From 2d6cb7413d34e5e1ac8b153a9a5ef577bd63bf83 Mon Sep 17 00:00:00 2001 From: phil Date: Tue, 6 Oct 2026 10:06:14 +0900 Subject: [PATCH] fix(deps): bump Go 1.26.8, x/crypto, distroless 13 0.9.x images carry 10 HIGH: Go stdlib 1.26.5, x/crypto 0.54 in the binary, and libssl3 in distroless/cc-debian12 (no fix in bookworm). - go.mod: toolchain go1.26.8; x/crypto v0.57.0, x/net v0.59.0 (x/sys follows). - Dockerfile: builder golang:1.26.8-bookworm, runtime distroless/cc-debian13:nonroot, both pinned by digest. cc stays because the binary is cgo (go-nvml); glibc 2.41 runs a 2.36 build. Local: trivy HIGH,CRITICAL = 0 on the built image, govulncheck clean, go test -race green. Co-Authored-By: Claude Opus 5.5 Signed-off-by: phil --- Dockerfile | 4 ++-- go.mod | 12 +++++++----- go.sum | 12 ++++++------ 3 files changed, 15 insertions(+), 13 deletions(-) diff --git a/Dockerfile b/Dockerfile index 61fd25d..d3afa82 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,7 +9,7 @@ # The previous split (a static image plus a separate `-gpu` variant) meant two # artifacts, two digests to sign, and a values field to pick between them — # for a difference no operator wanted to reason about. -FROM golang:1.26-bookworm AS builder +FROM golang:1.26.8-bookworm@sha256:a688600ca24f8a4d3ca77f95b0dd40704a9fc787c826660eb7ba0b641b8b175d AS builder WORKDIR /src COPY go.mod go.sum* ./ RUN go mod download @@ -22,7 +22,7 @@ ARG VERSION="" RUN CGO_ENABLED=1 GOOS=linux GOARCH=${TARGETARCH} \ go build -trimpath -ldflags="-s -w -X main.version=${VERSION}" -tags gpu -o /out/nodevitals ./cmd/nodevitals -FROM gcr.io/distroless/cc-debian12:nonroot +FROM gcr.io/distroless/cc-debian13:nonroot@sha256:e792ab3d241a468a4fd7519ddbbebe66b49b5f365771716ea688ad40b6c6f1c2 # Links the ghcr package to this repository, so the image shows up under the # repo's Packages and its provenance is traceable from the registry alone. LABEL org.opencontainers.image.source=https://github.com/KeiaiLab/nodevitals diff --git a/go.mod b/go.mod index aa13fe1..178183d 100644 --- a/go.mod +++ b/go.mod @@ -1,15 +1,19 @@ module github.com/KeiaiLab/nodevitals -go 1.26 +go 1.26.0 + +toolchain go1.26.8 require ( github.com/NVIDIA/go-nvml v0.13.3-1 github.com/alecthomas/kingpin/v2 v2.4.0 github.com/anatol/smart.go v0.0.0-20260706181715-5cd61760b880 github.com/prometheus/client_golang v1.23.2 + github.com/prometheus/client_model v0.6.2 github.com/prometheus/node_exporter v1.12.1 github.com/prometheus/procfs v0.21.1 go.etcd.io/bbolt v1.5.0 + golang.org/x/sys v0.48.0 gopkg.in/yaml.v3 v3.0.1 ) @@ -42,16 +46,14 @@ require ( github.com/opencontainers/selinux v1.15.1 // indirect github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect github.com/prometheus-community/go-runit v0.1.0 // indirect - github.com/prometheus/client_model v0.6.2 // indirect github.com/prometheus/common v0.70.0 // indirect github.com/safchain/ethtool v0.7.0 // indirect github.com/xhit/go-str2duration/v2 v2.1.0 // indirect go.uber.org/atomic v1.7.0 // indirect go.uber.org/multierr v1.6.0 // indirect - golang.org/x/crypto v0.54.0 // indirect - golang.org/x/net v0.57.0 // indirect + golang.org/x/crypto v0.57.0 // indirect + golang.org/x/net v0.59.0 // indirect golang.org/x/sync v0.22.0 // indirect - golang.org/x/sys v0.47.0 // indirect google.golang.org/protobuf v1.36.11 // indirect howett.net/plist v1.0.1 // indirect ) diff --git a/go.sum b/go.sum index d0636cf..f2aa4d8 100644 --- a/go.sum +++ b/go.sum @@ -113,16 +113,16 @@ go.uber.org/multierr v1.6.0 h1:y6IPFStTAIT5Ytl7/XYmHvzXQ7S3g/IeZW9hyZ5thw4= go.uber.org/multierr v1.6.0/go.mod h1:cdWPpRnG4AhwMwsgIHip0KRBQjJy5kYEpYjJxpXp9iU= go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ= go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ= -golang.org/x/crypto v0.54.0 h1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw= -golang.org/x/crypto v0.54.0/go.mod h1:KWL8ny2AZdGR2cWmzeHrp2azQPGogOv+HeQaVEXC2dk= -golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= -golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= +golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= +golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= +golang.org/x/net v0.59.0 h1:5zfYln+w5XCxwrnMMJPufRgNoXEaGxl0wo5GqPXyues= +golang.org/x/net v0.59.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20211031064116-611d5d643895/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= -golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= +golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=