[backport] Fix CVEs in release/v5.x release branch

.bin-deps.yaml

@@ -0,0 +1,14 @@
+tools:
+  - name: k3d
+    mode: pinned
+    source: k3d-io/k3d
+    # renovate: datasource=github-release-attachments depName=k3d-io/k3d
+    version: v5.9.0
+    checksums:
+      darwin/amd64: "b4aabc37534f95b9c764e7823f2df923f50d57600837aa60a06266cce47db732"
+      darwin/arm64: "fe106541d5d0a3f18debcd4d432a16f8c0ce3e6ddc06f8fbb6f696a122313e00"
+      linux/amd64: "06d8f25bc3a971c4eb29e0ff08429b180402db0f4dec838c9eac427e296800a0"
+      linux/arm64: "03cde5cf23e6e8e67de5a039ecf26e5b85aca82fba3e5d13dadf904cd218a250"
+    release:
+      download_template: "k3d-{os}-{arch}"
+      # asset is the binary itself; no extract path needed

.github/workflows/e2e-ci.yaml

@@ -109,9 +109,9 @@ jobs:
         run: |
           make package;
           make package-helm;
-      -
-        name : Install k3d
-        run : ./.github/workflows/e2e/scripts/install-k3d.sh
+      - uses: rancherlabs/dep-fetch/actions/sync-deps@56731ed2727325212f71f7682013dc71c18540e1 # v0.1.1
+        with:
+          version: v0.1.1
       -
         name : Setup k3d cluster
         run : ./.github/workflows/e2e/scripts/setup-cluster.sh

.github/workflows/e2e/scripts/install-ci-chart.sh

@@ -9,7 +9,7 @@ cd $(dirname $0)/../../../..
 
 helm upgrade --install --create-namespace -n cattle-ci-system rancher-kuberlr-kubectl-debug \
   --set global.kubectl.image.repository=${REPO:-rancher}/kuberlr-kubectl \
-  --set global.kubectl.image.tag=${TAG:-dev} \
+  --set-string global.kubectl.image.tag=${TAG:-dev} \
   ${cluster_args} \
   ${RANCHER_HELM_ARGS} ./build/charts/kuberlr-kubectl-test
 

.github/workflows/head-build.yml

@@ -70,14 +70,21 @@ jobs:
 
           push-to-prime: false
 
+  retag:
+    permissions:
+      packages: write
+    runs-on: ubuntu-latest
+    needs:
+      - prebuild-env
+      - publish-public
+    container:
+      image: ghcr.io/rancher/ci-image/charts:latest
+    steps:
       - name: Re-tag the static head image using the rolling tag
         env:
           FULL_IMAGE_URL: ${{ env.PUBLIC_REGISTRY }}/${{ vars.REPO || github.repository_owner }}/${{ vars.IMAGE_NAME || 'kuberlr-kubectl' }}
           STATIC_TAG: ${{ needs.prebuild-env.outputs.branch_static_tag }}
           LATEST_TAG: ${{ needs.prebuild-env.outputs.branch_tag }}
         run: |
-          VERSION="1.2.0"
-          curl -LO "https://github.com/oras-project/oras/releases/download/v${VERSION}/oras_${VERSION}_linux_amd64.tar.gz"
-          mkdir -p oras-install/
-          tar -zxf oras_${VERSION}_*.tar.gz -C oras-install/
-          oras-install/oras copy ${{ env.FULL_IMAGE_URL }}:${{ env.STATIC_TAG }} ${{ env.FULL_IMAGE_URL }}:${{ env.LATEST_TAG }}
+          echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin
+          oras copy ${{ env.FULL_IMAGE_URL }}:${{ env.STATIC_TAG }} ${{ env.FULL_IMAGE_URL }}:${{ env.LATEST_TAG }}

.github/workflows/release.yml

@@ -108,21 +108,18 @@ jobs:
           prime-username: ${{ env.PRIME_REGISTRY_USERNAME }}
           prime-password: ${{ env.PRIME_REGISTRY_PASSWORD }}
 
