docker/28.0.1-r2: cve remediation

[octo-sts]

docker/28.0.1-r2: fix GHSA-qxp5-gwg8-xv66

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/docker.advisories.yaml

Source code for this service: https://go/cve-remedy-automation-source

Logs for this execution: https://go/cve-remedy-automation-logs

Docs for this service: (not provided yet)

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

Based on the error message and the melange YAML file, I'll provide a specific analysis and solution:

• Detected Error:

failed to run 'go mod tidy': exit status 1 with output: go: go.mod file not found in current directory or any parent directory

• Error Category: Build Configuration

• Failure Point: The go/bump step in the pipeline attempting to update dependencies

• Root Cause Analysis:
The error occurs because moby/moby uses a custom vendoring system with vendor.mod instead of the standard Go modules system. The go/bump action assumes a standard go.mod file exists.

• Suggested Fix:
Remove the go/bump step and incorporate the dependency update directly in the sed commands:

pipeline:
  - uses: git-checkout
    with:
      repository: https://github.com/moby/moby
      tag: v${{package.version}}
      expected-commit: bbd0a17ccc67e48d4a69393287b7fcc4f0578683

  - runs: |
      # Update golang.org/x/net directly in vendor.mod
      sed -i 's|golang.org/x/net v0.33.0|golang.org/x/net v0.36.0|' vendor.mod
      # ... rest of your existing sed commands ...

• Explanation:
The Docker Engine (moby/moby) project intentionally uses a custom vendoring system with vendor.mod instead of go.mod. The go/bump action is incompatible with this approach. By removing it and handling the dependency update through direct modification of vendor.mod, we maintain the project's intended dependency management system.

• Additional Notes:

• Docker's vendoring system is managed through hack/vendor.sh
• All dependency updates should be done via vendor.mod modifications
• The existing sed commands already handle the necessary security updates
• This approach better aligns with upstream Docker's build system

• References:

• https://github.com/moby/moby/blob/master/vendor.mod
• https://github.com/moby/moby/blob/master/hack/vendor.sh
• https://github.com/moby/moby/blob/master/project/PACKAGERS.md