Gospatial/tegola:latest docker image haves security issues

[fjrsaracho]

Hello,

Scanning Gospatial/tegola:latest with trivy scan is reporting security issue marked as critical CVE-2024-24790

It is already fixed on stdlib >1.21.11

[ARolek]

@fjrsaracho thanks for the report! I will get this updated for the next release. This makes me think we should implement weekly code scanning to keep on top of these vulns. That way it's not just pushes that trigger the scan.

[fjrsaracho]

@ARolek Investigating a bit seems to be easy to implement there is already an action supported by aquasecurity, check it out here: https://github.com/aquasecurity/trivy-action

May I ask why are you uploading vendors?

[ARolek]

@ARolek Investigating a bit seems to be easy to implement there is already an action supported by aquasecurity, check it out here: https://github.com/aquasecurity/trivy-action

Do you know if Trivy is free for open source? I have only encountered it commercially.

May I ask why are you uploading vendors?

As in, why are we vendoring our dependancies? This is a long debated project, but generally speaking I want the project to be buildable without needing to fetch anything externally.

[fjrsaracho]

Hello!
It is under Apache License 2.0. Including comercial usage. You can read more on following link: https://github.com/aquasecurity/trivy/blob/main/LICENSE

Not sure if it fits for you as a real "open-source"