New build process created
This commit is contained in:
Raj Chaudhuri committed
1 parent
273c611d43
commit
90a5d945c2
14 files changed
+614
-197
No files matched your search
@@ -0,0 +1,13 @@
|
||||
# Git status should be ignored
|
||||
.git
|
||||
|
||||
# .dockerignore should be ignored
|
||||
.dockerignore
|
||||
|
||||
# Almost all of the reweave directory
|
||||
# should be ignored
|
||||
reweave/build/Dockerfile
|
||||
reweave/tools/
|
||||
reweave/scans/
|
||||
reweave/Makefile
|
||||
reweave/*.md
|
||||
@@ -0,0 +1,95 @@
|
||||
# New Build Process
|
||||
|
||||
This new build process is based on a multi-stage Dockerfile, which combines the build image Dockerfile and all the template-generated final image Dockerfiles from the [old build process](BUILDING-OLD.md).
|
||||
|
||||
> NOTE: The new process currently does not build the weave Docker plugin. Nor does it run any tests. This may change in the future.
|
||||
|
||||
## What you need
|
||||
|
||||
* Docker v23.0.1 or later
|
||||
* An account on an image registry, like the Docker Hub
|
||||
* [grype](https://github.com/anchore/grype) 0.59.0 or later for image scanning
|
||||
* The `tools` directory contents. Run `git submodule update --init`.
|
||||
|
||||
## During development
|
||||
|
||||
At the start of each development cycle, edit [reweave/Makefile](Makefile) and set `IMAGE_VERSION` should be set to something later than the currently published version, perhaps with a prerelease suffix. Also, set `REGISTRY_USER` to a your registry user account.
|
||||
|
||||
After you make code or configurations changes, run the following in the `reweave` directory:
|
||||
|
||||
```bash
|
||||
make
|
||||
```
|
||||
|
||||
This will build all weave net images for your local platform, tag them with your repo user name, and load them to your local docker engine.
|
||||
|
||||
Once the images are built, you can scan the `weave-kube` and `weave-npc` images by running:
|
||||
|
||||
```bash
|
||||
make scan
|
||||
```
|
||||
|
||||
This will scan the images and generate reports in the [scans](scans/) directory.
|
||||
|
||||
## To publish images
|
||||
|
||||
1. Change `IMAGE_VERSION` and `REGISTRY_USER` variables in [reweave/Makefile](Makefile) to their final, publishable versions.
|
||||
2. Build and scan as you would for development.
|
||||
3. Commit and tag your changes.
|
||||
4. Login to your registry account using `docker login`.
|
||||
5. Run the following:
|
||||
|
||||
```bash
|
||||
make publish
|
||||
```
|
||||
|
||||
This will build multi-architecture images, and push them to your registry.
|
||||
|
||||
Don't forget to `docker logout` afterwards.
|
||||
|
||||
## Multi-stage Dockerfile
|
||||
|
||||
The Dockerfile can be found at [reweave/build/Dockerfile](build/Dockerfile). It, and the companion [Makefile](#makefile), build multi-arch images for all weave components.
|
||||
|
||||
### Stage 1 (builderbase)
|
||||
|
||||
The first stage creates a build environment for cross-compiling all weave net executables for all supported architectures. It is built only once for a given build platform. It starts with `golang:1.20.2-bullseye` as a base, and does the following:
|
||||
|
||||
* Installs build essentials and cross-compilers for all supported architectures.
|
||||
* Adds the Debian buster repositories. This is because the last supported version of `libpcap` that allows static linking (1.8.1) is not present in the Debian bullseye repos.
|
||||
* Installs `libpcap-dev`, pinned to v1.8.1.
|
||||
|
||||
### Stage 2 (builder)
|
||||
|
||||
The second stage is where the weave net executables are built. It is built once for each target architecture.
|
||||
|
||||
It starts from `builderbase` as the base, and does the following:
|
||||
|
||||
* Sets environment variables indicating the current build and target architectures
|
||||
* Copies in the source code
|
||||
* Downloads modules
|
||||
* Uses the [Makefile](#makefile) to build all weave net executables for the target architecture
|
||||
|
||||
### Stage 3 (alpinebase)
|
||||
|
||||
All weave net images ultimately derive from an Alpine base image. This stage allows customization of an official Alpine image, and using the customized image as the base for the weave net images. Currently, there is no customization required.
|
||||
|
||||
### Subsequent stages
|
||||
|
||||
Each of the subsequent stages builds one image, corresponding to one component of weave net. These start from `alpinebase`, or `weaverimage` (Stage 4) as the base, and add what executables, scripts and configuration they need from `builder`.
|
||||
|
||||
## Makefile
|
||||
|
||||
The [Makefile](build/Makefile) is a distilled version of the [old Makefile](../Makefile). It only builds executables. It invokes the correct C cross-compiler, and picks up the correct static `libpcap`, based on the target architecture. It is meant be used only in Stage 2 of the build process, and not directly.
|
||||
|
||||
## build-images.sh
|
||||
|
||||
This script invokes `docker buildx build` for each stage from stage 4 onwards. By default, it builds for all supported platforms, tags the image as `weaveworks/IMAGENAME:CURRENTVERSION`, and keeps them in the build cache. This behavior can be controlled by setting the following environment variables before invoking the script.
|
||||
|
||||
|Env Var Name|Description|Default Value|
|
||||
|---|---|---|
|
||||
|IMAGE_VERSION|The tag part of the name (after `:`) for all weave net images.|*version set in script file*|
|
||||
|REGISTRY_USER|The account name (with optional registry name in front) used to tag all weave net images.|`weaveworks`|
|
||||
|PLATFORMS|Comma-separated list of the target platforms for which the weave net images will be built.|`linux/amd64,linux/arm,linux/arm64,linux/ppc64le,linux/s390x`|
|
||||
|POSTBUILD|Whether to push the images after build (`--push`) , or load them to the local Docker engine (`--load`). `--load` is only possible if PLATFORMS has the same value as the build platform. If left empty, the images will be built in the build cache only.||
|
||||
|ALPINE_BASEIMAGE|The qualified name for the base Alpine image used to build all weave net images.|`alpine:3.17.2`|
|
||||
+17
-1
@@ -2,6 +2,22 @@
|
||||
|
||||
All changes made to the weave net codebase during the reweave effort will be documented in this file.
