github/tor-guard-relay
1
1
Fork 0
mirror of https://github.com/r3bo0tbx1/tor-guard-relay.git synced 2026-04-06 00:32:04 +02:00
Code Issues Packages Projects Releases Wiki Activity

🛡 fix(security): resolve critical CVEs via multi-stage build and OS upgrade

Browse Source 
This commit addresses high-severity vulnerabilities detected by Docker Scout in both the Lyrebird binary and the Alpine base image.

Changes:
- Lyrebird: Implemented a multi-stage build using golang:1.24-alpine. This compiles Lyrebird from source to resolve "baked-in" Go runtime and dependency vulnerabilities (stdlib, crypto, pion) found in the upstream Alpine package.
- Base OS: Added apk upgrade --no-cache to force the installation of the latest system libraries, patching active CVEs in musl and openssl.

Resolves: CVE-2025-9230 (openssl), CVE-2025-26519 (musl), and multiple Go runtime CVEs.
This commit is contained in:
rE-Bo0t.bx1
2025-11-20 23:16:35 +08:00
parent 7f36fcc805
commit 2af8ec9565
2 changed files with 4 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
Dockerfile
View File

@@ -41,8 +41,9 @@ LABEL maintainer="rE-Bo0t.bx1 <r3bo0tbx1@brokenbotnet.com>" \
SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
# Note: 'lyrebird' removed from apk add, we copy it from builder instead
# Note: 'lyrebird' removed from apk add, copying it from builder instead
RUN set -eux \
&& apk upgrade --no-cache
&& apk add --no-cache \
tor \
tini \

3
Dockerfile.edge
View File

@@ -46,8 +46,9 @@ LABEL maintainer="rE-Bo0t.bx1 <r3bo0tbx1@brokenbotnet.com>" \
SHELL ["/bin/ash", "-eo", "pipefail", "-c"]
# NOTE: 'lyrebird' removed from apk add list (we copy it from builder)
# NOTE: 'lyrebird' removed from apk add list (copying it from builder instead)
RUN set -eux \
&& apk upgrade --no-cache
&& apk add --no-cache \
tor \
tini \