s360: Resolve library vulnerabilty by auspham · Pull Request #26161 · sonic-net/sonic-buildimage

auspham · 2026-03-13T02:44:26Z

Why I did it

After #25876, there are still some left over vulnerabilities. Majority is gnoic and go library. Some new introduces by the upgrade of protobuf==6.31.1.

This PR will try to address them

Work item tracking

Microsoft ADO (number only):

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

mssonicbld · 2026-03-13T02:44:35Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-13T02:44:47Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Updates SONiC build and Azure Pipelines defaults to use the publicmirror.azurecr.io container registry, aligning build-time configuration and CI image publishing with the new registry endpoint.

Changes:

Switch default docker registry in rules/config from sonicdev-microsoft.azurecr.io to publicmirror.azurecr.io.
Update Azure Pipelines parameters (registry_url) to default to publicmirror.azurecr.io for sonic-slave and sonic-mgmt pipelines.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 3 comments.

File	Description
`rules/config`	Changes default registry host used when pulling/pushing SONiC docker images during builds.
`.azure-pipelines/docker-sonic-slave.yml`	Updates the default registry URL parameter for sonic-slave CI builds.
`.azure-pipelines/docker-sonic-slave-template.yml`	Updates the default registry URL parameter used by the sonic-slave build template.
`.azure-pipelines/docker-sonic-mgmt.yml`	Updates the default registry URL parameter for sonic-mgmt image build/push pipeline.

Comments suppressed due to low confidence (1)

.azure-pipelines/docker-sonic-slave-template.yml:28

registry_url now defaults to publicmirror.azurecr.io, but pushes depend on Docker@2 login via registry_conn. If registry_conn is still configured for the old registry, the subsequent docker push $REGISTRY_SERVER/... will fail. Consider changing the default registry_conn (or adding a check) so the login registry and registry_url stay in sync.

- name: registry_url
  type: string
  default: publicmirror.azurecr.io
- name: registry_conn
  type: string
  default: sonicdev
- name: pool

.azure-pipelines/docker-sonic-slave.yml

.azure-pipelines/docker-sonic-mgmt.yml

rules/config

mssonicbld · 2026-03-13T02:56:23Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-13T02:56:36Z

Azure Pipelines successfully started running 1 pipeline(s).

mssonicbld · 2026-03-15T21:34:45Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-15T21:34:59Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Updates SONiC build and CI defaults to use the publicmirror.azurecr.io container registry, aligning local build configuration (rules/config) with Azure Pipelines image build/push pipelines.

Changes:

Switched the default docker registry server in rules/config to publicmirror.azurecr.io.
Updated Azure Pipelines defaults (registry_url, registry_conn) for docker-sonic-slave and docker-sonic-mgmt builds to use publicmirror.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated no comments.

File	Description
`rules/config`	Updates default `REGISTRY_SERVER` to point builds/pulls at `publicmirror.azurecr.io`.
`.azure-pipelines/docker-sonic-slave.yml`	Changes default registry URL and service connection name used by the sonic-slave build pipeline.
`.azure-pipelines/docker-sonic-slave-template.yml`	Changes default registry URL and service connection name used by the sonic-slave template.
`.azure-pipelines/docker-sonic-mgmt.yml`	Changes default registry URL and service connection name used by the sonic-mgmt build/publish pipeline.

mssonicbld · 2026-03-15T22:19:00Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-15T22:19:12Z

Azure Pipelines successfully started running 1 pipeline(s).

dockers/docker-ptf/Dockerfile.j2

rules/config

mssonicbld · 2026-03-16T06:44:22Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-16T06:44:35Z

Azure Pipelines successfully started running 1 pipeline(s).

Copilot

Pull request overview

Updates build/pipeline defaults to use the public mirror container registry, and adjusts docker-ptf build steps and dependency pinning.

Changes:

Switch Azure Pipelines docker build defaults from sonicdev-microsoft.azurecr.io to publicmirror.azurecr.io.
Modify docker-ptf to install a Go toolchain and build grpcurl/gnoic from source, plus update protobuf pinning for gnxi tooling.
Remove the setuptools==65.5.1 pin in the shared Dockerfile macro.