|
||||
|
||||
## 2.8.2-beta0
|
||||
|
||||
A new build process was created here.
|
||||
|
||||
### Added
|
||||
|
||||
* Documentation and tools under the `reweave` directory
|
||||
* .dockerignore in the repository root, to exclude files from the new build process
|
||||
* Multi-stage Dockerfile, and a Makefile for the second stage, in `reweave/build`
|
||||
|
||||
### Changed
|
||||
* Included image building targets in Makefile directly under `reweave`
|
||||
* Changed `IMAGE_VERSION` to `2.8.2-beta0` in Makefile directly under `reweave`
|
||||
* The Alpine base image for all weave net images was set to `alpine:3.17.2` via the multi-stage Dockerfile
|
||||
* Re-generated security scan reports after building with the new process
|
||||
|
||||
## 2.8.1
|
||||
|
||||
This was the last released version of the weave net images before the reweave effort began.
|
||||
@@ -10,4 +26,4 @@ This was the last released version of the weave net images before the reweave ef
|
||||
|
||||
* Documentation and tools under the `reweave` directory
|
||||
* Image security scanning tools
|
||||
* Security scan reports for `weave-kube` and `weave-npc` images.
|
||||
* Security scan reports for `weave-kube` and `weave-npc` images
|
||||
+25
-2
@@ -1,15 +1,38 @@
|
||||
IMAGE_VERSION ?= 2.8.1
|
||||
IMAGE_VERSION ?= 2.8.2-beta0
|
||||
REGISTRY_USER ?= weaveworks
|
||||
|
||||
# Targets
|
||||
.PHONY: build
|
||||
build: submodule
|
||||
REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \
|
||||
PLATFORMS="$$(docker version -f '{{ .Server.Arch }}')" \
|
||||
POSTBUILD=--load \
|
||||
tools/build-images.sh
|
||||
|
||||
.PHONY: scan
|
||||
scan:
|
||||
REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \
|
||||
tools/scan-images.sh
|
||||
|
||||
.PHONY: publish
|
||||
publish: submodule
|
||||
REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \
|
||||
POSTBUILD=--push tools/build-images.sh
|
||||
|
||||
.PHONY: clean-images
|
||||
clean-images:
|
||||
REGISTRY_USER=${REGISTRY_USER} IMAGE_VERSION=${IMAGE_VERSION} \
|
||||
tools/clean-images.sh
|
||||
|
||||
.PHONY: clean-scan
|
||||
clean-scan:
|
||||
tools/clean-scans.sh
|
||||
|
||||
.PHONY: clean
|
||||
clean: clean-scan
|
||||
clean: clean-scan clean-images
|
||||
|
||||
.PHONY: submodule
|
||||
submodule: ../tools/.git
|
||||
|
||||
../tools/.git:
|
||||
git submodule update --init
|
||||
+2
-2
@@ -14,8 +14,8 @@ The current focus of this effort is running weave net as a CNI plugin on Kuberne
|
||||
|
||||
* ~~Document the old build process~~Old build process documented in [BUILDING-OLD.md](BUILDING-OLD.md)
|
||||
* ~~Create a image scanning process and scan current image~~Image scanning process created, scan reports generated for 2.8.1
|
||||
* Create a new build process
|
||||
* Build, generate and test current images
|
||||
* ~~Create a new build process~~New build process created, documented in [BUILDING.md](BUILDING.md)
|
||||
* ~~Build, generate and test current images~~Built and scanned v2.8.2-beta0
|
||||
* Upgrade Go compiler version
|
||||
* Scan images for CVEs
|
||||
* While there are fixable CVEs:
|
||||
|
||||
@@ -0,0 +1,259 @@
|
||||
# syntax=docker/dockerfile:1
|
||||
ARG ALPINE_BASEIMAGE=alpine:3.17.2
|
||||
|
||||
########
|
||||
# Stage 1: go 1.20 on debian bullseye
|
||||
# This installs cross-compilation tools for supported architectures.
|
||||
# It will be built only once for a given build platform. Subsequent
|
||||
# stages will start from this and cross-compile for each target
|
||||
# architecture.
|
||||
FROM --platform=$BUILDPLATFORM golang:1.20.2-bullseye AS builderbase
|
||||
|
||||
# Support Raspberry Pi 2 and newer
|
||||
ENV GOARM 7
|
||||
|
||||
# The names of the architectures that we fetch cross-compilers for
|
||||
# from the Debian packages.
|
||||
ENV DEB_CROSSPLATFORMS \
|
||||
amd64 \
|
||||
armhf \
|
||||
arm64 \
|
||||
ppc64el \
|
||||
s390x
|
||||
|
||||
# Install the build-essential and crossbuild-essential-ARCH packages
|
||||
RUN <<EOCROSSCOMPILERS
|
||||
for platform in ${DEB_CROSSPLATFORMS}; do dpkg --add-architecture $platform; done
