Security hardening
This release adds the opt-in --strip-xattrs flag (#532). It drops extended attributes and POSIX ACLs, including file capabilities, from the layers kaniko handles; without the flag, behaviour is unchanged. Thanks to @gouldnicholas for reporting that capability xattrs carried by a base image pass through unchanged into the images kaniko builds.
What's Changed
- integration: make the arg_multi fixtures deterministic by @sergiodj in #539
- Drop github.com/docker/docker from the module graph by @sergiodj in #525
- feat: add opt-in --strip-xattrs for xattrs and ACLs in layers by @8none1 in #532
- test(util): drop the docker/docker import from xattr_strip_test.go by @sergiodj in #540
- deps: bump github.com/moby/go-archive from 0.2.0 to 0.3.3 by @sergiodj in #541
- chore(deps): bump the gomod group with 4 updates by @dependabot[bot] in #542
- integration: make Dockerfile_test_issue_2066 independent of archive.ubuntu.com by @sergiodj in #547
- chore(deps): bump golang.org/x/oauth2 from 0.37.0 to 0.38.0 by @dependabot[bot] in #543
- chore(deps): bump google.golang.org/api from 0.310.0 to 0.311.0 by @dependabot[bot] in #544
- chore(deps): bump github.com/moby/moby/api from 1.55.0 to 1.56.1 by @dependabot[bot] in #545
- chore(deps): bump github.com/spf13/pflag from 1.0.10 to 1.1.0 by @dependabot[bot] in #546
- chore(deps): bump golang.org/x/sync from 0.24.0 to 0.25.0 by @dependabot[bot] in #548
- chore(deps): bump golang.org/x/sys from 0.49.0 to 0.50.0 by @dependabot[bot] in #549
- chore(deps): bump the gomod group with 2 updates by @dependabot[bot] in #550
Full Changelog: v1.25.22...v1.25.23