trust-manager/0.14.0-r0: cve remediation

[octo-sts]

trust-manager/0.14.0-r0: fix GHSA-v778-237x-gjrc

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/trust-manager.advisories.yaml

[octo-sts]

Gen AI suggestions to solve the build error:

• Detected Error: None visible in the provided log - the build appears to stop without an explicit error message

• Error Category: Configuration/Build

• Failure Point: The log shows successful dependency installation but appears to terminate before completing the build process

• Root Cause Analysis: Based on the melange.yaml and the build log, there might be an issue with the go build command not having the necessary version information ldflags, which was mentioned in the comment "We can't use go/install because this requires specific ldflags to set the version"

• Suggested Fix:
Modify the build step to include version information via ldflags:

  - runs: |
      cd trust-manager
      mkdir ./bin
      VERSION=${{package.version}}
      go build -ldflags "-X main.Version=${VERSION}" -o ./bin/trust-manager ./cmd/trust-manager
      mkdir -p ${{targets.destdir}}/usr/bin
      install -Dm755 ./bin/trust-manager ${{targets.destdir}}/usr/bin/trust-manager

• Explanation:

• The original comment indicates version information needs to be passed via ldflags
• The trust-manager project likely expects version information at build time
• Adding the -ldflags parameter with version information should properly embed the version into the binary
• This is a common requirement for Go projects to embed version information at build time

• Additional Notes:

• Consider checking the upstream Makefile for the exact ldflags used in official builds
• The project might have additional build-time variables that need to be set
• You might want to verify the version format matches upstream expectations

• References:

• Trust Manager repository build instructions: https://github.com/cert-manager/trust-manager
• Go build documentation for ldflags: https://golang.org/cmd/go/#hdr-Compile_packages_and_dependencies