|
||||
apt-get update
|
||||
apt-get install -y build-essential
|
||||
for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done
|
||||
apt-get clean
|
||||
rm -rf /var/lib/apt/lists/*
|
||||
EOCROSSCOMPILERS
|
||||
|
||||
# weave net is dependent on libpcap, which it statically links.
|
||||
# Later versions of libpcap do not allow static linking. The
|
||||
# last version in stable Debian repositories which does is 1.8.1
|
||||
# , which is available in the debian buster repos.
|
||||
# Add buster repositories
|
||||
# Install libpcap-dev version 1.8.1-6+deb10u1 for all supported
|
||||
# architectures.
|
||||
RUN <<EOBUSTERREPOS
|
||||
echo "deb http://deb.debian.org/debian/ buster main" > /etc/apt/sources.list.d/busters-repos.list
|
||||
echo "deb-src http://deb.debian.org/debian/ buster main" >> /etc/apt/sources.list.d/busters-repos.list
|
||||
apt-get update
|
||||
for platform in ${DEB_CROSSPLATFORMS}; do apt-get install -y libpcap0.8:${platform}=1.8.1-6+deb10u1 libpcap0.8-dev:${platform}=1.8.1-6+deb10u1 libpcap-dev:${platform}=1.8.1-6+deb10u1; done
|
||||
EOBUSTERREPOS
|
||||
# End Stage 1
|
||||
########
|
||||
|
||||
########
|
||||
# Stage 2: Compile weave-net executables.
|
||||
# This stage builds one image per supported architecture. The
|
||||
# companion Makefile compiles all executables that make up weave
|
||||
# net, for the target architecture. Subsequent stages each build
|
||||
# an image for a single component of weave-net.
|
||||
FROM builderbase AS builder
|
||||
ARG BUILDARCH
|
||||
ARG TARGETARCH
|
||||
ARG WEAVE_VERSION
|
||||
ENV ARCH=${TARGETARCH}
|
||||
ENV BUILDARCH=${BUILDARCH}
|
||||
# Git hash that will be built into executables
|
||||
ENV WEAVE_VERSION=${WEAVE_VERSION}
|
||||
|
||||
WORKDIR /root/weave
|
||||
COPY . .
|
||||
|
||||
RUN go mod download -x
|
||||
RUN <<EOMAKE
|
||||
cd reweave/build
|
||||
CGO_ENABLED=1 make all
|
||||
EOMAKE
|
||||
# End Stage 2
|
||||
########
|
||||
|
||||
########
|
||||
# Stage 3: Alpine Base
|
||||
# This stage exists in case there are any additional tweaks
|
||||
# required in the alpine base image.
|
||||
FROM ${ALPINE_BASEIMAGE} as alpinebase
|
||||
# Any additional tweaks will appear here
|
||||
# End Stage 3
|
||||
########
|
||||
|
||||
########
|
||||
# Stage 4: Weaver image
|
||||
# This will be tagged as REGISTRY_USER/weave:VERSION
|
||||
FROM alpinebase AS weaverimage
|
||||
|
||||
LABEL works.weave.role="system" \
|
||||
maintainer="Weaveworks <help@weave.works>" \
|
||||
org.opencontainers.image.title="Weave Net" \
|
||||
org.opencontainers.image.description="Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery" \
|
||||
org.opencontainers.image.url="https://weave.works" \
|
||||
org.opencontainers.image.source="https://github.com/weaveworks/weave" \
|
||||
org.opencontainers.image.vendor="Weaveworks" \
|
||||
org.label-schema.schema-version="1.0" \
|
||||
org.label-schema.name="Weave Net" \
|
||||
org.label-schema.description="Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery" \
|
||||
org.label-schema.url="https://weave.works" \
|
||||
org.label-schema.vcs-url="https://github.com/weaveworks/weave" \
|
||||
org.label-schema.vendor="Weaveworks"
|
||||
|
||||
RUN apk add --update \
|
||||
curl \
|
||||
iptables \
|
||||
ipset \
|
||||
iproute2 \
|
||||
conntrack-tools \
|
||||
bind-tools \
|
||||
ca-certificates \
|
||||
&& rm -rf /var/cache/apk/*
|
||||
|
||||
COPY --from=builder /root/weave/weave /root/weave/prog/weaver/weaver /home/weave/
|
||||
COPY --from=builder /root/weave/prog/weaveutil/weaveutil /usr/bin/
|
||||
COPY --from=builder /root/weave/prog/weaver/weavedata.db /weavedb/
|
||||
ENTRYPOINT ["/home/weave/weaver"]
|
||||
WORKDIR /home/weave
|
||||
|
||||
ARG revision
|
||||
ARG imageversion
|
||||
LABEL org.opencontainers.image.revision="${revision}" \
|
||||
org.label-schema.vcs-ref="${revision}" \
|
||||
org.reweave.image-version="${imageversion}"
|
||||
# End Stage 4
|
||||
########
|
||||
|
||||
########
|
||||
# Stage 5: weaveexec image
|
||||
# This will be tagged as REGISTRY_USER/weaveexec:VERSION
|
||||
FROM weaverimage AS weavexecimage
|
||||
|
||||
LABEL maintainer="Weaveworks <help@weave.works>" \
|
||||
org.opencontainers.image.title="weaveexec" \
|
||||
org.opencontainers.image.source="https://github.com/weaveworks/weave" \
|
||||
org.opencontainers.image.vendor="Weaveworks"
|
||||
|
||||
ENTRYPOINT ["/home/weave/sigproxy", "/home/weave/weave"]
|
||||
|
||||
COPY --from=builder /root/weave/prog/sigproxy/sigproxy /root/weave/prog/weaveexec/symlink /home/weave/
|
||||
COPY --from=builder /root/weave/prog/weavewait/weavewait /w/w
|
||||
