Bump user-api to v0.34.2 in prod

[fridex]

Related Issues and Dependencies

Related: thoth-station/storages#2578

[sesheta]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
To complete the pull request process, please ask for approval from fridex after the PR has been reviewed.

The full list of commands accepted by this bot can be found here.

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[fridex]

/hold

... until available https://quay.io/repository/thoth-station/user-api?tab=tags

[goern]

interesting... user-api is based on quay.io/thoth-station/s2i-thoth-ubi8-py38:v0.32.0 srcRef that container images has 0 vulnerabilities (see quay), the user-api container image has 7 High-level vulnerabilities all trace back to RHSA-2021:3816.

1. how did that end up in user-api container image?
2. is a build log of https://quay.io/repository/thoth-station/user-api/manifest/sha256:da4deb819740b293aa8f6c671b7004289ac3ffaca7f7fc4e14a2d0fbaa40626d available?
3. why is https://quay.io/repository/thoth-station/user-api/manifest/sha256:da4deb819740b293aa8f6c671b7004289ac3ffaca7f7fc4e14a2d0fbaa40626d build from v0.32.0? see label io.openshift.s2i.build.image
4. can we feed back quay image scans to a pull request?

[goern]

/assign @fridex
/assign @mayaCostantini
/assign @harshad16
/sig devsecops
/sig security

[sesheta]

@goern: The label(s) sig/security cannot be applied, because the repository doesn't have them.

In response to this:

/assign @fridex
/assign @mayaCostantini
/assign @harshad16
/sig devsecops
/sig security

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[goern]

maybe this is a thing? https://artifacthub.io/packages/tekton-task/tekton-catalog-tasks/trivy-scanner I didn't find any similar task for clair/quay.io

[goern]

user-api is based on quay.io/thoth-station/s2i-thoth-ubi8-py38:v0.32.0 srcRef that container images has 0 vulnerabilities

my fault, v0.32.0 has 7 vuls on quay, v0.32.2 has 0

[codificat]

/close
in favour of #2316

[sesheta]

@codificat: Closed this PR.

In response to this:

/close
in favour of #2316

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.