Bump go builder, build dependencies and runtime dependencies#69
Merged
Conversation
mclasmeier
force-pushed
the
mc/go-builder
branch
from
5d8e591 to
bffb4d1
Compare
mclasmeier
force-pushed
the
mc/go-builder
branch
from
bffb4d1 to
0bbffc9
Compare
mclasmeier
force-pushed
the
mc/go-builder
branch
from
674aa7b to
7e1bb44
Compare
mclasmeier
changed the title
added 2 commits
March 24, 2026 14:00
mclasmeier
force-pushed
the
mc/go-builder
branch
from
7e1bb44 to
dad0467
Compare
GrimmiMeloni
approved these changes
Mar 27, 2026
Collaborator
GrimmiMeloni
left a comment
GrimmiMeloni
left a comment
There was a problem hiding this comment.
Overall looking good to me.
Question - is there any concern around the downloads we do here from google and github? I.e. shall we rather pin the downloads by SHA? (Or check against checksums?)
The recent wave of supply chain attacks makes me wonder if we can still trust a "known good" source to actually be known good all the time...
mclasmeier
force-pushed
the
mc/go-builder
branch
from
db07537 to
420023a
Compare
mclasmeier
force-pushed
the
mc/go-builder
branch
from
420023a to
61f96b8
Compare
tommartensen
approved these changes
Mar 30, 2026
Fix tar invocation
mclasmeier
force-pushed
the
mc/go-builder
branch
from
2d2f358 to
9977aac
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps
go-toolset, which we also use for other images)Also removes the helm CLI from the image (which also comes with a critical CVE), thereby only supporting operator-based installs when using the image. I think this is alright, given that the nowadays hidden
--helmoption is only for specific dev needs until it is deprecated and removed completely.Before:
After:
