From 513554176f36c758ecb01dd7c941fb940bde519b Mon Sep 17 00:00:00 2001 From: Farjaad Rawasia Date: Tue, 1 Sep 2026 12:56:35 -0400 Subject: [PATCH 1/2] fix: upgrade alpine packages in final image to address CVE-2026-63073 The pinned alpine base ships openssl 3.5.7-r0, which is affected by CVE-2026-63073. The patched 3.5.8-r0 is already published in the apk repos, but alpine:latest has not been rebuilt since 3.24.1, so bumping the digest is currently a no-op. Upgrading at build time picks up the patched package now and self-heals future package CVEs between base image rebuilds. Co-Authored-By: Claude Opus 5 (1M context) --- Dockerfile | 1 + 1 file changed, 1 insertion(+) diff --git a/Dockerfile b/Dockerfile index 9c47a57..4e2180b 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,6 +2,7 @@ FROM golang:alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b99 RUN apk --no-cache add ca-certificates FROM alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b +RUN apk --no-cache upgrade ARG TARGETPLATFORM # copy the ca-certificate.crt from the build stage COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ From 3d7328a49449db6cb4b81628a47b08ec6ad7c766 Mon Sep 17 00:00:00 2001 From: Farjaad Rawasia Date: Tue, 1 Sep 2026 13:04:05 -0400 Subject: [PATCH 2/2] docs: explain why the final image upgrades apk packages Co-Authored-By: Claude Opus 5 (1M context) --- Dockerfile | 2 ++ 1 file changed, 2 insertions(+) diff --git a/Dockerfile b/Dockerfile index 4e2180b..1d93908 100644 --- a/Dockerfile +++ b/Dockerfile @@ -2,6 +2,8 @@ FROM golang:alpine@sha256:3ad57304ad93bbec8548a0437ad9e06a455660655d9af011d58b99 RUN apk --no-cache add ca-certificates FROM alpine:latest@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b +# alpine:latest is only rebuilt on alpine point releases, so it can ship packages +# with CVEs that are already patched in the apk repos - pull those fixes in here RUN apk --no-cache upgrade ARG TARGETPLATFORM # copy the ca-certificate.crt from the build stage