search

estesp / manifest-tool

Command line tool to create and query container image manifest list/indexes
Apache License 2.0
741 stars 92 forks source link

New release for Golang CVE #205

Closed jingyuanliang closed 1 year ago

jingyuanliang commented 1 year ago

Will we get a new release for the recent Golang stdlib CVEs?

estesp commented 1 year ago

I had some issues in main since the last release that needed solving; now that I believe those are resolved, and I've done the stdlib and Go version updates, I should be able to release 2.0.7 in the next few days.

jwboyer commented 1 year ago

There's also now a containerd CVE which is conveniently fixed by some updated vendoring in the latest commits. Is that new release coming soon?

estesp commented 1 year ago

Yes; I waited because I wanted to verify there was no new issue with credential helpers that came up in another report; I was able to verify credential helpers are working properly yesterday, so now I can cut a release. Probably will get it out before the end of the day since there is nothing else other than starting the process left

jwboyer commented 1 year ago

Nice! You remain one of my heroes :smile:

estesp commented 1 year ago

Release v2.0.7 is in process in GitHub Actions: https://github.com/estesp/manifest-tool/actions/runs/4327070051

estesp commented 1 year ago

Ugh; there is an issue with public repo inspect related to the 401 challenge returned by DockerHub even for public images. Please don't update to v2.0.7 for now; I will have a fix soon

estesp commented 1 year ago

Release v2.0.8 is in process; sorry for the churn!

estesp commented 1 year ago

v2.0.8 is now final and working; container images are being pushed to DockerHub

estesp commented 1 year ago

Nice! You remain one of my heroes 😄

By the way, you are too kind! Hope you are doing well @jwboyer!