embeddevio
b69c3b67e2
fix( #61 ): не оставлять pip в runtime-образе
...
ci / lint (push) Successful in 52s
ci / lint (pull_request) Successful in 44s
contract-openapi / openapi-contract (push) Successful in 50s
contract-openapi / ts-client-is-current (push) Successful in 52s
contract-openapi / openapi-contract (pull_request) Failing after 13m2s
ci / unit (push) Has been cancelled
ci / security (push) Has been cancelled
ci / unit (pull_request) Has been cancelled
ci / security (pull_request) Has been cancelled
contract-openapi / ts-client-is-current (pull_request) Has been cancelled
ci / build (push) Has been cancelled
ci / image-scan (push) Has been cancelled
ci / push (push) Has been cancelled
ci / build (pull_request) Has been cancelled
ci / image-scan (pull_request) Has been cancelled
ci / push (pull_request) Has been cancelled
trivy разбирает pip/_vendor/vendor.txt и репортит вендоренные msgpack 1.1.2 /
urllib3 2.7.0 / setuptools 70.3.0 как установленные пакеты — при том что в venv
реально стоят 1.2.4 / 2.8.0 / 84.2.1 (проверено pip list внутри образа staging-cc3621a1).
py3-pip переведён в .build-deps и удаляется вместе с ними; pip в venv и системный
pip вычищаются — runtime не должен содержать инсталлятора.
Refs #61
2026-10-29 22:41:58 +03:00
embeddevio
cc3621a12b
fix( #61 ): пины транзитивных python-зависимостей под гейт image-scan
...
ci / lint (push) Successful in 51s
ci / lint (pull_request) Successful in 44s
contract-openapi / openapi-contract (push) Successful in 49s
contract-openapi / ts-client-is-current (push) Successful in 43s
contract-openapi / openapi-contract (pull_request) Successful in 58s
contract-openapi / ts-client-is-current (pull_request) Successful in 49s
ci / unit (push) Successful in 51s
ci / security (push) Successful in 1m11s
ci / unit (pull_request) Successful in 56s
ci / security (pull_request) Successful in 2m42s
ci / build (push) Successful in 5m35s
ci / build (pull_request) Failing after 42s
ci / image-scan (push) Failing after 45s
ci / image-scan (pull_request) Has been skipped
ci / push (push) Has been skipped
ci / push (pull_request) Has been skipped
После бампа Go/alpine/x-crypto/x-net в образе остались 5 HIGH — все в venv:
urllib3 2.7.0 → 2.8.0, msgpack 1.1.2 → 1.2.3, setuptools 70.3.0 → 78.1.1
Refs #61
2026-10-29 22:16:53 +03:00
embeddevio
ea63e904b4
fix( #61 ): x/crypto v0.58.0 + x/net v0.62.0
...
ci / lint (pull_request) Successful in 47s
contract-openapi / openapi-contract (push) Successful in 53s
contract-openapi / ts-client-is-current (push) Successful in 36s
contract-openapi / openapi-contract (pull_request) Successful in 58s
contract-openapi / ts-client-is-current (pull_request) Successful in 42s
ci / unit (pull_request) Successful in 53s
ci / security (pull_request) Successful in 1m21s
ci / build (pull_request) Successful in 40s
ci / image-scan (pull_request) Failing after 7s
ci / push (pull_request) Has been skipped
ci / lint (push) Successful in 50s
ci / unit (push) Successful in 52s
ci / security (push) Successful in 1m19s
ci / build (push) Successful in 39s
ci / image-scan (push) Failing after 3s
ci / push (push) Has been skipped
После бампа Go 1.26 / alpine 3.23 в образе остались только Go-модули:
x/crypto v0.43.0 — 5 HIGH (ssh*, фиксы до v0.55.0)
x/net v0.45.0 — 16 HIGH (http2/idna/dnsmessage, фиксы до v0.60.0)
Оба подняты на актуальные версии из proxy.golang.org (v0.58.0 / v0.62.0).
В alpine 3.23.7 находок нет (66 пакетов).
Refs #61
2026-10-29 21:51:41 +03:00
embeddevio
20db51b7a2
fix( #61 ): бамп базовых образов и x/crypto под гейт image-scan
...
ci / lint (push) Successful in 40s
ci / lint (pull_request) Successful in 40s
contract-openapi / openapi-contract (push) Successful in 51s
contract-openapi / ts-client-is-current (push) Successful in 42s
contract-openapi / openapi-contract (pull_request) Successful in 54s
contract-openapi / ts-client-is-current (pull_request) Successful in 39s
ci / unit (push) Successful in 46s
ci / security (push) Successful in 1m24s
ci / unit (pull_request) Successful in 58s
ci / security (pull_request) Successful in 1m27s
ci / build (push) Successful in 9m44s
ci / build (pull_request) Successful in 35s
ci / image-scan (push) Failing after 7s
ci / image-scan (pull_request) Failing after 3s
ci / push (push) Has been skipped
ci / push (pull_request) Has been skipped
- GO_IMAGE golang:1.25-alpine → golang:1.26-alpine (CVE Go stdlib 1.25.14: CVE-2026-56857 CRITICAL, CVE-2026-111943/78667/97031 HIGH)
- golang.org/x/crypto → v0.43.0 в amneziawg-go (CVE-2025-47913 HIGH)
- runtime alpine:3.21 → alpine:3.23 + apk upgrade (HIGH в пакетах базы)
Refs #61 , Refs #18 , Refs #17
2026-10-29 21:09:52 +03:00
embeddevio
e153143cc1
Merge branch 'main' into feat/18-docker-runtime
ci / lint (push) Successful in 51s
ci / lint (pull_request) Successful in 49s
contract-openapi / openapi-contract (push) Successful in 59s
contract-openapi / ts-client-is-current (push) Successful in 48s
contract-openapi / openapi-contract (pull_request) Successful in 59s
contract-openapi / ts-client-is-current (pull_request) Successful in 43s
ci / unit (push) Successful in 52s
ci / security (push) Successful in 1m21s
ci / unit (pull_request) Successful in 55s
ci / security (pull_request) Successful in 1m20s
ci / build (push) Successful in 36s
ci / build (pull_request) Successful in 36s
ci / image-scan (push) Failing after 3s
ci / image-scan (pull_request) Failing after 3s
ci / push (push) Has been skipped
ci / push (pull_request) Has been skipped
2026-10-29 21:09:40 +03:00
embeddevio
d2f6e89d58
fix( #18 ): создавать /etc/iproute2/rt_tables (в alpine его нет) + понятное предупреждение про ip_forward
2026-10-21 23:47:15 +03:00
embeddevio
789c1854fe
fix( #18 ): amneziawg-tools/src собирает бинарь wg — копируем его как awg (+awg-quick)
2026-10-21 23:42:43 +03:00
embeddevio
ec44dcca4e
fix( #18 ): builder на golang:1.25 — amneziawg-go требует go >= 1.25 (падение сборки на 1.23)
2026-10-21 23:38:47 +03:00
embeddevio
71e9891247
feat( #18 ): супервизор entrypoint.sh и пример .conf
2026-10-21 23:31:04 +03:00
embeddevio
2adc02cb3f
feat( #18 ): multi-stage Dockerfile (awg-tools + runtime alpine)
2026-10-21 23:30:57 +03:00
embeddevio