Reviewed changes

Copilot reviewed 6 out of 6 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
`dockers/dockerfile-macros.j2`	Removes setuptools version pin used during “offending packages” installs.
`dockers/docker-ptf/gnxi-patches/0005-Enhance-gnmi_cli_py-4.patch`	Updates protobuf requirement version in gnxi patch.
`dockers/docker-ptf/Dockerfile.j2`	Reworks grpcurl/gnoic install to build from source with Go; updates protobuf pin and related comments.
`.azure-pipelines/docker-sonic-slave.yml`	Default registry URL/connection updated to public mirror.
`.azure-pipelines/docker-sonic-slave-template.yml`	Default registry URL/connection updated to public mirror.
`.azure-pipelines/docker-sonic-mgmt.yml`	Default registry URL/connection updated to public mirror.

liushilongbuaa · 2026-03-16T10:42:14Z

dockers/dockerfile-macros.j2

        RUN pip3 install {{ pkg }}
-        RUN pip3 install setuptools==65.5.1
+        RUN pip3 install setuptools
    {%- endfor %}


Yes. It's better put outside for loop.

dockers/docker-ptf/Dockerfile.j2

+# Install Go toolchain for building grpcurl and gnoic from source
+# to ensure they use a patched Go stdlib (GO-2026-4337: crypto/tls)
+{% if CONFIGURED_ARCH == "armhf" %}
+RUN GO_ARCH=armv6l \
+{% elif CONFIGURED_ARCH == "arm64" %}
+RUN GO_ARCH=arm64 \
+{% else %}
+RUN GO_ARCH=amd64 \
+{% endif %}
+    && GO_VERSION=1.25.8 \
+    && curl -L "https://go.dev/dl/go${GO_VERSION}.linux-${GO_ARCH}.tar.gz" -o /tmp/go.tar.gz \
+    && tar -C /usr/local -xzf /tmp/go.tar.gz \
+    && rm /tmp/go.tar.gz


dockers/docker-ptf/Dockerfile.j2

 # gnxi/gnmi_cli_py ships pre-generated _pb2.py stubs; they are
-# Pin to 6.31.1 to match grpcio-tools keep a known-good version.
+# Pin to 6.33.5 to match grpcio-tools keep a known-good version.
 RUN set -e; \
    . /etc/os-release; \
    if [ "$VERSION_CODENAME" = "bookworm" ]; then \
-        pip install protobuf==6.31.1; \
+        pip install protobuf==6.33.5; \


dockers/docker-ptf/Dockerfile.j2


+# Remove Go toolchain to reduce image size
+RUN rm -rf /usr/local/go "$(go env GOPATH 2>/dev/null || echo $HOME/go)"
+ENV PATH="/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"


liushilongbuaa · 2026-03-16T06:48:26Z

.azure-pipelines/docker-sonic-mgmt.yml

 - name: registry_url
  type: string
-  default: sonicdev-microsoft.azurecr.io
+  default: publicmirror.azurecr.io


We can't change this

liushilongbuaa · 2026-03-16T06:48:38Z

.azure-pipelines/docker-sonic-slave-template.yml

 - name: registry_url
  type: string
-  default: sonicdev-microsoft.azurecr.io
+  default: publicmirror.azurecr.io


We can't change this

liushilongbuaa · 2026-03-16T06:48:51Z

.azure-pipelines/docker-sonic-slave.yml

 - name: registry_url
  type: string
-  default: sonicdev-microsoft.azurecr.io
+  default: publicmirror.azurecr.io


We can't change this

Signed-off-by: Austin Pham <[email protected]>

mssonicbld · 2026-03-16T10:10:25Z

/azp run Azure.sonic-buildimage

azure-pipelines · 2026-03-16T10:10:38Z

Azure Pipelines successfully started running 1 pipeline(s).

StormLiangMS

Code Review

1. Go version 1.25.8 — does this exist?
Go's current latest stable is around 1.24.x. Please verify that go1.25.8 is actually available on https://go.dev/dl/ — if it doesn't resolve, the Docker build will fail silently with a curl download error.

2. setuptools unpinned — potential reproducibility risk
\\dockerfile

```
   RUN pip3 install setuptools==65.5.1
```

```
   RUN pip3 install setuptools
```

\
Fully unpinning setuptools means builds could pull different versions over time, risking non-reproducible builds. Consider pinning to a minimum safe version (e.g. setuptools>=75.0) instead of leaving it completely open.

3. protobuf bump 6.31.1 → 6.33.5 ✅
Consistently applied across all 3 locations (Dockerfile.j2, patch file, gnxi install). Looks good.

4. Building grpcurl/gnoic from source ✅
Good approach to address GO-2026-4337 (crypto/tls). Go toolchain cleanup at the end is a nice touch to keep image size down.

Overall looks good — just the two minor items above to address.

StormLiangMS

LGTM — approving this PR for the security fixes.