COPY --from=builder /root/weave/prog/weavewait/weavewait_noop /w-noop/w
|
||||
COPY --from=builder /root/weave/prog/weavewait/weavewait_nomcast /w-nomcast/w
|
||||
WORKDIR /home/weave
|
||||
|
||||
ARG revision
|
||||
ARG imageversion
|
||||
LABEL org.opencontainers.image.revision="${revision}" \
|
||||
org.reweave.image-version="${imageversion}"
|
||||
# End Stage 5
|
||||
########
|
||||
|
||||
########
|
||||
# Stage 6: weavekube image
|
||||
# This will be tagged as REGISTRY_USER/weave-kube:VERSION
|
||||
FROM weaverimage AS weavekubeimage
|
||||
|
||||
LABEL maintainer="Weaveworks <help@weave.works>" \
|
||||
org.opencontainers.image.title="weave-kube" \
|
||||
org.opencontainers.image.source="https://github.com/weaveworks/weave" \
|
||||
org.opencontainers.image.vendor="Weaveworks"
|
||||
|
||||
COPY --from=builder /root/weave/prog/weave-kube/init.sh /root/weave/prog/weave-kube/launch.sh /root/weave/prog/kube-utils/kube-utils /home/weave/
|
||||
ENTRYPOINT ["/home/weave/launch.sh"]
|
||||
|
||||
ARG revision
|
||||
ARG imageversion
|
||||
LABEL org.opencontainers.image.revision="${revision}" \
|
||||
org.reweave.image-version="${imageversion}"
|
||||
# End Stage 6
|
||||
########
|
||||
|
||||
########
|
||||
# Stage 7: weavenpc image
|
||||
# This will be tagged as REGISTRY_USER/weave-npc:VERSION
|
||||
FROM alpinebase AS weavenpcimage
|
||||
|
||||
LABEL works.weave.role="system" \
|
||||
maintainer="Weaveworks <help@weave.works>" \
|
||||
org.opencontainers.image.title="Weave Net" \
|
||||
org.opencontainers.image.description="Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery" \
|
||||
org.opencontainers.image.url="https://weave.works" \
|
||||
org.opencontainers.image.source="https://github.com/weaveworks/weave" \
|
||||
org.opencontainers.image.vendor="Weaveworks" \
|
||||
org.label-schema.schema-version="1.0" \
|
||||
org.label-schema.name="Weave Net" \
|
||||
org.label-schema.description="Weave Net creates a virtual network that connects Docker containers across multiple hosts and enables their automatic discovery" \
|
||||
org.label-schema.url="https://weave.works" \
|
||||
org.label-schema.vcs-url="https://github.com/weaveworks/weave" \
|
||||
org.label-schema.vendor="Weaveworks"
|
||||
|
||||
RUN apk add --update \
|
||||
iptables \
|
||||
ipset \
|
||||
ulogd \
|
||||
&& rm -rf /var/cache/apk/* \
|
||||
&& mknod /var/log/ulogd.pcap p
|
||||
COPY --from=builder /root/weave/prog/weave-npc/weave-npc /usr/bin/weave-npc
|
||||
COPY --from=builder /root/weave/prog/weave-npc/ulogd.conf /etc/ulogd.conf
|
||||
COPY --from=builder /root/weave/prog/weave-npc/launch.sh /usr/bin/
|
||||
ENTRYPOINT ["/usr/bin/launch.sh"]
|
||||
|
||||
ARG revision
|
||||
ARG imageversion
|
||||
LABEL org.opencontainers.image.revision="${revision}" \
|
||||
org.label-schema.vcs-ref="${revision}" \
|
||||
org.reweave.image-version="${imageversion}"
|
||||
# End Stage 7
|
||||
########
|
||||
|
||||
########
|
||||
# Stage 8: weavedb image
|
||||
# This is a nearly-empty image that we use to create a data-only
|
||||
# container for persistence.
|
||||
# This will be tagged as REGISTRY_USER/weavedb:VERSION
|
||||
FROM scratch AS weavedbimage
|
||||
|
||||
LABEL works.weave.role="system" \
|
||||
maintainer="Weaveworks <help@weave.works>" \
|
||||
org.opencontainers.image.title="weavedb" \
|
||||
org.opencontainers.image.source="https://github.com/weaveworks/weave" \
|
||||
org.opencontainers.image.vendor="Weaveworks"
|
||||
|
||||
ENTRYPOINT ["data-only"]
|
||||
# Workaround for Docker refusing to save an empty image
|
||||
COPY --from=builder /etc/os-release /etc/os-release
|
||||
|
||||
ARG revision
|
||||
ARG imageversion
|
||||
LABEL org.opencontainers.image.revision="${revision}" \
|
||||
org.reweave.image-version="${imageversion}"
|
||||
# End Stage 8
|
||||
########
|
||||
|
||||
########
|
||||
# Stage 9: Network tester
|
||||
# This will be tagged as REGISTRY_USER/network-tester:VERSION
|
||||
#
|
||||
# Copyright 2016 The Kubernetes Authors.
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License");
|
||||
# you may not use this file except in compliance with the License.
|
||||
# You may obtain a copy of the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS,
|
||||
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
||||
# See the License for the specific language governing permissions and
|
||||
# limitations under the License.
|
||||
|
||||
FROM bash AS networktesterimage
|
||||
RUN apk add --no-cache curl bind-tools
|
||||
COPY --from=builder /root/weave/test/images/network-tester/webserver webserver
|
||||
EXPOSE 8080
|
||||
ENTRYPOINT ["/webserver"]
