From 20db51b7a2cacc9e73f4ce775af88d17c6b3e42a Mon Sep 17 00:00:00 2001
From: embeddevio <embeddev.iot@gmail.com>
Date: Thu, 29 Oct 2026 21:09:52 +0300
Subject: [PATCH] =?UTF-8?q?fix(#61):=20=D0=B1=D0=B0=D0=BC=D0=BF=20=D0=B1?=
 =?UTF-8?q?=D0=B0=D0=B7=D0=BE=D0=B2=D1=8B=D1=85=20=D0=BE=D0=B1=D1=80=D0=B0?=
 =?UTF-8?q?=D0=B7=D0=BE=D0=B2=20=D0=B8=20x/crypto=20=D0=BF=D0=BE=D0=B4=20?=
 =?UTF-8?q?=D0=B3=D0=B5=D0=B9=D1=82=20image-scan?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- GO_IMAGE golang:1.25-alpine → golang:1.26-alpine (CVE Go stdlib 1.25.14: CVE-2026-56857 CRITICAL, CVE-2026-111943/78667/97031 HIGH)
- golang.org/x/crypto → v0.43.0 в amneziawg-go (CVE-2025-47913 HIGH)
- runtime alpine:3.21 → alpine:3.23 + apk upgrade (HIGH в пакетах базы)

Refs #61, Refs #18, Refs #17
---
 deploy/Dockerfile | 20 +++++++++++++++++---
 1 file changed, 17 insertions(+), 3 deletions(-)

diff --git a/deploy/Dockerfile b/deploy/Dockerfile
index 9f02af9..cc7fa49 100644
--- a/deploy/Dockerfile
+++ b/deploy/Dockerfile
@@ -6,7 +6,12 @@
 # ВАЖНО: AMNEZIAWG_GO_REF / AMNEZIAWG_TOOLS_REF по умолчанию указывают на master
 # и должны быть запинены на проверенный тег/коммит перед релизом (см. #45).
 
-ARG GO_IMAGE=golang:1.25-alpine
+# Базовые образы и зависимости подняты под гейт image-scan (issue #61):
+#   golang:1.26-alpine   — закрывает CVE Go stdlib 1.25.14 (CRITICAL CVE-2026-56857 + HIGH)
+#   golang.org/x/crypto >= v0.43.0 — закрывает CVE-2025-47913 (ssh/agent)
+#   alpine:3.23          — закрывает HIGH в пакетах alpine 3.21
+ARG GO_IMAGE=golang:1.26-alpine
+ARG X_CRYPTO_VERSION=v0.43.0
 
 # --- stage 1: сборка awg-утилит (Go) -----------------------------------------
 FROM ${GO_IMAGE} AS go-build
@@ -15,12 +20,18 @@ ARG AMNEZIAWG_GO_REPO=https://github.com/amnezia-vpn/amneziawg-go.git
 ARG AMNEZIAWG_GO_REF=master
 ARG AMNEZIAWG_TOOLS_REPO=https://github.com/amnezia-vpn/amneziawg-tools.git
 ARG AMNEZIAWG_TOOLS_REF=master
+ARG X_CRYPTO_VERSION
 
 RUN apk add --no-cache git make gcc musl-dev linux-headers
 
 WORKDIR /src
 RUN git clone --depth 1 --branch "${AMNEZIAWG_GO_REF}" "${AMNEZIAWG_GO_REPO}" amneziawg-go \
- && cd amneziawg-go && make && cp amneziawg-go /usr/local/bin/amneziawg-go
+ && cd amneziawg-go \
+ && go get "golang.org/x/crypto@${X_CRYPTO_VERSION}" \
+ && go mod tidy \
+ && go list -m golang.org/x/crypto \
+ && make \
+ && cp amneziawg-go /usr/local/bin/amneziawg-go
 
 RUN git clone --depth 1 --branch "${AMNEZIAWG_TOOLS_REF}" "${AMNEZIAWG_TOOLS_REPO}" amneziawg-tools \
  && cd amneziawg-tools/src && make \
@@ -28,7 +39,10 @@ RUN git clone --depth 1 --branch "${AMNEZIAWG_TOOLS_REF}" "${AMNEZIAWG_TOOLS_REP
  && if [ -f wg-quick ]; then cp wg-quick /usr/local/bin/awg-quick; fi
 
 # --- stage 2: runtime -------------------------------------------------------
-FROM alpine:3.21 AS runtime
+FROM alpine:3.23 AS runtime
+
+# Пакеты базы обновляем на момент сборки: trivy --ignore-unfixed учитывает только исправимые CVE.
+RUN apk upgrade --no-cache
 
 LABEL org.opencontainers.image.title="awg-dash" \
       org.opencontainers.image.description="AmneziaWG gateway with intelligent routing: REST API + Web UI + split-tunnel" \