Patch vulnerabilities and exposures for the Verified Catalogs

[QuanZhang-William]

In TEP-0115, we selected 5 resources to be supported at Verified support tier, where the @tektoncd/catalog-maintainers are expected to patch the detected CVEs.

In TEP-0079, we have proposed to use the Artifact Hub Scanner service (which uses Trivy) to generate vulnerability reports and displayed on the Artifact Hub.

Here is the list of resources (and the underlying images) that will be serviced at Verified tier:

• git-batch-merge [security report]
  • gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.18.1
• git-clone [security report]
  • gcr.io/tekton-releases/github.com/tektoncd/pipeline/cmd/git-init:v0.40.2
• kaniko [security report]
  • gcr.io/kaniko-project/executor:v1.5.1@sha256:c6166717f7fe0b7da44908c986137ecfeab21f31ec3992f6e128fff8a94be8a5
  • docker.io/library/bash:5.1.4@sha256:c523c636b722339f41b6a431b44588ab2f762c5de5ec3bd7964420ff982fb1d9
• golang-build [security report]
  • docker.io/library/golang:latest
  • golang-test uses the same image as golang-build

The security reports for the above resources currently contains a bunch of CVEs, which should be addressed before we can claim these are the Verified Catalogs.

We can create separate issues to track the progress for each resource.

Steps to Reproduce the Problem

The Artifact Hub uses Trivy to scan the container images, you can get the same security report by running Trivy locally:

1. Install Trivy
2. run trivy image [container image name]

@tektoncd/catalog-maintainers

[tekton-robot]

Issues go stale after 90d of inactivity. Mark the issue as fresh with /remove-lifecycle stale with a justification. Stale issues rot after an additional 30d of inactivity and eventually close. If this issue is safe to close now please do so with /close with a justification. If this issue should be exempted, mark the issue as frozen with /lifecycle frozen with a justification.

/lifecycle stale

Send feedback to tektoncd/plumbing.

[vinamra28]

/remove-lifecycle stale /lifecycle frozen this we might revisit in future