fix: [CI-23226]: remediate vulnerabilities in harnesssecure/gcs#106
fix: [CI-23226]: remediate vulnerabilities in harnesssecure/gcs#106imaditya55 wants to merge 2 commits into
Conversation
Bump Go toolchain and vulnerable indirect deps to their minimum-safe versions per Trivy fix column, closing 46/47 unique CVEs found by the baseline Trivy scan on plugins/gcs:1.6.10 (baseline uses the docker.io public copy since harnesssecure/gcs is a private mirror built from the same source). Edits: - go directive: 1.25.7 -> 1.25.12 (stdlib CVEs) - golang.org/x/crypto (indirect): v0.46.0 -> v0.52.0 (13 HIGH+MED) - golang.org/x/net (indirect): v0.48.0 -> v0.55.0 (7 CVEs) - golang.org/x/sys (indirect): v0.40.0 -> v0.45.0 (CVE-2026-39824) - go.opentelemetry.io/otel{,sdk,metric,sdk/metric,trace} (indirect): v1.40.0 -> v1.43.0 (otel/sdk HIGH) - github.com/go-jose/go-jose/v4 (indirect): v4.1.3 -> v4.1.4 (CVE-2026-34986) - cloud.google.com/go/storage: v1.50.0 -> v1.62.3 (unlocks newer subs) - google.golang.org/api: v0.214.0 -> v0.284.0 (unlocks newer subs) - .drone.yml, .harness/harness.yaml: golang:1.25.7 -> golang:1.25.12 so CI-built binaries embed the fixed stdlib. Scans (Harness OnDemand + local Trivy) verify the fix in-pipeline before merge. See PR body for the full canonical report.
Replace deprecated WithCredentialsFile with JWTConfigFromJSON token source, and decode upload metadata in tests without CRC32C field. Co-authored-by: Cursor <cursoragent@cursor.com>
| return err | ||
| } | ||
| } else if c.String("json-key") != "" { | ||
| err := os.MkdirAll(os.TempDir(), 0600) |
There was a problem hiding this comment.
The temp file was only needed for the old WithCredentialsFile, which reads credentials from a file on disk. That function is now deprecated and it's what broke the lint check in CI. The new approach reads the key straight from memory, so there's no need to create, write, or delete a temp file anymore.
| if err := credFile.Close(); err != nil { | ||
| return nil, fmt.Errorf("failed to close gcs credentials file: %w", err) | ||
| func gcsClientWithJSONKey(jsonKey string) (*storage.Client, error) { | ||
| auth, err := google.JWTConfigFromJSON([]byte(jsonKey), storage.ScopeFullControl) |
There was a problem hiding this comment.
google.JWTConfigFromJSON is from golang.org/x/oauth2/google. It reads the service-account JSON key in memory and returns a token source, which we hand to the storage client. This is actually the exact same approach already used just above in gcsClientWithToken so both auth paths now work the same way instead of the old deprecated file-based one.
This is the exact same approach already used by gcsClientWithToken (the function right above it in main.go) , so both auth paths now work the same way instead of the old deprecated file-based one.
3 participants
Summary
CVE remediation for CI-23226 (
harnesssecure/gcs:1.6.10— same source asplugins/gcs:1.6.10fromdrone-plugins/drone-gcs).Go 1.25.12 + dependency bumps from vuln_remediation pipeline, plus CI fixes for failures caused by library upgrades.
Root cause of CI failures
The vuln_remediation pipeline updated
go.mod/go.sumto fix CVEs. Two library upgrades caused CI to fail:1. Lint failure (SA1019 — deprecated API)
google.golang.org/apiv0.214.0→v0.284.0option.WithCredentialsFileas deprecatedgolangci-lint runfailed in Test stage2. Test failure (JSON unmarshal)
cloud.google.com/go/storagev1.50.0→v1.62.3crc32Cas base64 string in upload metadata JSONTestRunfailed unmarshaling intostorage.ObjectAttrs(uint32expected)Go 1.25.12 bump alone did not cause these — the Google library upgrades did.
Fixes in this PR
WithCredentialsFilewithJWTConfigFromJSON+WithTokenSourcecrc32Cfieldgolang:1.25.12Functional sanity validation
Fake-GCS pipeline — both runs uploaded
file1.yamlandfile2.yamlsuccessfully:plugins/gcs:1.6.10: (https://app.harness.io/ng/account/9UuUfLwaQ-6ZowvbG7qtLQ/all/orgs/default/projects/RaghavTest/pipelines/gcs_plugin_image_test/executions/hxZh56u0RNuoZ_ibBYKphA/pipeline?storeType=INLINE)vinayakharness/gcs-test:gcs-1.6.11--debug: (https://app.harness.io/ng/account/9UuUfLwaQ-6ZowvbG7qtLQ/all/orgs/default/projects/RaghavTest/pipelines/gcs_plugin_image_test/executions/Jj6AKgN-TBa0NeGmawBNgA/pipeline?storeType=INLINE)OnDemand vulnerability scans (CI-23226)
harnesssecure/gcs:1.6.10vinayakharness/gcs-test:gcs-1.6.11--debugScanner: Harness OnDemand (Snyk + Prisma) · Status: BOTH_OK
CI status
All Harness
dronegcsharnesschecks green (11/11) on commitb94a912.Related