Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

tekton-pipeline images can contain vulnerabilities #1833

Closed
othomann opened this issue Jan 9, 2020 · 2 comments
Closed

tekton-pipeline images can contain vulnerabilities #1833

othomann opened this issue Jan 9, 2020 · 2 comments
Assignees
@othomann
Labels
kind/feature Categorizes issue or PR as related to a new feature.

Comments

@othomann
Copy link
Contributor

othomann commented Jan 9, 2020

Expected Behavior

No vulnerabilities in docker images built for tekton-pipeline

Actual Behavior

Two vulnerabilities are reported today against latest.

Steps to Reproduce the Problem

  1. use the ibmcloud cr va tool to check docker images for vulnerabilities.
  2. two images contain issues:
    creds-init-c761f275af7b3d8bea9d50cc6cb0106f latest 821029bb8b42 othomann 14 hours ago 25 MB 1 problem
    git-init-4874978a9786b6625dd8b6ef2a21aa70 latest 879990cf3bde othomann 14 hours ago 31 MB 1 problem
  3. The command apk update && apk upgrade needs to be added in the Dockerfile. alpine:latest might not be built using latest packages.

Additional Info
othomann added a commit to othomann/pipeline that referenced this issue Jan 9, 2020
@othomann
Fix for tektoncd#1833
655d1f8
@vdemeester
Copy link
Member

/kind feature

@tekton-robot tekton-robot added the kind/feature Categorizes issue or PR as related to a new feature. label Jan 9, 2020
@othomann
Copy link
Contributor Author

Closing #1833. Fixed with PR #1835.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@othomann othomann

Labels
kind/feature Categorizes issue or PR as related to a new feature.
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@vdemeester @othomann @tekton-robot