone-docker /bin/ diff --git a/docker/docker/Dockerfile.linux.arm64 b/docker/docker/Dockerfile.linux.arm64 index 86fd6272..143b25db 100644 --- a/docker/docker/Dockerfile.linux.arm64 +++ b/docker/docker/Dockerfile.linux.arm64 @@ -1,9 +1,9 @@ -FROM arm64v8/docker:28.1.1-dind +FROM arm64v8/docker:28.5.1-dind ENV DOCKER_HOST=unix:///var/run/docker.sock # Install cosign for container image signing -RUN wget -O /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.5.3/cosign-linux-arm64 \ +RUN wget -O /usr/local/bin/cosign https://github.com/sigstore/cosign/releases/download/v2.6.3/cosign-linux-arm64 \ && chmod +x /usr/local/bin/cosign ADD release/linux/arm64/drone-docker /bin/