infobloxopen / migrate

53%

ib: 53%

LAST BUILD ON BRANCH dktest-moby

branch: dktest-moby

CHANGE BRANCH

x

Reset

Sync Branches

• dktest-moby
• alpine-master
• alpine-upgrade
• aws-sdk-v2
• ci-stable-test-check
• cve-ai-fix
• cve-fix
• dirty-state-down-steps-up
• hostname_pgx
• hotload
• ib
• image-scan
• jenkins-go
• jenkins-go-1268
• master
• merge-upstream
• no-make-docker
• pgx-migrate-test
• pgx_hotload
• pgx_pg
• pgx_register
• refs/tags/v1.0.10
• refs/tags/v1.0.11
• refs/tags/v1.0.12
• refs/tags/v1.0.13
• refs/tags/v1.0.3
• refs/tags/v1.0.4
• refs/tags/v1.0.6
• refs/tags/v1.0.7
• refs/tags/v1.0.8
• refs/tags/v1.0.9
• reportImage
• specify-alpine-version
• storeMigratesInDB
• sync-upstream
• tdrpt-6373-reduce-CVEs
• tdrpt-6835-reduce-cves
• tdrpt-7838-reduce-CVEs
• update-go
• update_aws_go_version_to_v2
• upgrade-otel-v1.42.0
• vuln-fixes

Build # 35296949798

Build Type

Pull #66

github

Committed by daniel-garcia

Commit Message

Drop github.com/docker/docker via org-controlled dktest fork

github.com/docker/docker carries five advisories that no version bump can
clear: the module path stopped publishing at v28.5.2 (which we already
had) when the project renamed to github.com/moby/moby/v2, so the Go vuln
DB records them as `introduced: 0` with no fixed event. Trivy suggests a
fix at 29.3.1, but that is the Docker project release number and is not
resolvable on this module path -- `go get` rejects it as an unknown
revision.

Nothing in the shipped binary reaches this code; govulncheck reports zero
reachable vulnerabilities either way. It is imported only by dktesting,
which is used exclusively from _test.go files. The cost is manifest-level:
SCA tooling (BlackDuck Polaris, trivy) flags all five regardless of
reachability. Upstream hit the same problem and migrated their own test
harness off it in 3add8f4.

The only remaining requirement was dhui/dktest, whose latest release
(v0.4.6) still imports docker/docker. dhui/dktest#53 migrates it to
github.com/moby/moby and is open but unmerged, so this points the
requirement at our own fork of that branch, pinned to the exact commit.
It needs no new dependencies: moby/moby/api v1.54.2 and moby/moby/client
v0.4.1 are the versions this module already used, and neither path is
flagged -- the advisories name the github.com/moby/moby root module, not
those subpaths.

Trivy manifest findings go from 5 to 1; what remains is the x/crypto
openpgp advisory, which has no fix on any version and stays only because
x/crypto is in the module graph. The openpgp package itself is no longer
imported.

Revert this replace once dhui/dktest#53 ships a tagged release. Note that
replace directives are ignored by downstream consumers, so this affects
only builds and scans of this repository.

Verified: go build, go vet (which type-checks every _test.go, where
dktesting is consumed), and the non-docker test packages all pass.

Pull Request Pull Request #66: Drop github.com/docker/docker via org-controlled dktest fork

Coverage Stats

4442 of 8437 relevant lines covered (52.65%)

6491.71 hits per line