[docker-ptf]: Upgrade gnmic golang.org/x/* deps to fix security vulne… - #28038
Merged
qiluo-msft merged 1 commit intoJun 23, 2026
Merged
Conversation
…rabilities
The gnmic build (pinned upstream commit 653dc5dd) locks older golang.org/x/*
modules (x/crypto v0.50.0, x/net v0.53.0, x/text v0.36.0, x/sys v0.43.0) that
Trivy/S360 flags as HIGH. Unlike the grpcurl build step, gnmic did not upgrade
these. Add 'go get golang.org/x/{crypto,net,text,sys,oauth2}@latest && go mod
tidy' before the build so gnmic picks up the patched x/* releases, matching the
grpcurl step.
Signed-off-by: Austin Pham <austinpham@microsoft.com>
Collaborator
|
/azp run Azure.sonic-buildimage |
|
Azure Pipelines successfully started running 1 pipeline(s). |
Contributor
There was a problem hiding this comment.
Pull request overview
Updates the docker-ptf image build to ensure the gnmic binary is compiled with patched golang.org/x/* module versions, addressing security scanner findings for the pinned upstream gnmic commit.
Changes:
- Extend the
gnmicbuild step togo getthe latestgolang.org/x/{crypto,net,text,sys,oauth2}modules. - Run
go mod tidybefore buildinggnmicso the updated dependency set is captured for the build.
Comment on lines
+421
to
425
| # forced removal in #27059. The golang.org/x/* modules are additionally | ||
| # upgraded to latest to clear current/future golang.org/x/* CVEs (the | ||
| # pinned commit still locks older x/crypto, x/net, etc.). Temporary until | ||
| # the next tagged gnmic release ships. | ||
| RUN GNMIC_REV=653dc5dd4ddcd3bd4197317875a10c1ce8b06653 \ |
yijingyan2
approved these changes
Jun 23, 2026
qiluo-msft
approved these changes
Jun 23, 2026
6 tasks
roger-nexthop
pushed a commit
to nexthop-ai/sonic-buildimage
that referenced
this pull request
Jul 12, 2026
…rabilities (sonic-net#28038) Why I did it S360 / Trivy container scanning flags the docker-ptf image's gnmic binary (/usr/local/bin/gnmic) with HIGH golang.org/x/* CVEs. The gnmic build was changed (sonic-net#27059) to build from a pinned upstream commit (653dc5dd), which locks older modules — golang.org/x/crypto v0.50.0, x/net v0.53.0, x/text v0.36.0, x/sys v0.43.0. Unlike the grpcurl build step in the same Dockerfile, the gnmic step did not upgrade these, so the vulnerable versions ship in the image. Work item tracking Microsoft ADO: 38538287 How I did it In dockers/docker-ptf/Dockerfile.j2, added go get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest && go mod tidy before go build in the gnmic RUN block, matching the existing grpcurl step. How to verify it Build target/docker-ptf.gz, load it, and scan: trivy image docker-ptf:latest --scanners vuln --ignore-unfixed usr/local/bin/gnmic should report 0 fixable vulns (x/* upgraded to latest). Which release branch to backport (provide reason below if selected) Tested branch (Please provide the tested image version) docker-ptf built from this branch on latest master Description for the changelog [docker-ptf]: Upgrade gnmic golang.org/x/* dependencies to address HIGH CVEs
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why I did it
S360 / Trivy container scanning flags the
docker-ptfimage'sgnmicbinary(
/usr/local/bin/gnmic) with HIGHgolang.org/x/*CVEs. The gnmic build waschanged (#27059) to build from a pinned upstream commit (
653dc5dd), whichlocks older modules —
golang.org/x/crypto v0.50.0,x/net v0.53.0,x/text v0.36.0,x/sys v0.43.0. Unlike thegrpcurlbuild step in the sameDockerfile, the gnmic step did not upgrade these, so the vulnerable
versions ship in the image.
Work item tracking
How I did it
In
dockers/docker-ptf/Dockerfile.j2, addedgo get golang.org/x/crypto@latest golang.org/x/net@latest golang.org/x/text@latest golang.org/x/sys@latest golang.org/x/oauth2@latest && go mod tidybefore
go buildin the gnmicRUNblock, matching the existing grpcurl step.How to verify it
Build
target/docker-ptf.gz, load it, and scan:usr/local/bin/gnmicshould report 0 fixable vulns (x/* upgraded to latest).Which release branch to backport (provide reason below if selected)
Tested branch (Please provide the tested image version)
Description for the changelog
[docker-ptf]: Upgrade gnmic golang.org/x/* dependencies to address HIGH CVEs