From 9fcc1800b741d2b953aa125277ef53f5167af135 Mon Sep 17 00:00:00 2001 From: Anand Parthasarathi Date: Mon, 28 Sep 2026 15:41:44 +0530 Subject: [PATCH] fix(nvca): bump distroless/go base image to v4.1.4 on v3.2 The nvca, nvca-operator, and cluster-validator 3.2.25 images all report the same 9 out-of-SLA vulnerabilities on the nSpect LaunchAPI container-oss-vulns-out-of-sla gate, despite: - govulncheck showing 0 code-reachable Go vulnerabilities (nvca, cluster-validator) - trivy, scanning the base image's own SBOM against Debian's vendor security tracker, showing 0 vulnerabilities for all 9 packages in nvcr.io/nvidia/distroless/go:v4.0.8 The identical count across all three images (including cluster-validator, which doesn't depend on grpc) points to a shared, non-application-specific source on the base OS layer -- likely raw NVD version-string matching against Debian's backport patch versions, which vendor-aware scanners already treat as patched. Bumping to v4.1.4 (latest available, same distroless family) picks up newer patch versions of libc6, libssl3t64/openssl-provider-fips, and tzdata, which may shift past whatever version nSpect's matcher is keying on. trivy scan of the v4.1.4 SBOM also reports 0 vulnerabilities. Verified with a full bazel build of the nvca, nvca-operator, and cluster-validator targets. Closes NO-REF --- MODULE.bazel | 2 +- MODULE.bazel.lock | 8 ++++---- 2 files changed, 5 insertions(+), 5 deletions(-) diff --git a/MODULE.bazel b/MODULE.bazel index 5e3499952f..1bc56e0ac2 100644 --- a/MODULE.bazel +++ b/MODULE.bazel @@ -443,7 +443,7 @@ oci.pull( # rather than an internal-only path. oci.pull( name = "distroless_go", - digest = "sha256:938bd28ce4ddb800118a951774203e7563c2067a72b20ae6b85d2c7da165a178", + digest = "sha256:965c2a14a594d7d467bbe9a6517d958cee22ed035333097bdc216da68fd55ba5", image = "nvcr.io/nvidia/distroless/go", platforms = [ "linux/amd64", diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock index f9543a766a..75edff1684 100644 --- a/MODULE.bazel.lock +++ b/MODULE.bazel.lock @@ -573,7 +573,7 @@ "@@rules_oci+//oci:extensions.bzl%oci": { "general": { "bzlTransitiveDigest": "Vjs2aLDiztq2JcqxCwBcmhWsa/nb80kDJ1sMT56l+0k=", - "usagesDigest": "EDzShmIAPaiLhkdqPiXbibm5GmGgklN1Yz6iboWtAQ4=", + "usagesDigest": "wEswBtBs5h/EGo82snqgoeJeH/IvY8/akyI7OvCLKqI=", "recordedInputs": [ "REPO_MAPPING:aspect_bazel_lib+,bazel_tools bazel_tools", "REPO_MAPPING:bazel_features+,bazel_tools bazel_tools", @@ -819,7 +819,7 @@ "scheme": "https", "registry": "nvcr.io", "repository": "nvidia/distroless/go", - "identifier": "sha256:938bd28ce4ddb800118a951774203e7563c2067a72b20ae6b85d2c7da165a178", + "identifier": "sha256:965c2a14a594d7d467bbe9a6517d958cee22ed035333097bdc216da68fd55ba5", "platform": "linux/amd64", "target_name": "distroless_go_linux_amd64", "bazel_tags": [] @@ -832,7 +832,7 @@ "scheme": "https", "registry": "nvcr.io", "repository": "nvidia/distroless/go", - "identifier": "sha256:938bd28ce4ddb800118a951774203e7563c2067a72b20ae6b85d2c7da165a178", + "identifier": "sha256:965c2a14a594d7d467bbe9a6517d958cee22ed035333097bdc216da68fd55ba5", "platform": "linux/arm64/v8", "target_name": "distroless_go_linux_arm64_v8", "bazel_tags": [] @@ -846,7 +846,7 @@ "scheme": "https", "registry": "nvcr.io", "repository": "nvidia/distroless/go", - "identifier": "sha256:938bd28ce4ddb800118a951774203e7563c2067a72b20ae6b85d2c7da165a178", + "identifier": "sha256:965c2a14a594d7d467bbe9a6517d958cee22ed035333097bdc216da68fd55ba5", "platforms": { "@@platforms//cpu:x86_64": "@distroless_go_linux_amd64", "@@platforms//cpu:arm64": "@distroless_go_linux_arm64_v8"