New CVEs about docker

[timkelty]

@jessedobbelaere almost – Currently we only build/push on releases so the job would also have to tag/release.

But you've inspired me – gonna work on this right now.

[timkelty]

@elivz here is fine, or ping me on Discord.

I'll be automating this shortly, so we'll just get new upstreams nightly.

[elivz]

Ok fine. I take back all those things I said about you, Tim.

[timkelty]

I think that's why I've been dragging my feet. 🫂

[timkelty]

new phone, who dis?

😆 https://github.com/craftcms/docker/actions/runs/5467130524

[elivz]

Ah well. Looks like setuptools isn't updated upstream yet. Still getting the same error. Might have to try again in a day or two.

[jessedobbelaere]

@timkelty Any idea about the automatic nightly builds? Could be as simple as adding a schedule to .github/workflows/build-and-push.yml probably?

on:
  workflow_dispatch:
  push:
    branches:
      - develop
  release:
    types: [published]
+ schedule:
+    - cron: "30 2 * * *"  # Runs at 02:30 UTC every day
permissions:
  contents: read
env:
  BUILD_PLATFORMS: linux/amd64, linux/arm64

[timkelty]

We did it, folks…finally!
Thanks to @jessedobbelaere for the nudge and @elivz and @pixleight for the patience.

Images will be rebuilt and tagged nightly to get upstream patches.

❤️ to open source!

[jessedobbelaere]

Thanks so much @timkelty 🥳 !

[elivz]

Amazing! Admit it, though....you'll miss hearing from me.

[elivz]

@timkelty We've got a few more CVE alerts this week - ncurses & setuptools. Mind rebuilding when get a sec?

[elivz]

@timkelty It's me! Hi! Got a couple more high priority alerts, this time with setuptools and cups. Rebuild plz?

[pixleight]

Hey @timkelty , piggybacking on @elivz — any chance can we try a new build? Looks like we've got a few new vulnerabilities in addition to setuptools:

   Vulnerability    Severity Package                                  Type     Fix version      URL
 - CVE-2023-36664   High     ghostscript-9.56.1-r1                    APKG     9.56.1-r2        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-36664
 - CVE-2023-3446    Unknown  libcrypto1.1-1.1.1u-r1                   APKG     1.1.1u-r2        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3446
 - CVE-2023-3446    Unknown  libssl1.1-1.1.1u-r1                      APKG     1.1.1u-r2        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3446
 - CVE-2023-35945   Unknown  nghttp2-libs-1.47.0-r0                   APKG     1.47.0-r1        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-35945
 - CVE-2023-3446    Unknown  openssl-1.1.1u-r1                        APKG     1.1.1u-r2        https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3446
 - CVE-2022-29858   Medium   assets-1.0.0                             npm      None             https://nvd.nist.gov/vuln/detail/CVE-2022-29858
 - CVE-2022-38724   Medium   assets-1.0.0                             npm      None             https://nvd.nist.gov/vuln/detail/CVE-2022-38724
 - VULNDB-306015    High     setuptools-59.4.0                        python   65.5.1           https://us2.app.sysdig.com/secure//#/scanning/vulnerabilities/VULNDB-306015

[timkelty]

@pixleight 🤞 https://github.com/craftcms/docker/actions/runs/5626052568