distroless

No entries match these filters. Clear filters

1. changes since 2026-10-26 Oct 28, 2026 · issue 123
   • Updated supported platform Bumping non-snapshot packages to latest stable versions
   └──▷ BREAKING ON UPGRADE

   • !The --set-github-output-on-diff flag has been removed from diff.bash; GitHub ActionsGitHub ActionsGitHub's built-in CI/CD system that runs automated workflows triggered by repository events, letting cyber tools automate testing, building, and releasing without managing separate pipeline infrastructure. output is now written automatically when GITHUB_ACTIONS=true and GITHUB_OUTPUT is set.
2. changes since 2026-10-20 Oct 26, 2026 · issue 122

   distroless diff tool now fails fast when no image targets are selected, and batches Bazel builds to cut elapsed time by up to 34%.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • The diff tool exits with an explicit error when --only <target> matches no image targets in the query file, rather than silently succeeding.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

3. changes since 2026-10-17 Oct 20, 2026 · issue 115

   Distroless blocks compromised CA roots and switches Node.js images to system CA trust store⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Blocks two compromised CA roots (AAA Certificate Services and 'emSign ECC Root CA - G3') from the ca-certificates.crt bundle, matched by SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. SPKI hash to catch renames and re-issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a TestBlockedRoots test in common/cacerts_test.go that validates every image archive against a blockedSPKIs denylist, covering both the PEM bundle at etc/ssl/certs/ca-certificates.crt and the Java trust store at etc/ssl/certs/java/cacerts.
   • Allows skipping the mandatory 1-day soak time for image updates, enabling faster emergency pushes.
   • Blocks two compromised CA roots (AAA Certificate Services and 'emSign ECC Root CA - G3') from the ca-certificates.crt bundle, matched by SHA-256SHA-256A cryptographic hash function that turns data into a fixed 256-bit fingerprint. It is used to check integrity; hashing does not encrypt the original data. SPKI hash to catch renames and re-issues.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Adds a TestBlockedRoots test in common/cacerts_test.go that validates every image archive against a blockedSPKIs denylist, covering both the PEM bundle at etc/ssl/certs/ca-certificates.crt and the Java trust store at etc/ssl/certs/java/cacerts.

   1 more in Everything

4. changes since 2026-09-10 Oct 1, 2026 · issue 092

   Distroless adds a Dart example using the base-nossl image and requires Dart 3.9 for the dart build CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   • Adds a Dart example (examples/dart/bin/hello.dart) demonstrating a distroless container built with the base-nossl image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠
   • Requires Dart 3.9 for the dart build CLI when building distroless Dart images.
   • Adds a Dart example (examples/dart/bin/hello.dart) demonstrating a distroless container built with the base-nossl image.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 more in Everything

5. changes since 2026-09-10 Sep 24, 2026 · issue 085

   Distroless adds a Dart example using the base-nossl image and requires Dart 3.9 for the dart build CLI.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   └──▷ USE IT
   Bootstrap a minimal Dart distroless container using the base-nossl image, as shown in the new example.
   examples/dart/bin/hello.dart copy

   // examples/dart/bin/hello.dart
   void main() {
     print('Hello, distroless!');
   }

   • Requires Dart 3.9 for the dart build CLI when building distroless Dart containers.⁠︀︄︇︀︅︉︀︅︀︀︃︀︀︅︅︀︅︊︀︄︆︀︃︄⁠

   1 detail in Everything

6. changes since 2026-08-31 Sep 10, 2026 · issue 071
   └──▷ BREAKING ON UPGRADE

   • !Debian 12 (debian12) base image builds are removed — any image pipeline pulling a debian12 distroless variant will break on upgrade.
7. changes since 2026-08-01 Aug 31, 2026 · issue 060

   Distroless hardens Node.js supply-chain trust with GPG signature verification and an update-node-keys subcommand in knife.

   └──▷ TRY IT
   Generate an SPDXSPDXAn open standard for describing software components, licenses and their relationships. Its documents let different tools exchange a software bill of materials without inventing a new format. JSON SBOMSBOMA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue. for a generic (non-Debian) package such as a Node.js binary archive.
   copy

   $ go run private/pkg/package_spdx.go \
     --package_name nodejs \
     --version 22.23.2 \
     --purl 'pkg:generic/nodejs@22.23.2?download_url=https://nodejs.org/' \
     --sha256 <sha256-of-archive> \
     --url https://nodejs.org/dist/v22.23.2/node-v22.23.2-linux-x64.tar.gz \
     --id nodejs-22.23.2 \
     --supplier 'Organization: OpenJS Foundation' \
     --output nodejs.spdx.json

   • Exposes update-node-keys subcommand in knife to sync committed Node.js release public keys from the upstream nodejs/release-keys repository, callable directly from CI workflows.
   • Verifies Node.js SHASUMS256.txt.asc via GPG --decrypt against committed release keys stored in knife.d/nodejs_keys.asc, replacing the previous unsigned plaintext fetch — no network access for key material.
   • Imports Node.js release public keys into an isolated temporary GNUPGHOME keyring (using gpg --batch --import) so GPG verification is hermetic and does not pollute the host keyring.
   • Switches all gpg calls in the Node.js updater to execFileSync with argument arrays, eliminating shell-expansion attack surfaceattack surfaceThe exposed systems, interfaces and access points an attacker could try to use. It includes internet-facing services as well as identities, software and other reachable resources. during checksum verification.
   • Adds package_spdx.go tool that generates per-package SPDX JSON SBOMsSBOMsA software bill of materials, an inventory of the components and versions inside an application. It helps teams find affected software when a dependency has a vulnerability or licensing issue., accepting --package_name, --version, --purl, --sha256, --url, --id, --copyright, --generates, --homepage, --supplier, and --description flags.

   +1 more show less

   • Adds rollback prevention to package update scripts so versions cannot regress during automated bumps.

   6 details in Everything