|
||||
# End Stage 9
|
||||
########
|
||||
@@ -0,0 +1,112 @@
|
||||
.DEFAULT: all
|
||||
.PHONY: all showbuild exes
|
||||
|
||||
# This specifies the architecture we're building for, in GOARCH format
|
||||
ARCH?=amd64
|
||||
|
||||
# This specifies the architecture we are building on , in GOARCH format
|
||||
BUILDARCH?=amd64
|
||||
|
||||
# A list of all supported architectures here. Should be named as Go is
|
||||
# naming platforms.
|
||||
# All supported architectures must have an "ifeq" block below that
|
||||
# selects the corrsponding Debian platform architecture in CCARCH
|
||||
ALL_ARCHITECTURES=amd64 arm arm64 ppc64le s390x
|
||||
|
||||
# We need the Debian platform architecture format, for
|
||||
# crosscompilation
|
||||
ifeq ($(ARCH),amd64)
|
||||
CCARCH=x86_64-linux-gnu
|
||||
endif
|
||||
ifeq ($(ARCH),arm)
|
||||
CCARCH=arm-linux-gnueabihf
|
||||
endif
|
||||
ifeq ($(ARCH),arm64)
|
||||
CCARCH=aarch64-linux-gnu
|
||||
endif
|
||||
ifeq ($(ARCH),ppc64le)
|
||||
CCARCH=powerpc64le-linux-gnu
|
||||
endif
|
||||
ifeq ($(ARCH),s390x)
|
||||
CCARCH=s390x-linux-gnu
|
||||
endif
|
||||
|
||||
# Set the architecture-specific C compiler and library
|
||||
# load path.
|
||||
ifeq ($(ARCH),$(BUILDARCH))
|
||||
CC=gcc
|
||||
CGO_LDFLAGS=
|
||||
else
|
||||
CC=$(CCARCH)-gcc
|
||||
CGO_LDFLAGS=-L/usr/lib/$(CCARCH)
|
||||
endif
|
||||
|
||||
# The default version that's chosen when pushing the images. Can/should be overridden
|
||||
#GIT_REVISION=$(shell git rev-parse HEAD)
|
||||
# Git commit hash that will be built into executables
|
||||
WEAVE_VERSION?=git-$(shell git rev-parse --short=12 HEAD)
|
||||
|
||||
# Paths to all relevant binaries that should be compiled
|
||||
WEAVER_EXE=../../prog/weaver/weaver
|
||||
SIGPROXY_EXE=../../prog/sigproxy/sigproxy
|
||||
KUBEUTILS_EXE=../../prog/kube-utils/kube-utils
|
||||
WEAVENPC_EXE=../../prog/weave-npc/weave-npc
|
||||
WEAVEWAIT_EXE=../../prog/weavewait/weavewait
|
||||
WEAVEWAIT_NOOP_EXE=../../prog/weavewait/weavewait_noop
|
||||
WEAVEWAIT_NOMCAST_EXE=../../prog/weavewait/weavewait_nomcast
|
||||
WEAVEUTIL_EXE=../../prog/weaveutil/weaveutil
|
||||
RUNNER_EXE=../../tools/runner/runner
|
||||
TEST_TLS_EXE=../../test/tls/tls
|
||||
NETWORKTESTER_EXE=../../test/images/network-tester/webserver
|
||||
|
||||
# All binaries together in a list
|
||||
EXES=$(WEAVER_EXE) $(SIGPROXY_EXE) $(KUBEUTILS_EXE) $(WEAVENPC_EXE) $(WEAVEWAIT_EXE) $(WEAVEWAIT_NOOP_EXE) $(WEAVEWAIT_NOMCAST_EXE) $(WEAVEUTIL_EXE) $(RUNNER_EXE) $(TEST_TLS_EXE) $(NETWORKTESTER_EXE)
|
||||
|
||||
# The flags we are passing to go build. -extldflags -static for making a static binary,
|
||||
# -X main.version for telling the Go binary which version it is,
|
||||
# -s -w drop symbol tables used by debuggers (not Go's internal symbol info)
|
||||
# -tags "osusergo netgo" to use native Go UID and DNS implementations
|
||||
BUILD_FLAGS=-ldflags "-extldflags -static -X main.version=$(WEAVE_VERSION) -s -w" -tags "osusergo netgo"
|
||||
|
||||
# Targets
|
||||
all: showbuild exes
|
||||
|
||||
showbuild:
|
||||
echo Build Arch: $(BUILDARCH)
|
||||
echo Target Arch: $(ARCH)
|
||||
echo CC: $(CC)
|
||||
echo CGO_LDFLAGS: $(CGO_LDFLAGS)
|
||||
|
||||
$(WEAVER_EXE) $(WEAVEUTIL_EXE): ../../common/*.go ../../common/*/*.go ../../net/*.go ../../net/*/*.go
|
||||
$(WEAVER_EXE): ../../router/*.go ../../ipam/*.go ../../ipam/*/*.go ../../db/*.go ../../nameserver/*.go ../../prog/weaver/*.go
|
||||
$(WEAVER_EXE): ../../api/*.go ../../plugin/*.go ../../plugin/*/*
|
||||
$(WEAVER_EXE): ../../proxy/*.go
|
||||
$(WEAVEUTIL_EXE): ../../prog/weaveutil/*.go ../../net/*.go ../../plugin/net/*.go ../../plugin/ipam/*.go ../../db/*.go
|
||||
$(SIGPROXY_EXE): ../../prog/sigproxy/*.go
|
||||
$(KUBEUTILS_EXE): ../../prog/kube-utils/*.go
|
||||
$(WEAVENPC_EXE): ../../prog/weave-npc/*.go ../../npc/*.go ../../npc/*/*.go
|
||||
$(TEST_TLS_EXE): ../../test/tls/*.go
|
||||
$(RUNNER_EXE): ../../tools/runner/*.go
|
||||
$(WEAVEWAIT_NOOP_EXE): ../../prog/weavewait/*.go
|
||||
$(WEAVEWAIT_EXE): ../../prog/weavewait/*.go ../../net/*.go
|
||||
$(WEAVEWAIT_NOMCAST_EXE): ../../prog/weavewait/*.go ../../net/*.go
|
||||
$(NETWORKTESTER_EXE): ../../test/images/network-tester/*.go
|
||||
|
||||
exes: $(EXES)
|
||||
|
||||
$(WEAVER_EXE):
|
||||
CC=$(CC) GOOS=linux GOARCH=$(ARCH) go build $(BUILD_FLAGS) -o $@ ./$(@D)
|
||||
|
||||
$(WEAVEUTIL_EXE) $(KUBEUTILS_EXE) $(WEAVENPC_EXE) $(NETWORKTESTER_EXE):
|
||||
CC=$(CC) GOOS=linux GOARCH=$(ARCH) go build $(BUILD_FLAGS) -o $@ ./$(@D)
|
||||
|
||||
$(WEAVEWAIT_EXE):
|
||||
CC=$(CC) GOOS=linux GOARCH=$(ARCH) go build $(BUILD_FLAGS) -tags "osusergo netgo iface mcast" -o $@ ./$(@D)
|
||||
|
||||
$(WEAVEWAIT_NOMCAST_EXE):
|
||||
CC=$(CC) GOOS=linux GOARCH=$(ARCH) go build $(BUILD_FLAGS) -tags "osusergo netgo iface" -o $@ ./$(@D)
|
||||
|
||||
# These programs need a separate rule as they fail the netgo check in
|
||||
# the main build stanza due to not importing net package
|
||||
$(SIGPROXY_EXE) $(TEST_TLS_EXE) $(WEAVEWAIT_NOOP_EXE) $(RUNNER_EXE):
|
||||
CC=$(CC) GOOS=linux GOARCH=$(ARCH) go build $(BUILD_FLAGS) -o $@ ./$(@D)
|
||||
@@ -1 +1 @@
|
||||
Image version: 2.8.1
|
||||
Image version: 2.8.2-beta0
|
||||
@@ -1 +1 @@
|
||||
weave-kube CVE Count: 163
|
||||
weave-kube CVE Count: 40
|
||||
@@ -1,67 +1,4 @@
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
apk-tools 2.10.4-r2 2.10.6-r0 apk CVE-2021-30139 High
|
||||
apk-tools 2.10.4-r2 2.10.7-r0 apk CVE-2021-36159 Critical
|
||||
bind-libs 9.14.12-r0 9.16.11-r2 apk CVE-2020-8625 High
|
||||
bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25214 Medium
|
||||
bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25215 High
|
||||
bind-libs 9.14.12-r0 9.16.15-r0 apk CVE-2021-25216 Critical
|
||||
bind-libs 9.14.12-r0 9.16.4-r0 apk CVE-2020-8618 Medium
|
||||
bind-libs 9.14.12-r0 9.16.4-r0 apk CVE-2020-8619 Medium
