Merge pull request openshift#19 from tmshort/CVE-2023-25165

OCPBUGS-7683: Bump helm to v3.11.1 to address CVE-2023-25165

.ci-operator.yaml

@@ -1,4 +1,4 @@
 build_root_image:
   name: release
   namespace: openshift
-  tag: rhel-8-release-golang-1.19-openshift-4.12
+  tag: rhel-8-release-golang-1.19-openshift-4.13

.golangci.yaml

@@ -6,11 +6,11 @@ linters:
   enable:
   - asciicheck
   - bodyclose
-  - deadcode
   - depguard
   - errorlint
   - gofmt
   - goimports
+  - gosec
   - importas
   - misspell
   - nestif
@@ -22,7 +22,6 @@ linters:
   - unconvert
   - unparam
   - unused
-  - varcheck
   - whitespace
 
 linters-settings:
@@ -42,6 +41,5 @@ linters-settings:
   goimports:
     local-prefixes: github.com/operator-framework/rukpak
 
-
 output:
   format: tab

.goreleaser.template.yml

@@ -11,6 +11,7 @@ builds:
   - id: unpack
     main: ./cmd/unpack
     binary: unpack
+    tags: $GO_BUILD_TAGS
     goos:
     - linux
     goarch:
@@ -23,6 +24,7 @@ builds:
   - id: helm
     main: ./cmd/helm
     binary: helm
+    tags: $GO_BUILD_TAGS
     goos:
       - linux
     goarch:
@@ -35,6 +37,7 @@ builds:
   - id: core
     main: ./cmd/core
     binary: core
+    tags: $GO_BUILD_TAGS
     goos:
     - linux
     goarch:
@@ -47,6 +50,7 @@ builds:
   - id: webhooks
     main: ./cmd/webhooks
     binary: webhooks
+    tags: $GO_BUILD_TAGS
     goos:
       - linux
     goarch:
@@ -59,6 +63,7 @@ builds:
   - id: crdvalidator
     main: ./cmd/crdvalidator
     binary: crdvalidator
+    tags: $GO_BUILD_TAGS
     goos:
     - linux
     goarch:
@@ -71,6 +76,7 @@ builds:
   - id: rukpakctl
     main: ./cmd/rukpakctl
     binary: rukpakctl
+    tags: $GO_BUILD_TAGS
     goos:
       - linux
     goarch:

Dockerfile

@@ -1,4 +1,4 @@
-FROM registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.19-openshift-4.12 AS builder
+FROM registry.ci.openshift.org/ocp/builder:rhel-8-golang-1.19-openshift-4.13 AS builder
 
 # copy just enough of the git repo to parse HEAD, used to record version in OLM binaries
 COPY .git/HEAD .git/HEAD
@@ -9,11 +9,14 @@ WORKDIR /build
 COPY . .
 RUN make build
 
-FROM registry.ci.openshift.org/ocp/4.12:base
+FROM registry.ci.openshift.org/ocp/4.13:base
 
 COPY --from=builder /build/bin/core /
 COPY --from=builder /build/bin/unpack /
 COPY --from=builder /build/bin/webhooks /
+COPY --from=builder /build/bin/helm /
+COPY --from=builder /build/bin/crdvalidator /
+COPY --from=builder /build/bin/rukpakctl /
 USER 1001
 
 LABEL io.k8s.display-name="OpenShift RukPak" \