From c7f6b915102d85135efef939a28c94ffd638b96b Mon Sep 17 00:00:00 2001 From: vAHiD <136799059+vAHiD55555@users.noreply.github.com> Date: Thu, 29 Jun 2023 02:13:52 +0330 Subject: [PATCH 1/3] Create go-ossf-slsa3-publish.yml Signed-off-by: vAHiD <136799059+vAHiD55555@users.noreply.github.com> --- .github/workflows/go-ossf-slsa3-publish.yml | 38 +++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/go-ossf-slsa3-publish.yml diff --git a/.github/workflows/go-ossf-slsa3-publish.yml b/.github/workflows/go-ossf-slsa3-publish.yml new file mode 100644 index 0000000000..79ea193f75 --- /dev/null +++ b/.github/workflows/go-ossf-slsa3-publish.yml @@ -0,0 +1,38 @@ +# This workflow uses actions that are not certified by GitHub. +# They are provided by a third-party and are governed by +# separate terms of service, privacy policy, and support +# documentation. + +# This workflow lets you compile your Go project using a SLSA3 compliant builder. +# This workflow will generate a so-called "provenance" file describing the steps +# that were performed to generate the final binary. +# The project is an initiative of the OpenSSF (openssf.org) and is developed at +# https://github.com/slsa-framework/slsa-github-generator. +# The provenance file can be verified using https://github.com/slsa-framework/slsa-verifier. +# For more information about SLSA and how it improves the supply-chain, visit slsa.dev. + +name: SLSA Go releaser +on: + workflow_dispatch: + release: + types: [created] + +permissions: read-all + +jobs: + # ======================================================================================================================================== + # Prerequesite: Create a .slsa-goreleaser.yml in the root directory of your project. + # See format in https://github.com/slsa-framework/slsa-github-generator/blob/main/internal/builders/go/README.md#configuration-file + #========================================================================================================================================= + build: + permissions: + id-token: write # To sign. + contents: write # To upload release assets. + actions: read # To read workflow path. + uses: slsa-framework/slsa-github-generator/.github/workflows/builder_go_slsa3.yml@v1.4.0 + with: + go-version: 1.17 + # ============================================================================================================= + # Optional: For more options, see https://github.com/slsa-framework/slsa-github-generator#golang-projects + # ============================================================================================================= + From d184fb008e7034fd4e9c3b274d2386e681ee5b53 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Tue, 8 Aug 2023 19:40:46 +0000 Subject: [PATCH 2/3] fix: Dockerfile to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5776808 - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5776808 - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5788370 - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5788370 - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-5821142 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 709554db3d..ba2e041c24 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ RUN set -ex \ -o /go/bin/sing-box \ -ldflags "-X \"github.com/sagernet/sing-box/constant.Version=$VERSION\" -s -w -buildid=" \ ./cmd/sing-box -FROM alpine AS dist +FROM alpine:3.18.3 AS dist LABEL maintainer="nekohasekai " RUN set -ex \ && apk upgrade \ From 7f60f610c0b59c4be8910863dd8d41d5be148c36 Mon Sep 17 00:00:00 2001 From: snyk-bot Date: Sat, 2 Dec 2023 16:38:21 +0000 Subject: [PATCH 3/3] fix: Dockerfile to reduce vulnerabilities The following vulnerabilities are fixed with an upgrade: - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-6032386 - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-6032386 - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-6055795 - https://snyk.io/vuln/SNYK-ALPINE318-OPENSSL-6055795 --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index ba2e041c24..063c96aa72 100644 --- a/Dockerfile +++ b/Dockerfile @@ -13,7 +13,7 @@ RUN set -ex \ -o /go/bin/sing-box \ -ldflags "-X \"github.com/sagernet/sing-box/constant.Version=$VERSION\" -s -w -buildid=" \ ./cmd/sing-box -FROM alpine:3.18.3 AS dist +FROM alpine:3.18.5 AS dist LABEL maintainer="nekohasekai " RUN set -ex \ && apk upgrade \