fix(openbao): replace legacy Docker module in JWT plugin

[sbaum1994]

TL;DR

Upgrade the OpenBao JWT plugin from plugincontainer v0.4.1 to v0.5.0. This preserves Docker-backed plugin support while replacing the legacy github.com/docker/docker module reported for CVE-2026-17106 with the split Moby API and client modules.

Additional Details

The JWT plugin receives its Docker dependency transitively from the Vault SDK through github.com/hashicorp/go-secure-stdlib/plugincontainer. The legacy Docker module does not publish the fixed 29.7.0 module version, while plugincontainer v0.5.0 has migrated its API and client use to github.com/moby/moby/api and github.com/moby/moby/client.

This change also:

• pins plugincontainer v0.5.0 in the reproducible plugin build
• verifies the expected plugincontainer version in built artifacts
• fails CI if plugin build metadata contains github.com/docker/docker
• records the modified third-party dependency in NOTICE

Dependency review:

• github.com/hashicorp/go-secure-stdlib/plugincontainer v0.5.0: MPL-2.0
• github.com/moby/moby/api v1.54.0: Apache-2.0
• github.com/moby/moby/client v0.3.0: Apache-2.0
• github.com/containerd/errdefs v1.0.0 and github.com/containerd/errdefs/pkg v0.3.0: Apache-2.0

All licenses are allowed by the repository policy. NOTICE is updated for the plugincontainer and Moby module migration.

For the Reviewer

The functional change is the plugincontainer dependency migration. Most of the line churn is generated go.sum cleanup. Please focus on the build and artifact verification changes in infra/openbao/scripts/ and .github/workflows/openbao-jwt-plugin.yml.

For QA

Validation completed:

• go test ./...
• go build ./...
• go mod tidy -diff
• go mod verify
• cross-built and verified linux/amd64 and linux/arm64 plugin artifacts with infra/openbao/scripts/build-jwt-plugin.sh
• confirmed plugin build metadata contains plugincontainer v0.5.0 and no github.com/docker/docker dependency
• shellcheck -x infra/openbao/scripts/build-jwt-plugin.sh infra/openbao/scripts/verify-jwt-plugin.sh
• parsed .github/workflows/openbao-jwt-plugin.yml as YAML
• git diff --check origin/main...HEAD

No additional QA is expected because the existing plugin tests and cross-platform artifact verification cover the dependency-only change.

Issues

Fixes #1738

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover these changes.
• The documentation is up to date with these changes.

Summary by CodeRabbit

• Chores

  • Updated the JWT plugin’s container integration to version 0.5.0 or newer.
  • Refreshed supporting dependencies and licensing notices.
  • Added configuration support for selecting the container integration version during builds.

• Tests

  • Enhanced build and verification checks to confirm the expected container integration version.
  • Added validation to prevent legacy Docker modules from being included in JWT plugin binaries.
  • Verification output now reports the detected integration version.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: fe73fe87-b290-4100-a8a8-1a88e7d5c44f

📥 Commits

Reviewing files that changed from the base of the PR and between a7c4ac7 and f570a0a.

⛔ Files ignored due to path filters (1)

• infra/openbao/plugins/vault-plugin-secrets-jwt/go.sum is excluded by !**/*.sum

📒 Files selected for processing (5)

• .github/workflows/openbao-jwt-plugin.yml
• infra/openbao/plugins/vault-plugin-secrets-jwt/NOTICE
• infra/openbao/plugins/vault-plugin-secrets-jwt/go.mod
• infra/openbao/scripts/build-jwt-plugin.sh
• infra/openbao/scripts/verify-jwt-plugin.sh

Included review availability: Your plan provides up to 12 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The JWT plugin now pins plugincontainer to v0.5.0, updates related Go modules, verifies binary metadata, rejects the legacy Docker module, and adds CI enforcement.

Changes

JWT plugin dependency validation

Layer / File(s)	Summary
Dependency and build configuration infra/openbao/plugins/vault-plugin-secrets-jwt/go.mod, infra/openbao/scripts/build-jwt-plugin.sh, infra/openbao/plugins/vault-plugin-secrets-jwt/NOTICE	The plugin updates indirect dependencies, pins plugincontainer to v0.5.0, and documents the Moby module split.
Binary dependency verification infra/openbao/scripts/verify-jwt-plugin.sh	The verification script checks the embedded plugincontainer version and rejects binaries that contain github.com/docker/docker.
CI build enforcement .github/workflows/openbao-jwt-plugin.yml	The workflow builds the plugin and fails when build metadata contains the legacy Docker module.

Priority: ⬆️ High

Estimated code review effort: 3 (Moderate) | ~20 minutes

Change: Bug fix · Severity of issue fixed: High

Merge Risk: 🟡 Moderate · up to f570a

The upgrade image can still contain an unremediated JWT plugin with the legacy Docker dependency, so this security-focused change should be corrected before merge.

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (3 skipped: 3 …	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title follows Conventional Commits format with the required scope and accurately describes the primary dependency and security-related change in the JWT plugin.
Linked Issues check	✅ Passed	Issue #1738 requires removal of the legacy Docker module when unused, or an update when the plugin uses Docker support. The PR retains Docker-backed support and upgrades plugincontainer to pinned ve…
Out of Scope Changes check	✅ Passed	The changed files support issue #1738. The dependency declaration, NOTICE update, build pin, verification checks, and CI metadata inspection all implement or validate the Docker dependency migration. …

Full details: Docstring Coverage

Explanation

Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files. (3 skipped: 3 unsupported.)

• Fix all pre-merge checks with AI

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/1738-openbao-docker

---

_{Comment @coderabbitai help to get the list of available commands.}

[balajinvda]

🎉 This PR is included in version nvcf-openbao-v1.3.4 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