-      -
-        name: Login to GitHub Container Registry
-        uses: docker/login-action@c94ce9fb468520275223c153574b00df6fe4bcc9 # v3
-        with:
-          registry: ghcr.io
-          username: ${{ github.actor }}
-          password: ${{ secrets.GITHUB_TOKEN }}
-
+  retag:
+    permissions:
+      packages: write
+    runs-on: ubuntu-latest
+    needs: publish-public
+    container:
+      image: ghcr.io/rancher/ci-image/charts:latest
+    steps:
       - name: Re-tag the image to ghcr.io/${{ github.repository_owner }}
         env:
           FULL_IMAGE_URL: ${{ env.PUBLIC_REGISTRY }}/${{ vars.REPO || github.repository_owner }}/${{ vars.IMAGE_NAME || 'kuberlr-kubectl' }}
           FULL_IMAGE_GHCR_URL: ghcr.io/${{ github.repository_owner }}/${{ vars.IMAGE_NAME || 'kuberlr-kubectl' }}
         run: |
-          VERSION="1.2.0"
-          curl -LO "https://github.com/oras-project/oras/releases/download/v${VERSION}/oras_${VERSION}_linux_amd64.tar.gz"
-          mkdir -p oras-install/
-          tar -zxf oras_${VERSION}_*.tar.gz -C oras-install/
-          oras-install/oras copy ${{ env.FULL_IMAGE_URL }}:${{ github.ref_name }} ${{ env.FULL_IMAGE_GHCR_URL }}:${{ github.ref_name }}
+          echo "${{ secrets.GITHUB_TOKEN }}" | oras login ghcr.io -u ${{ github.actor }} --password-stdin
+          oras copy ${{ env.FULL_IMAGE_URL }}:${{ github.ref_name }} ${{ env.FULL_IMAGE_GHCR_URL }}:${{ github.ref_name }}

.gitignore

@@ -12,4 +12,5 @@ new-versions.txt
 /image_arch_test
 *.oci
 kubectl-versions.txt.log
-kubeconfig.yaml
+kubeconfig.yaml
+.dep-fetch

kubectl-versions.txt

@@ -1,3 +1,3 @@
 v1.31.14
 v1.32.13
-v1.33.11
+v1.33.12

package/Dockerfile

@@ -1,5 +1,5 @@
-ARG BCI_VERSION=15.7
-FROM ghcr.io/flavio/kuberlr:v0.6.1 AS kuberlr
+ARG BCI_VERSION=16.0
+FROM ghcr.io/flavio/kuberlr:v0.7.0 AS kuberlr
 FROM registry.suse.com/bci/bci-busybox:${BCI_VERSION} AS final
 FROM registry.suse.com/bci/bci-base:${BCI_VERSION} AS zypper
 
@@ -15,6 +15,7 @@ COPY --from=final / /chroot/
 # install all artefacts within a dir (/chroot) that can then be copied
 # over to a scratch image.
 RUN zypper --non-interactive refresh && \
+    zypper --installroot /chroot --non-interactive update && \
     zypper --installroot /chroot -n rm busybox-vi busybox-links && \
     zypper --installroot /chroot -n in bash-completion && \
     zypper --installroot /chroot clean -a && \

scripts/local-e2e

@@ -64,11 +64,26 @@ REPO=${REPO} TAG=${TAG} make package-helm;
 header "Image built ${REPO}/kuberlr-kubectl:${TAG}"
 export TAG
 
-# Install k3d
+# Add dep-fetch bin directory to PATH if not already present
+if [[ ":$PATH:" != *":${PWD}/bin:"* ]]; then
+  export PATH="${PWD}/bin:${PATH}"
+fi
+# Check for k3d being installed
 which k3d > /dev/null  2>&1
 if [ "$?" -eq 1 ]; then
+  # Install k3d
   echo "Found k3d not installed setting up now..."
-  ./.github/workflows/e2e/scripts/install-k3d.sh
+
+  # Check if dep-fetch is available
+  which dep-fetch > /dev/null 2>&1
+  if [ "$?" -eq 1 ]; then
+    echo "ERROR: dep-fetch is not installed"
+    echo "Please install dep-fetch from: https://github.com/rancherlabs/dep-fetch"
+    exit 1
+  fi
+
+  dep-fetch sync
+
 fi
 
 # Setup k3d cluster

scripts/verify-local-multiarch-image

@@ -8,7 +8,7 @@ CI_ROOT="./ci"
 OCI_ARCHIVE_PATH=${OCI_ARCHIVE_PATH:-"$CI_ROOT/multiarch-image.oci"}
 CI_LOG_FILE="$CI_ROOT/image-ci-$(date +'%Y%m%d-%H%M%S').log"
 TARGET_FILES=(
-  "/bin/kuberlr"
+  "/usr/bin/kuberlr"
   "/usr/bin/kube*"
 )
 OUTPUT_DIR="$CI_ROOT/files"
@@ -30,6 +30,7 @@ cleanup() {
   pwd
     if [[ -n "$TEMP_DIR" && -d "$TEMP_DIR" ]]; then
         log "Cleaning up temporary directory: $TEMP_DIR"
+        chmod -R u+rwx "$TEMP_DIR" 2>/dev/null || true
         rm -rf "$TEMP_DIR"
     fi
 }