The two minor items (Go version validation and setuptools pinning) can be addressed in a follow-up PR if needed.

auspham · 2026-03-17T00:58:38Z

Go version exists.
We unpin to prioritizing vulnerability resolve first. Once all clear we can pin to the last working version.

auspham requested review from lguohan, qiluo-msft and xumia as code owners March 13, 2026 02:44

Copilot AI review requested due to automatic review settings March 13, 2026 02:44

Copilot started reviewing on behalf of auspham March 13, 2026 02:45 View session

Copilot AI reviewed Mar 13, 2026

View reviewed changes

.azure-pipelines/docker-sonic-slave.yml Outdated Show resolved Hide resolved

.azure-pipelines/docker-sonic-mgmt.yml Outdated Show resolved Hide resolved

rules/config Show resolved Hide resolved

auspham force-pushed the austinpham/36979761-update-docker-registry branch from 29351a0 to 60129e5 Compare March 13, 2026 02:56

Copilot AI review requested due to automatic review settings March 15, 2026 21:34

auspham force-pushed the austinpham/36979761-update-docker-registry branch from 60129e5 to fae3993 Compare March 15, 2026 21:34

Copilot started reviewing on behalf of auspham March 15, 2026 21:35 View session

Copilot AI reviewed Mar 15, 2026

View reviewed changes

auspham force-pushed the austinpham/36979761-update-docker-registry branch from fae3993 to fd6bdd8 Compare March 15, 2026 22:18

liushilongbuaa reviewed Mar 16, 2026

View reviewed changes

dockers/docker-ptf/Dockerfile.j2 Show resolved Hide resolved

liushilongbuaa reviewed Mar 16, 2026

View reviewed changes

rules/config Outdated Show resolved Hide resolved

Copilot AI review requested due to automatic review settings March 16, 2026 06:44

auspham force-pushed the austinpham/36979761-update-docker-registry branch from fd6bdd8 to 63ed114 Compare March 16, 2026 06:44

Copilot started reviewing on behalf of auspham March 16, 2026 06:44 View session

Copilot AI reviewed Mar 16, 2026

View reviewed changes

liushilongbuaa reviewed Mar 16, 2026

View reviewed changes

ci: update docker registry

8a895f3

Signed-off-by: Austin Pham <[email protected]>

auspham force-pushed the austinpham/36979761-update-docker-registry branch from 63ed114 to 8a895f3 Compare March 16, 2026 10:10

liushilongbuaa approved these changes Mar 16, 2026

View reviewed changes

auspham changed the title ~~ci: update docker registry~~ s360: Resolve library vulnerabilty Mar 16, 2026

StormLiangMS reviewed Mar 17, 2026

View reviewed changes

StormLiangMS approved these changes Mar 17, 2026

View reviewed changes

StormLiangMS merged commit e42b303 into sonic-net:master Mar 17, 2026
20 checks passed

auspham added Request for 202505 Branch Request for 202511 Branch labels Mar 18, 2026

mssonicbld added the Cherry Pick Conflict_202505 label Mar 18, 2026

This was referenced Mar 18, 2026

[202511] Cherry-pick 26161 s360: Resolve library vulnerabilty #26239

Merged

[202505] Cherry-pick 26161 s360: Resolve library vulnerabilty #26240

Merged

[202411] Fix 202411 vulnerability #26326

Open

Conversation

auspham commented Mar 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Why I did it

Work item tracking

How I did it

How to verify it

Which release branch to backport (provide reason below if selected)

Tested branch (Please provide the tested image version)

Description for the changelog

Link to config_db schema for YANG module changes

A picture of a cute animal (not mandatory but encouraged)

Uh oh!

mssonicbld commented Mar 13, 2026

Uh oh!

azure-pipelines bot commented Mar 13, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Mar 13, 2026

Uh oh!

azure-pipelines bot commented Mar 13, 2026

Uh oh!

mssonicbld commented Mar 15, 2026

Uh oh!

azure-pipelines bot commented Mar 15, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

mssonicbld commented Mar 15, 2026

Uh oh!

azure-pipelines bot commented Mar 15, 2026

Uh oh!

Uh oh!

Uh oh!

mssonicbld commented Mar 16, 2026

Uh oh!

azure-pipelines bot commented Mar 16, 2026

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

liushilongbuaa Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

liushilongbuaa Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

liushilongbuaa Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

liushilongbuaa Mar 16, 2026

Choose a reason for hiding this comment

Uh oh!

mssonicbld commented Mar 16, 2026

Uh oh!

azure-pipelines bot commented Mar 16, 2026

Uh oh!

StormLiangMS left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

StormLiangMS left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

auspham commented Mar 17, 2026

Uh oh!

Reviewers

auspham commented Mar 13, 2026 •

edited

Loading