|
||||
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8620 High
|
||||
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8621 High
|
||||
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8622 Medium
|
||||
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8623 High
|
||||
bind-libs 9.14.12-r0 9.16.6-r0 apk CVE-2020-8624 Medium
|
||||
bind-tools 9.14.12-r0 9.16.11-r2 apk CVE-2020-8625 High
|
||||
bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25214 Medium
|
||||
bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25215 High
|
||||
bind-tools 9.14.12-r0 9.16.15-r0 apk CVE-2021-25216 Critical
|
||||
bind-tools 9.14.12-r0 9.16.4-r0 apk CVE-2020-8618 Medium
|
||||
bind-tools 9.14.12-r0 9.16.4-r0 apk CVE-2020-8619 Medium
|
||||
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8620 High
|
||||
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8621 High
|
||||
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8622 Medium
|
||||
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8623 High
|
||||
bind-tools 9.14.12-r0 9.16.6-r0 apk CVE-2020-8624 Medium
|
||||
busybox 1.30.1-r3 apk CVE-2021-42374 Medium
|
||||
busybox 1.30.1-r3 apk CVE-2021-42376 Medium
|
||||
busybox 1.30.1-r3 apk CVE-2021-42378 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42379 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42380 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42381 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42382 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42384 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42385 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42386 High
|
||||
busybox 1.30.1-r3 apk CVE-2022-28391 High
|
||||
busybox 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High
|
||||
curl 7.66.0-r0 apk CVE-2020-8284 Low
|
||||
curl 7.66.0-r0 apk CVE-2021-22897 Medium
|
||||
curl 7.66.0-r0 apk CVE-2021-22922 Medium
|
||||
curl 7.66.0-r0 apk CVE-2021-22923 Medium
|
||||
curl 7.66.0-r0 apk CVE-2021-22925 Medium
|
||||
curl 7.66.0-r0 apk CVE-2021-22926 High
|
||||
curl 7.66.0-r0 apk CVE-2021-22946 High
|
||||
curl 7.66.0-r0 apk CVE-2021-22947 Medium
|
||||
curl 7.66.0-r0 apk CVE-2022-22576 High
|
||||
curl 7.66.0-r0 apk CVE-2022-27774 Medium
|
||||
curl 7.66.0-r0 apk CVE-2022-27775 High
|
||||
curl 7.66.0-r0 apk CVE-2022-27776 Medium
|
||||
curl 7.66.0-r0 apk CVE-2022-27781 High
|
||||
curl 7.66.0-r0 apk CVE-2022-27782 High
|
||||
curl 7.66.0-r0 apk CVE-2022-32206 Medium
|
||||
curl 7.66.0-r0 apk CVE-2022-32207 Critical
|
||||
curl 7.66.0-r0 apk CVE-2022-32208 Medium
|
||||
curl 7.66.0-r0 apk CVE-2022-32221 Critical
|
||||
curl 7.66.0-r0 apk CVE-2022-35252 Low
|
||||
curl 7.66.0-r0 apk CVE-2022-43552 Medium
|
||||
curl 7.66.0-r0 apk CVE-2023-23916 High
|
||||
curl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8169 High
|
||||
curl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8177 High
|
||||
curl 7.66.0-r0 7.66.0-r2 apk CVE-2020-8231 High
|
||||
curl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8285 High
|
||||
curl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8286 High
|
||||
curl 7.66.0-r0 7.66.0-r4 apk CVE-2021-22898 Low
|
||||
github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-76wf-9vgp-pj7w Medium
|
||||
github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-7f33-f4f5-xwgw Low
|
||||
github.com/aws/aws-sdk-go v1.13.22 1.34.0 go-module GHSA-f5pg-7wfw-84q9 Medium
|
||||
@@ -101,65 +38,5 @@ golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1
|
||||
golang.org/x/text v0.3.2 0.3.7 go-module GHSA-ppp9-7jff-5vj2 High
|
||||
golang.org/x/text v0.3.2 0.3.8 go-module GHSA-69ch-w2m2-3vjp High
|
||||
k8s.io/client-go v0.18.6 0.20.0-alpha.2 go-module GHSA-8cfg-vx93-jvxw Medium
|
||||
krb5-libs 1.17-r0 1.17.2-r0 apk CVE-2020-28196 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2021-3711 Critical
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2021-3712 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2021-4160 Medium
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-0778 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-1292 Critical
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-2068 Critical
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-2097 Medium
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-4304 Medium
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-4450 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2023-0215 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2023-0286 High
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High
|
||||
libcurl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8169 High
|
||||
libcurl 7.66.0-r0 7.66.0-r1 apk CVE-2020-8177 High
|
||||
libcurl 7.66.0-r0 7.66.0-r2 apk CVE-2020-8231 High
|
||||
libcurl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8285 High
|
||||
libcurl 7.66.0-r0 7.66.0-r3 apk CVE-2020-8286 High
|
||||
libcurl 7.66.0-r0 7.66.0-r4 apk CVE-2021-22898 Low
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2021-3711 Critical
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2021-3712 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2021-4160 Medium
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-0778 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-1292 Critical
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-2068 Critical
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-2097 Medium
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-4304 Medium
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-4450 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2023-0215 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2023-0286 High
|
||||
libssl1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium
|
||||
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low
|
||||
