coredns/1.12.0-r1: cve remediation

[octo-sts]

coredns/1.12.0-r1: fix GHSA-v778-237x-gjrc

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/coredns.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: "go.mod requires go >= 1.23.4 (running go 1.23.3; GOTOOLCHAIN=go1.23.3)"

• Error Category: Version

• Failure Point: make gen command in the kuma-coredns subpackage pipeline

• Root Cause Analysis: There's a version mismatch between the Go toolchain version available in the build environment (1.23.3) and the version required by the project's go.mod file (1.23.4)

• Suggested Fix:
Update the environment section in the melange YAML to specify the correct Go version:

environment:
  contents:
    packages:
      - libcap-utils
      - make
      - go-1.23=1.23.4-r0  # Explicitly specify the required Go version

• Explanation:
The build is failing because the Go toolchain version available (1.23.3) is older than what's required by the project (1.23.4). By explicitly specifying go-1.23=1.23.4-r0 in the environment packages, we ensure the correct Go version is available during the build process.

• Additional Notes:

• This issue commonly occurs when the Go version requirements in go.mod don't match the available toolchain
• The error is in the subpackage build step, but fixing the Go version in the main environment will resolve it
• It's important to keep the Go toolchain version aligned with the project's requirements

• References:

• Go Release Notes: https://golang.org/doc/devel/release#go1.23.4
• Wolfi OS Package Repository: https://packages.wolfi.dev/os
• Go Modules Reference: https://golang.org/ref/mod#go-mod-file-go

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: "go: go.mod requires go >= 1.23.4 (running go 1.23.3; GOTOOLCHAIN=go1.23.3)"

• Error Category: Version

• Failure Point: make gen command during subpackage kuma-coredns build

• Root Cause Analysis: The Go toolchain version mismatch - the package requires Go 1.23.4, but the system is using Go 1.23.3

• Suggested Fix:

1. Update the go-1.23 package version in the environment section:

environment:
  contents:
    packages:
      - go-1.23=1.23.4-r0
      - libcap-utils
      - make

• Explanation: The error occurs because CoreDNS's go.mod requires Go 1.23.4 or higher, but the build environment is using Go 1.23.3. By explicitly specifying the correct Go version in the package dependencies, we ensure the build environment has the required toolchain version.

• Additional Notes:

• Always specify exact Go versions to prevent toolchain mismatches
• The go-1.23 package in Wolfi provides Go 1.23.4
• This is a common issue when packages require specific minimum Go versions

• References:

• Go Toolchain Requirements: https://go.dev/doc/toolchain
• CoreDNS Build Requirements: https://github.com/coredns/coredns#compilation
• Wolfi Go Package Documentation: https://packages.wolfi.dev/os/x86_64/go-1.23

[hbh7]

Not sure why this isn't picking up the latest version...

HTTP_AUTH=$(chainctl auth token --audience apk.cgr.dev) wolfi-package-status | grep go-1.23
go-1.23 version 1.23.0-r0 (4 months ago - 2024-08-14 23:51:41 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.0-r0 (4 months ago - 2024-08-14 23:51:41 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.0-r1 (3 months ago - 2024-09-03 05:16:32 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.0-r1 (3 months ago - 2024-09-03 05:16:32 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.1-r0 (3 months ago - 2024-09-06 00:34:41 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.1-r0 (3 months ago - 2024-09-06 00:34:41 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.2-r0 (2 months ago - 2024-10-01 18:04:32 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.2-r0 (2 months ago - 2024-10-01 18:04:32 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.3-r0 (1 month ago - 2024-11-06 23:03:49 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.3-r0 (1 month ago - 2024-11-06 23:03:49 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.3-r1 (4 weeks ago - 2024-11-14 00:05:34 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.3-r1 (4 weeks ago - 2024-11-14 00:05:34 +0000 UTC) in wolfi os repository
go-1.23-doc version 1.23.4-r0 (1 week ago - 2024-12-03 19:03:20 +0000 UTC) in wolfi os repository
go-1.23 version 1.23.4-r0 (1 week ago - 2024-12-03 19:03:20 +0000 UTC) in wolfi os repository