build: override grpc and buildkit for three scanner findings

Andrew Dunnrequested to merge
andunn-go-overrides-2 into main

The OpenVEX re-triage of the published scratch images found nine Go findings per image. Three of them an override answers, and this adds the two entries that answer them:

  • google.golang.org/grpc to v1.83.1 from the v1.82.1 upstream requires at KANIKO_VERSION, for CVE-2026-84304 (high), fixed on the same module path.
  • github.com/moby/buildkit to v0.31.1 from v0.30.0, for CVE-2026-61711 (medium) and CVE-2026-61712 (low).

Both go in go-overrides.txt, which the three builder stages already read: the entry reaches the compiler through go get, go mod tidy and go mod vendor, and the same list becomes every image's io.gitlab.public-sector.kaniko.go_overrides label. No upstream source file is edited and KANIKO_VERSION does not move.

What else moves

Measured from vendor/modules.txt in the standard builder stage, built with and without the two entries: 45 further modules move, and two leave the tree. 16 aws-sdk-go-v2, 8 go.opentelemetry.io, 4 github.com/moby, 3 github.com/docker (including cli from v29.4.3+incompatible to v29.5.3+incompatible), 3 github.com/containerd, 2 github.com/prometheus, and 9 single modules. stargz-snapshotter/estargz and gogo/protobuf drop out because the new graph requires neither. SECURITY.md records each family with its version spans and each single module with old and new versions; the SBOM attestation carries the full list.

github.com/docker/docker is not among them. buildkit v0.31.1 requires no github.com/docker/docker, so it stays at the v28.5.2+incompatible the pinned tag requires and no import path moves to a v29 one.

Proofs

Built locally, --platform linux/amd64, all three Dockerfiles:

  • Trivy 0.74.0 on the new standard image: 6 findings, down from 9. CVE-2026-84304, CVE-2026-61711 and CVE-2026-61712 are gone.
  • The go_overrides label reads golang.org/x/crypto@v0.56.0,google.golang.org/grpc@v1.83.1,github.com/moby/buildkit@v0.31.1.
  • executor version prints Kaniko version : v1.25.19.
  • An alpine:3.24 build through the executor with --no-push --destination=proof:alpine exits 0.
  • warmer --cache-dir=/cache --image=alpine:3.24 exits 0 and writes the layer and its manifest into the volume.
  • Dockerfile.warmer and Dockerfile.debug compile against the new graph, so all six images rebuild.
  • scripts/verify-reproducibility.sh standard: two --no-cache from-source builds both give e6e18407..., which is the binary in the image every proof above ran against. It differs from the published v1.25.19 image's 773effe0..., as a new module graph requires.
  • scripts/check-versions.sh exits 0 and reports upstream at v1.82.1 and v0.30.0, so the retirement check does not fire yet and will once upstream catches up.

Not fixed here

The six remaining findings need something other than an override. moby/go-archive CVE-2026-17106 sits behind upstream's own replace to v0.1.0. Four docker/docker v28.5.2 CVEs have their fix on the moby/moby/v2 module path, which is a source change, not a version bump. GO-2026-5932 against x/crypto v0.56.0 is a false positive. Those belong to the OpenVEX statement work.

Merge request reports