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High
|
||||
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium
|
||||
libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium
|
||||
libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High
|
||||
libxml2 2.9.9-r3 2.9.9-r4 apk CVE-2020-24977 Medium
|
||||
libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3517 High
|
||||
libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3518 High
|
||||
libxml2 2.9.9-r3 2.9.9-r5 apk CVE-2021-3537 Medium
|
||||
musl 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium
|
||||
musl-utils 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium
|
||||
protobuf 3.6.1-r1 apk CVE-2021-22570 Medium
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42374 Medium
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42376 Medium
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42378 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42379 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42380 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42381 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42382 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42384 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42385 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42386 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2022-28391 High
|
||||
ssl_client 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High
|
||||
zlib 1.2.11-r1 apk CVE-2018-25032 High
|
||||
zlib 1.2.11-r1 apk CVE-2022-37434 Critical
|
||||
libcrypto3 3.0.8-r0 3.0.8-r1 apk CVE-2023-0464 Unknown
|
||||
libssl3 3.0.8-r0 3.0.8-r1 apk CVE-2023-0464 Unknown
|
||||
@@ -1 +1 @@
|
||||
weave-npc CVE Count: 77
|
||||
weave-npc CVE Count: 15
|
||||
@@ -1,18 +1,4 @@
|
||||
NAME INSTALLED FIXED-IN TYPE VULNERABILITY SEVERITY
|
||||
apk-tools 2.10.4-r2 2.10.6-r0 apk CVE-2021-30139 High
|
||||
apk-tools 2.10.4-r2 2.10.7-r0 apk CVE-2021-36159 Critical
|
||||
busybox 1.30.1-r3 apk CVE-2021-42374 Medium
|
||||
busybox 1.30.1-r3 apk CVE-2021-42376 Medium
|
||||
busybox 1.30.1-r3 apk CVE-2021-42378 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42379 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42380 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42381 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42382 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42384 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42385 High
|
||||
busybox 1.30.1-r3 apk CVE-2021-42386 High
|
||||
busybox 1.30.1-r3 apk CVE-2022-28391 High
|
||||
busybox 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High
|
||||
github.com/gogo/protobuf v1.3.1 1.3.2 go-module GHSA-c3h9-896r-86jm High
|
||||
github.com/prometheus/client_golang v1.7.1 go-module CVE-2022-21698 High
|
||||
github.com/prometheus/client_golang v1.7.1 1.11.1 go-module GHSA-cg3q-j54f-5p7p High
|
||||
@@ -27,53 +13,5 @@ golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1 0.0.0-2
|
||||
golang.org/x/text v0.3.2 0.3.7 go-module GHSA-ppp9-7jff-5vj2 High
|
||||
golang.org/x/text v0.3.2 0.3.8 go-module GHSA-69ch-w2m2-3vjp High
|
||||
k8s.io/client-go v0.18.6 0.20.0-alpha.2 go-module GHSA-8cfg-vx93-jvxw Medium
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2021-3711 Critical
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2021-3712 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2021-4160 Medium
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-0778 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-1292 Critical
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-2068 Critical
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-2097 Medium
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-4304 Medium
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2022-4450 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2023-0215 High
|
||||
libcrypto1.1 1.1.1g-r0 apk CVE-2023-0286 High
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium
|
||||
libcrypto1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2021-3711 Critical
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2021-3712 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2021-4160 Medium
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-0778 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-1292 Critical
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-2068 Critical
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-2097 Medium
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-4304 Medium
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2022-4450 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2023-0215 High
|
||||
libssl1.1 1.1.1g-r0 apk CVE-2023-0286 High
|
||||
libssl1.1 1.1.1g-r0 1.1.1i-r0 apk CVE-2020-1971 Medium
|
||||
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23839 Low
|
||||
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23840 High
|
||||
libssl1.1 1.1.1g-r0 1.1.1j-r0 apk CVE-2021-23841 Medium
|
||||
libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3449 Medium
|
||||
libssl1.1 1.1.1g-r0 1.1.1k-r0 apk CVE-2021-3450 High
|
||||
musl 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium
|
||||
musl-utils 1.1.22-r3 1.1.22-r4 apk CVE-2020-28928 Medium
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42374 Medium
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42376 Medium
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42378 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42379 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42380 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42381 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42382 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42384 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42385 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2021-42386 High
