Skip to content

Releases: cloudfoundry/bosh-gdc-cpi-release

Release list

BOSH GDC CPI v0.1.0

BOSH GDC CPI v0.1.0 Latest
Latest

Choose a tag to compare

View all tags
@github-actions github-actions released this 28 Oct 22:22
v0.1.0
This tag was signed with the committer’s verified signature.
dilipkumar2k6 Dilip
SSH Key Fingerprint: T7uBmd+tVOYhanViEvQOTHclCjtsHuPuMowdXWuVOQE
Verified
Learn about vigilant mode.
189e479

BOSH Google Distributed Cloud (GDC) CPI Release v0.1.0

BOSH Deployment Manifest Snippet

releases:
  - name: bosh-gdc-cpi
    version: "0.1.0"
    url: https://github.com/cloudfoundry/bosh-gdc-cpi-release/releases/download/v0.1.0/bosh-gdc-cpi-0.1.0.tgz
    sha1: sha256:8de4f9205b38048912024755f9b2e5562f2b5924770061e753a64f272cd4fc87

Release Provenance & Verification

Field Value
Release Name bosh-gdc-cpi
Version 0.1.0
Git Tag v0.1.0
Commit SHA 189e479
SHA-256 Digest 8de4f9205b38048912024755f9b2e5562f2b5924770061e753a64f272cd4fc87
Concourse Stage succeeded
GCS Release Bucket gs://cfbosh-cicd/cpi_releases/bosh-gdc-cpi-0.1.0.tgz

Vulnerability Report for BOSH CPI

Version: 0.1.0
Scan Date: 2026-10-28 18:45:00 UTC
Go Toolchain: go1.26.10
Scanner: govulncheck -mode=binary (symbol-level scan of the linked cpi_binary_linux against https://vuln.go.dev)

Result: ⚠️ 3 known vulnerabilities (0 fixable by upgrading, 3 without an upstream fix)

Fixable — upgrade required

None — the toolchain and all dependencies are at or above every fixed version.

No upstream fix available

Module Linked version ID Aliases Summary
github.com/aws/aws-sdk-go v1.45.7 GO-2022-0635 CVE-2020-8912, GHSA-7f33-f4f5-xwgw In-band key negotiation issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
github.com/aws/aws-sdk-go v1.45.7 GO-2022-0646 CVE-2020-8911, GHSA-f5pg-7wfw-84q9 CBC padding oracle issue in AWS S3 Crypto SDK for golang in github.com/aws/aws-sdk-go
golang.org/x/crypto v0.58.0 GO-2026-5932 - The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues

These advisories have no fixed version in the Go vulnerability database (typically end-of-life or unmaintained packages pulled in transitively). The scan is symbol-level: the vulnerable code is linked into the binary, which does not by itself mean the CPI calls it. Track them in the dependency roadmap.

What's Changed

Other Changes

  • feat: add GDC BOSH CPI release implementation and CI workflows by @dilipkumar2k6 in #1

Full Changelog: https://github.com/cloudfoundry/bosh-gdc-cpi-release/commits/v0.1.0

Contributors

dilipkumar2k6
Assets 9
Loading