sendnrw/netbird
2
0
Fork 0
mirror of https://github.com/netbirdio/netbird.git synced 2026-10-24 14:29:07 +02:00
Code Issues Packages Projects Releases Wiki Activity

[client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys (#8326)

Browse Source 
* [client,proxy,management,signal,relay] Distrust compromised eMudhra CA keys

Eight eMudhra intermediate CA private keys were compromised and browsers
blocked them on 2026-10-17. Our binaries were built with go1.26.7, which
accepts chains through those intermediates whenever the trust store still
holds emSign ECC Root CA - G3. go1.26.10 rejects them in crypto/x509 on
every platform, regardless of the trust store.

The UBI base still ships the root and Red Hat has no fixed package yet, so
the UBI images blocklist it with p11-kit. The ingest image, the UI server
image and the pinned Chainguard digests also carried the root and move to
bases that no longer do.

* [client,proxy,management,signal,relay] Use the fixed UBI base instead of a blocklist

Red Hat shipped ca-certificates 2026.2.92_v9.0.319-90.3 on 2026-10-22,
which drops emSign ECC Root CA - G3 and AAA Certificate Services. The
current ubi9-minimal image carries it, so pin that digest and remove the
p11-kit blocklist step.

* [misc] Pin upload-server images by digest only and restore go.mod comment
This commit is contained in:
Maycon Santos
2026-10-24 01:07:20 +02:00
committed by GitHub
parent 69f13e3733
commit c051ca8f87
21 changed files with 28 additions and 27 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.devcontainer/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM golang:1.26.7-bookworm
FROM golang:1.26.10-bookworm
RUN apt-get update && export DEBIAN_FRONTEND=noninteractive \
&& apt-get -y install --no-install-recommends\
.github/workflows/golang-test-linux.yml
+1 -1
View File
@@ -303,7 +303,7 @@ jobs:
-e GOCACHE=${CONTAINER_GOCACHE} \
-e GOMODCACHE=${CONTAINER_GOMODCACHE} \
-e CONTAINER=${CONTAINER} \
golang:1.26.7-alpine \
golang:1.26.10-alpine \
sh -c ' \
apk update; apk add --no-cache \
ca-certificates iptables ip6tables dbus dbus-dev libpcap-dev build-base; \
client/Dockerfile-rootless.ubi
+1 -1
View File
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed
ARG TARGETPLATFORM
ARG NETBIRD_BINARY=$TARGETPLATFORM/netbird
client/internal/metrics/infra/ingest/Dockerfile
+2 -2
View File
@@ -1,9 +1,9 @@
FROM golang:1.25-alpine AS build
FROM golang:1.26.10-alpine AS build
WORKDIR /app
COPY go.mod main.go ./
RUN CGO_ENABLED=0 go build -o ingest .
FROM alpine:3.20
FROM alpine:3.24
RUN adduser -D -H ingest
COPY --from=build /app/ingest /usr/local/bin/ingest
USER ingest
client/testutil/privileged/runner_test.go
+1 -1
View File
@@ -25,7 +25,7 @@ import (
// (.github/workflows/golang-test-linux.yml, test_client_on_docker).
const (
containerImage = "golang"
containerTag = "1.26.7-alpine"
containerTag = "1.26.10-alpine"
)
const (
client/ui/build/docker/Dockerfile.cross
+1 -1
View File
@@ -13,7 +13,7 @@
# docker run --rm -v $(pwd):/app wails-cross windows amd64
# docker run --rm -v $(pwd):/app wails-cross windows arm64
FROM golang:1.26.7-bookworm
FROM golang:1.26.10-bookworm
ARG TARGETARCH
client/ui/build/docker/Dockerfile.server
+2 -2
View File
@@ -2,7 +2,7 @@
# Multi-stage build for minimal image size
# Build stage
FROM golang:1.26.7-alpine AS builder
FROM golang:1.26.10-alpine AS builder
WORKDIR /app
@@ -22,7 +22,7 @@ RUN go mod tidy
RUN go build -tags server -ldflags="-s -w" -o server .
# Runtime stage - minimal image
FROM gcr.io/distroless/static-debian12
FROM gcr.io/distroless/static-debian13
# Copy the binary
COPY --from=builder /app/server /server
combined/Dockerfile.multistage
+1 -1
View File
@@ -1,4 +1,4 @@
FROM golang:1.26.7-bookworm AS builder
FROM golang:1.26.10-bookworm AS builder
WORKDIR /app
# Install build dependencies
combined/Dockerfile.ubi
+1 -1
View File
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed
ARG TARGETPLATFORM
ARG VERSION=dev
docs/testing-privileged.md
+1 -1
View File
@@ -32,7 +32,7 @@ list; both are optional and default to the full privileged suite.
1. Skips immediately when it detects it is already inside the container
