From 6258e4d93f9095cd70ee2a8723b51c2b5f9453c4 Mon Sep 17 00:00:00 2001 From: npecka Date: Wed, 20 May 2026 16:06:47 -0500 Subject: [PATCH 1/2] Fixing CVE-2026-25679 --- boilerplate/openshift/golang-osd-e2e/update | 2 +- test/e2e/Dockerfile | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/boilerplate/openshift/golang-osd-e2e/update b/boilerplate/openshift/golang-osd-e2e/update index b0a516a3..2010016c 100755 --- a/boilerplate/openshift/golang-osd-e2e/update +++ b/boilerplate/openshift/golang-osd-e2e/update @@ -23,7 +23,7 @@ mkdir -p "${E2E_SUITE_DIRECTORY}" E2E_SUITE_BUILDER_IMAGE=registry.ci.openshift.org/openshift/release:rhel-9-release-golang-1.25-openshift-4.21 if [[ -n ${KONFLUX_BUILDS} ]]; then - E2E_SUITE_BUILDER_IMAGE="brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.25" + E2E_SUITE_BUILDER_IMAGE="brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.25.8" fi echo "syncing ${E2E_SUITE_DIRECTORY}/Dockerfile" diff --git a/test/e2e/Dockerfile b/test/e2e/Dockerfile index 15a31b90..844d6059 100644 --- a/test/e2e/Dockerfile +++ b/test/e2e/Dockerfile @@ -1,5 +1,5 @@ # THIS FILE IS GENERATED BY BOILERPLATE. DO NOT EDIT. -FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.25 as builder +FROM brew.registry.redhat.io/rh-osbs/openshift-golang-builder:rhel_9_1.25.8 as builder WORKDIR /go/src/github.com/openshift/splunk-forwarder-operator/ COPY . . RUN CGO_ENABLED=0 GOFLAGS="-mod=mod" go test ./test/e2e -v -c --tags=osde2e -o /e2e.test From 2e299d46321bdf6d48f94b4dc0bcd55341ad6919 Mon Sep 17 00:00:00 2001 From: npecka Date: Wed, 20 May 2026 16:34:24 -0500 Subject: [PATCH 2/2] Update boilerplate to v8.3.6 for CVE-2026-25679 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Updates boilerplate version from image-v8.3.4 to image-v8.3.6 which includes golang 1.25.8 builder image for CVE-2026-25679 fix. Changes: - Updated boilerplate metadata to v8.3.6 - Updated operator build Dockerfile to use boilerplate:image-v8.3.6 - Updated UBI minimal base images to 9.8 The e2e test Dockerfile already contains golang 1.25.8 from the initial commit on this branch. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- .ci-operator.yaml | 2 +- boilerplate/_data/backing-image-tag | 2 +- boilerplate/_data/last-boilerplate-commit | 2 +- build/Dockerfile | 4 ++-- build/Dockerfile.olm-registry | 2 +- 5 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.ci-operator.yaml b/.ci-operator.yaml index 559bdf38..188626d7 100644 --- a/.ci-operator.yaml +++ b/.ci-operator.yaml @@ -1,4 +1,4 @@ build_root_image: name: boilerplate namespace: openshift - tag: image-v8.3.4 + tag: image-v8.3.6 diff --git a/boilerplate/_data/backing-image-tag b/boilerplate/_data/backing-image-tag index 77a6bbe4..ca21d244 100644 --- a/boilerplate/_data/backing-image-tag +++ b/boilerplate/_data/backing-image-tag @@ -1 +1 @@ -image-v8.3.4 +image-v8.3.6 diff --git a/boilerplate/_data/last-boilerplate-commit b/boilerplate/_data/last-boilerplate-commit index 4235f5c1..1fc1cbc3 100644 --- a/boilerplate/_data/last-boilerplate-commit +++ b/boilerplate/_data/last-boilerplate-commit @@ -1 +1 @@ -28f0d527a87f963961e218687f8e481acf62e47d +0d8c4f5b1d0cc0be7f35fa2d84430c112eb3a5f0 diff --git a/build/Dockerfile b/build/Dockerfile index 5db18566..e2a1be1b 100644 --- a/build/Dockerfile +++ b/build/Dockerfile @@ -1,9 +1,9 @@ -FROM quay.io/redhat-services-prod/openshift/boilerplate:image-v8.3.4 AS builder +FROM quay.io/redhat-services-prod/openshift/boilerplate:image-v8.3.6 AS builder COPY . /go/src/github.com/openshift/splunk-forwarder-operator WORKDIR /go/src/github.com/openshift/splunk-forwarder-operator RUN make go-build -FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7-1778562320 +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1777460003 ENV OPERATOR_PATH=/go/src/github.com/openshift/splunk-forwarder-operator \ OPERATOR_BIN=splunk-forwarder-operator diff --git a/build/Dockerfile.olm-registry b/build/Dockerfile.olm-registry index 1d247750..196448d3 100644 --- a/build/Dockerfile.olm-registry +++ b/build/Dockerfile.olm-registry @@ -4,7 +4,7 @@ COPY ${SAAS_OPERATOR_DIR} manifests RUN initializer --permissive # ubi-micro does not work for clusters with fips enabled unless we make OpenSSL available -FROM registry.access.redhat.com/ubi9/ubi-minimal:9.7-1778562320 +FROM registry.access.redhat.com/ubi9/ubi-minimal:9.8-1777460003 COPY --from=builder /bin/registry-server /bin/registry-server COPY --from=builder /bin/grpc_health_probe /bin/grpc_health_probe