|
||||
ssl_client 1.30.1-r3 apk CVE-2022-28391 High
|
||||
ssl_client 1.30.1-r3 1.30.1-r5 apk CVE-2021-28831 High
|
||||
zlib 1.2.11-r1 apk CVE-2018-25032 High
|
||||
zlib 1.2.11-r1 apk CVE-2022-37434 Critical
|
||||
libcrypto3 3.0.8-r0 3.0.8-r1 apk CVE-2023-0464 Unknown
|
||||
libssl3 3.0.8-r0 3.0.8-r1 apk CVE-2023-0464 Unknown
|
||||
Executable
+60
@@ -0,0 +1,60 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
# These variables are used to tag the images. Change as
|
||||
# required.
|
||||
: "${IMAGE_VERSION:=}"
|
||||
: "${REGISTRY_USER:=}"
|
||||
|
||||
if [ -z "${IMAGE_VERSION}" ] || [ -z "${REGISTRY_USER}" ] ; then
|
||||
>&2 echo "Please provide valid values for IMAGE_VERSION and REGISTRY_USER."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# These variables are used to control the build process
|
||||
# Change with care.
|
||||
: "${ALPINE_BASEIMAGE:=alpine:3.17.2}"
|
||||
: "${WEAVE_VERSION=git-$(git rev-parse --short=12 HEAD)}"
|
||||
: "${GIT_REVISION=$(git rev-parse HEAD)}"
|
||||
: "${PLATFORMS:=linux/amd64,linux/arm,linux/arm64,linux/ppc64le,linux/s390x}"
|
||||
: "${POSTBUILD:=}"
|
||||
|
||||
# These are the names of the images
|
||||
WEAVER_IMAGE=${REGISTRY_USER}/weave:${IMAGE_VERSION}
|
||||
WEAVEEXEC_IMAGE=${REGISTRY_USER}/weaveexec:${IMAGE_VERSION}
|
||||
WEAVEKUBE_IMAGE=${REGISTRY_USER}/weave-kube:${IMAGE_VERSION}
|
||||
WEAVENPC_IMAGE=${REGISTRY_USER}/weave-npc:${IMAGE_VERSION}
|
||||
WEAVEDB_IMAGE=${REGISTRY_USER}/weavedb:${IMAGE_VERSION}
|
||||
NETWORKTESTER_IMAGE=${REGISTRY_USER}/network-tester:${IMAGE_VERSION}
|
||||
|
||||
build_image() {
|
||||
# Get directory of script file
|
||||
a="/$0"; a="${a%/*}"; a="${a:-.}"; a="${a##/}/"; BINDIR=$(cd "$a"; pwd)
|
||||
|
||||
cd "$BINDIR/../.."
|
||||
|
||||
# shellcheck disable=SC2086
|
||||
docker buildx build \
|
||||
${POSTBUILD} \
|
||||
--platform=${PLATFORMS} \
|
||||
--target="$1" \
|
||||
--build-arg=ALPINE_BASEIMAGE=${ALPINE_BASEIMAGE} \
|
||||
--build-arg=WEAVE_VERSION=${WEAVE_VERSION} \
|
||||
--build-arg=revision=${GIT_REVISION} \
|
||||
--build-arg=imageversion=${IMAGE_VERSION} \
|
||||
-f reweave/build/Dockerfile \
|
||||
-t "$2" \
|
||||
.
|
||||
|
||||
cd -
|
||||
}
|
||||
|
||||
# shellcheck disable=SC2086
|
||||
{
|
||||
build_image "weaverimage" ${WEAVER_IMAGE}
|
||||
build_image "weavexecimage" ${WEAVEEXEC_IMAGE}
|
||||
build_image "weavekubeimage" ${WEAVEKUBE_IMAGE}
|
||||
build_image "weavenpcimage" ${WEAVENPC_IMAGE}
|
||||
build_image "weavedbimage" ${WEAVEDB_IMAGE}
|
||||
build_image "networktesterimage" ${NETWORKTESTER_IMAGE}
|
||||
}
|
||||
Executable
+24
@@ -0,0 +1,24 @@
|
||||
#!/bin/sh
|
||||
set -e
|
||||
|
||||
# These variables are used to tag the images. Change as
|
||||
# required.
|
||||
: "${IMAGE_VERSION:=}"
|
||||
: "${REGISTRY_USER:=}"
|
||||
|
||||
if [ -z "${IMAGE_VERSION}" ] || [ -z "${REGISTRY_USER}" ] ; then
|
||||
>&2 echo "Please provide valid values for IMAGE_VERSION and REGISTRY_USER."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
# These are the names of the images
|
||||
WEAVER_IMAGE=${REGISTRY_USER}/weave:${IMAGE_VERSION}
|
||||
WEAVEEXEC_IMAGE=${REGISTRY_USER}/weaveexec:${IMAGE_VERSION}
|
||||
WEAVEKUBE_IMAGE=${REGISTRY_USER}/weave-kube:${IMAGE_VERSION}
|
||||
WEAVENPC_IMAGE=${REGISTRY_USER}/weave-npc:${IMAGE_VERSION}
|
||||
WEAVEDB_IMAGE=${REGISTRY_USER}/weavedb:${IMAGE_VERSION}
|
||||
NETWORKTESTER_IMAGE=${REGISTRY_USER}/network-tester:${IMAGE_VERSION}
|
||||
|
||||
docker image rm "${WEAVER_IMAGE}" "${WEAVEEXEC_IMAGE}" "${WEAVEKUBE_IMAGE}" \
|
||||
"${WEAVENPC_IMAGE}" "${WEAVEDB_IMAGE}" "${NETWORKTESTER_IMAGE}"
|
||||
|
||||
Reference in new issue
Block a user