Skip to content

Upgrade azurelinux-image-tools to version 1.3.0#16916

Open
v-aaditya wants to merge 4 commits intomicrosoft:3.0-devfrom
Kanishk-Bansal:topic_azurelinux-image-tools-3.0
Open

Upgrade azurelinux-image-tools to version 1.3.0#16916
v-aaditya wants to merge 4 commits intomicrosoft:3.0-devfrom
Kanishk-Bansal:topic_azurelinux-image-tools-3.0

Conversation

@v-aaditya
Copy link
Copy Markdown
Contributor

@v-aaditya v-aaditya commented Apr 28, 2026

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge

Summary
  • Upgrade azurelinux-image-tools to version 1.3.0.
  • The azurelinux-image-tools package has been upgraded to version 1.3.0 and the CVE-2026-27141, CVE-2026-29181 and CVE-2026-39882 does not affect the respective vendor packages as they are not in affected range. Please refer below screenshot -
    image
Change Log
  • deleted: SPECS/azurelinux-image-tools/CVE-2026-27141.patch
  • modified: SPECS/azurelinux-image-tools/azurelinux-image-tools.signatures.json
  • modified: SPECS/azurelinux-image-tools/azurelinux-image-tools.spec
  • modified: cgmanifest.json
Does this affect the toolchain?

NO

Links to CVEs
Test Methodology
  • Local Build was sucessful.
    image

  • The license script shows no warning.

  • The changelog history has been verified using rpmspec command and there are no issues in it.

  • The Installation and Uninstallation of generated RPMs has been verified on docker image.

Corrected email format for Aditya Singh in changelog.
@Kanishk-Bansal Kanishk-Bansal added security CVE-fixed-by-upgrade CVE fixed by package upgrade labels Apr 28, 2026
Copy link
Copy Markdown
Contributor

@Kanishk-Bansal Kanishk-Bansal left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

remove

# Replace CGO_ENABLED=0 with CGO_ENABLED=1 in 'tools.mk' as it results in build failure.
sed -i 's/CGO_ENABLED=0/CGO_ENABLED=1/g' toolkit/scripts/tools.mk

@Kanishk-Bansal Kanishk-Bansal self-requested a review April 29, 2026 06:42
Removed sed command to change CGO_ENABLED from 0 to 1 in tools.mk, which was causing build failures as suggested by Kanishk.

%build
export GOPATH=%{our_gopath}
export GOFLAGS="-mod=vendor"
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Let's try to add a ms_nocgo flag :)

Suggested change
export GOFLAGS="-mod=vendor"
export GOEXPERIMENT=ms_nocgo_opensslcrypto

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have added as suggested.

%build
export GOPATH=%{our_gopath}
export GOFLAGS="-mod=vendor"
export GOEXPERIMENT=ms_nocgo_opensslcrypto
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Triggered test build: link

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

3.0-dev PRs Destined for AzureLinux 3.0 CVE-fixed-by-upgrade CVE fixed by package upgrade Packaging security

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants