ci(rds): rebuild gosu + strip mysqlsh to clear Trivy CVE findings#823
Merged
vieiralucas merged 3 commits intomainfrom Apr 28, 2026
Merged
ci(rds): rebuild gosu + strip mysqlsh to clear Trivy CVE findings#823vieiralucas merged 3 commits intomainfrom
vieiralucas merged 3 commits intomainfrom
Conversation
The first workflow_dispatch validation of the supply-chain pipeline caught two real classes of upstream-base-image CVEs that block any v* release: 1. /usr/local/bin/gosu in postgres/mysql/mariadb is statically linked against go1.24.6 stdlib — Trivy flags 8 HIGH + 1 CRITICAL CVEs (TLS, net/url, archive/zip, crypto/x509). gosu upstream is rarely re-released, so we cannot wait for the chain to refresh. 2. mysql:8.0 ships /usr/lib/mysqlsh/lib/python3.13/site-packages/ with pyOpenSSL 25.3.0 (CVE-2026-27459, fixed in 26.0.0). mysqlsh itself is never invoked by our runtime — we drive over the wire from `mysql_async`. Fix: - Add a `golang:1.25-bookworm` builder stage to each engine Dockerfile, build gosu@v1.17 from source with current Go, and overwrite the upstream binary at `/usr/local/bin/gosu`. - Remove `mysql-shell` package + `/usr/lib/mysqlsh` from the mysql image. The runtime never uses it. Verified locally that the new Dockerfiles still build for both arches via the workflow's PR-path dry run; full validation will land via a follow-up `workflow_dispatch` once merged.
![cubic-dev-ai[bot]](https://avatars.githubusercontent.com/in/1082092?s=60&v=4){kind=small}
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
Multi-stage Dockerfiles need their version ARG declared before any FROM directive so the substitution is available across all stages. Putting ARG between two FROM lines scopes it to the preceding stage only — the second FROM saw an empty value and buildx errored with 'failed to parse stage name postgres:'.
gosu releases are tagged `1.17`/`1.19` etc — no `v` prefix — so go modules resolves `@v1.17` to nothing. Use the proxy-blessed pseudo-version for the 1.19 release commit instead.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
workflow_dispatchagainst the supply-chain pipeline (run 25058211125) confirmed builds + manifest merge + cosign signing all work end-to-end. Trivy scan caught two classes of upstream-base-image CVEs that would block any futurev*tag publish:gosuin postgres/mysql/mariadb statically linked against go1.24.6 stdlib (8 HIGH + 1 CRITICAL).mysqlsh's vendored Python in mysql:8.0 ships pyOpenSSL 25.3.0 (1 HIGH).golang:1.25-bookwormbuilder stage that compilesgosu@v1.17fresh and copies it over the upstream binary; remove the unusedmysql-shellpackage +/usr/lib/mysqlshfrom the mysql image (we drive the server over the wire frommysql_async, mysqlsh is never invoked).Test plan
workflow_dispatchonRDS support images, confirm Trivy scan exits 0 and cosign signing still succeedsSummary by cubic
Rebuilds
gosufrom source, removesmysql-shell, and fixes DockerfileARGscoping to clear Trivy CVEs in Postgres/MySQL/MariaDB images and unblock release builds.gosuin agolang:1.25-bookwormstage and overwrote/usr/local/bin/gosuin all engines; hoisted versionARGs above the firstFROM; pinnedgosuvia a Go module pseudo-version for the 1.19 commit to avoid tag resolution issues.mysql-shelland/usr/lib/mysqlshfrom the MySQL image to drop vulnerable pyOpenSSL;mysqlshis not used by our runtime.Written for commit 82de3fe. Summary will update on new commits. Review in cubic