Port therock-7.14 build, CVE Go bump, and docs-lint from pensando main - #34
Merged
Merged
Conversation
…ix agent (#209) Remediate HIGH CVEs found by the canonical image scan (trivy image --ignore-unfixed --severity HIGH,CRITICAL): - gobinary: Go stdlib CVE-2026-42504 (MIME header DoS) -> bump Go 1.25.8 to 1.25.11 in go.mod, tools/base-image/Dockerfile, cmd/deviceconfigmanager/Dockerfile{,.standalone} and the Makefile mod pin. - redhat OS: gnutls CVE-2026-33845/33846/42009/42010 -> add `microdnf update -y` to docker/Dockerfile (matches the DME release image), pulling latest 9.x content (gnutls 3.8.10-4.el9_8). Bumps builder tag v1.2 -> v1.3 (dev.env, box.rb). No dependency replace directives are needed: the gobinary scanner only flags modules compiled into the binary, and none of the go.mod-graph dep CVEs are linked in. Also adds a DCM sec-fix Claude skill + agent (.claude/) that automates this workflow: canonical `trivy image` scan, Go toolchain bump, OS-package update, vendor regen, rebuild, and re-scan to 0 HIGH/CRITICAL. Result: trivy image reports 0 HIGH / 0 CRITICAL on both the gobinary and redhat targets.
* adding docs lint and spellcheck sanity * lint and spellcheck verification
…(#206) - Merge collab-7.12: add therock tarball install support, python3 fix, debian version parsing fix - Upgrade AMDSMI to therock-7.13 tag (commit 79e85e14), built fresh from source using DCM's own amdsmi-compile scripts for all 4 platforms: RHEL9, UBUNTU22, UBUNTU24, AZURE3 - Remove libamd_smi.so.26.2.2 and 26.3.0 from all platform asset dirs - Add libamd_smi.so.26.4.0 built natively per platform - Update dev.env: ROCM_TARBALL_URL to public therock-dist-linux-multiarch-7.13.0.tar.gz - Update docker/Dockerfile: ROCM_VERSION=7.13.0 - Update Makefile: AMDSMI_BRANCH=therock-7.13, AMDSMI_COMMIT=79e85e14...
…ll (#207) Update AMDSMI_BRANCH/AMDSMI_COMMIT defaults from therock-7.12 to therock-7.13 (79e85e14) in both Makefile and tools/smilib-builderimage/entrypoint.sh. Also set ROCM_TARBALL_URL default to the public therock-7.13.0 tarball, matching the Device Metrics Exporter Makefile convention. entrypoint.sh has its own fallback defaults independent of the Makefile — when the builder container is run directly without BRANCH/COMMIT env vars it now builds from therock-7.13 / 79e85e14 (verified: 3.1MB RHEL9 output). Addresses review comments on PR #206.
Co-authored-by: Copilot <198982749+Copilot@users.noreply.github.com>
The AINIC entry was carried over from the pensando fork's wordlist but AINIC is not being ported to this repo.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Ports 5 commits from the pensando fork's
mainthat had not yet been cherry-picked to ROCmmain. AINIC-related work (#138, #185) and internal-only changes (dev.env,box.rb,.claude/,devops/security_scan,branch_policy.yml) were intentionally excluded.Commits (in dependency order):
fix(cve)— bump Go toolchain to 1.25.11 (Go stdlib CVE-2026-42504) and addmicrodnf update -yfor the gnutls OS CVEs. Resolved onto ROCm's existing yum-based build; internal.claude//dev.env/box.rbdropped.feat(rocm)— upgrade to therock public build: libamd_smi 26.4.0 assets, therock tarball install (install-rocm-tarball.sh+ROCM_TARBALL_URL), and removal of thelibamdsmigit submodule. This switches ROCm's AMD SMI delivery from submodule+yum to the therock tarball build.Notes
.claude/,dev.env, andbox.rbverbatim from the original pensando commit; those files were intentionally not included here as they are internal-only.Test plan
make dcm(K8s binary) — Go 1.25.11 CGo-compiles cleanly against the new libamd_smi.so.26.4.0 + amdsmi.h (26.4.0)make dcm-docker— image builds end-to-end;microdnf update -ypulls el9_8 patched packages; therock 7.14.0rc0 tarball downloads and extracts; producesconfig-manager-ubi9-latest.tgz