(`DOCKER_CI=true`), so the privileged tests run in place instead of recursing.
2. Otherwise spins up a `golang:1.26.7-alpine` container (matching CI),
2. Otherwise spins up a `golang:1.26.10-alpine` container (matching CI),
bind-mounts the repo and the host Go build/module caches, installs the
required packages, and runs `go test -tags 'devcert privileged'` over the
client packages.
e2e/harness/Dockerfile.client
+1 -1
View File
@@ -3,7 +3,7 @@
# artifact), so this mirrors its alpine runtime + entrypoint while compiling the
# CGO-free client inline. BuildKit cache mounts keep rebuilds incremental.
FROM golang:1.26.7-bookworm AS builder
FROM golang:1.26.10-bookworm AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod go mod download
e2e/harness/Dockerfile.nblink
+1 -1
View File
@@ -8,7 +8,7 @@
# that quietly hands it NET_ADMIN would make the suite prove the opposite of
# what it is for.
FROM golang:1.26.7-bookworm AS builder
FROM golang:1.26.10-bookworm AS builder
WORKDIR /src
COPY go.mod go.sum ./
RUN --mount=type=cache,target=/go/pkg/mod go mod download
go.mod
+1 -1
View File
@@ -4,7 +4,7 @@ go 1.26.0
// Pin the toolchain to a patch release >= go1.26.2
// See https://go.dev/issue/77875.
toolchain go1.26.7
toolchain go1.26.10
require (
cunicu.li/go-rosenpass v0.5.42
management/Dockerfile.multistage
+1 -1
View File
@@ -1,4 +1,4 @@
FROM golang:1.26.7-bookworm AS builder
FROM golang:1.26.10-bookworm AS builder
WORKDIR /app
# Install build dependencies
management/Dockerfile.ubi
+1 -1
View File
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed
ARG TARGETPLATFORM
ARG VERSION=dev
proxy/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM golang:1.26.7-alpine AS builder
FROM golang:1.26.10-alpine AS builder
WORKDIR /app
RUN echo "netbird:x:1000:1000:netbird:/var/lib/netbird:/sbin/nologin" > /tmp/passwd && \
proxy/Dockerfile.multistage
+1 -1
View File
@@ -1,4 +1,4 @@
FROM golang:1.26.7-alpine AS builder
FROM golang:1.26.10-alpine AS builder
WORKDIR /app
COPY go.mod go.sum ./
proxy/Dockerfile.ubi
+1 -1
View File
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed
ARG TARGETPLATFORM
ARG VERSION=dev
relay/Dockerfile.ubi
+1 -1
View File
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed
ARG TARGETPLATFORM
ARG VERSION=dev
signal/Dockerfile.ubi
+1 -1
View File
@@ -1,4 +1,4 @@
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:7fbeae18dc9476399f565e68255f602a3374ea8614ba3d14843565131a13ff93
FROM registry.access.redhat.com/ubi9/ubi-minimal@sha256:2d4c4551af6831dcd26bbf86108c4385de5183ec8fe6b5868f6f9640fe47f4ed
ARG TARGETPLATFORM
ARG VERSION=dev
upload-server/Dockerfile
+6 -5
View File
@@ -16,13 +16,14 @@
# VARIANT=release|debug debug swaps the base for Chainguard busybox (a shell)
# VERSION stamped into the binary the same way goreleaser does
#
# Chainguard publishes only :latest for free, so the bases are pinned by digest
# and moved by Dependabot.
# Images are pinned by digest alone. The builder is golang:1.26.10-bookworm and
# the bases are Chainguard's :latest, the only free tag; bump them by hand with
# docker buildx imagetools inspect <image:tag>.
ARG VARIANT=release
# Pure Go: cross-compile from the build host instead of emulating the target.
FROM --platform=$BUILDPLATFORM golang:1.26.7-bookworm@sha256:e8c859f5632dcfde7b32d2012b4351728f6437930887c2f6a91ea242459e5514 AS builder
FROM --platform=$BUILDPLATFORM golang@sha256:632dff7351799a5a9954a48dc06670ade72ee44e8c351cdc0e5a57af2fea21af AS builder
WORKDIR /app
COPY go.mod go.sum ./
@@ -39,8 +40,8 @@ RUN --mount=type=cache,target=/go/pkg/mod \
-o /out/netbird-upload ./upload-server \
&& mkdir -p /out/var/lib/netbird
FROM cgr.dev/chainguard/static:latest@sha256:41e17ed83c594a64a9396b6ab96dd26d5ddc290dacf4c177464712ff21ad534f AS base-release
FROM cgr.dev/chainguard/busybox:latest@sha256:b2953ab1cae4a6265e18cf675851bd99975211b150d7a014774911d76eb309ba AS base-debug
FROM cgr.dev/chainguard/static@sha256:17367e4d3ae2b46c3290858e483fac09be085c92b372360fe3bf6a6150848fde AS base-release
FROM cgr.dev/chainguard/busybox@sha256:98e9e7306c899a8af252ef1ff50c54def91c2fe04677298eafdf0b902f2980ed AS base-debug
# hadolint ignore=DL3006
FROM base-${VARIANT}