Upgrade kured to 1.14.2 for vendored go CVE-2023-39325 (#7275)

Author: mandeepsplaha

SPECS/kured/kured-imagePullPolicy.patch

@@ -1,25 +1,21 @@
-From 492288d56314c65316a6d6f50b4b79c2eb0b267e Mon Sep 17 00:00:00 2001
-From: Rachel Menge <rachelmenge@microsoft.com>
-Date: Wed, 8 Nov 2023 10:51:46 -0800
-Subject: [PATCH] kured-imagePullPolicy patch updated for 1.13.2
+From: Mandeep Plaha <mandeepplaha@microsoft.com>
+Date: Tue, 16 Jan 2024 12:57:00 -0800
+Subject: [PATCH] kured-imagePullPolicy patch updated for 1.14.2
 
 ---
  kured-ds.yaml | 2 +-
  1 file changed, 1 insertion(+), 1 deletion(-)
 
 diff --git a/kured-ds.yaml b/kured-ds.yaml
-index 7721fa1..78322da 100644
+index 1f03c2c..9f0416f 100644
 --- a/kured-ds.yaml
 +++ b/kured-ds.yaml
 @@ -34,7 +34,7 @@ spec:
            # If you find yourself here wondering why there is no
            # :latest tag on Docker Hub,see the FAQ in the README
-           image: ghcr.io/kubereboot/kured:1.13.2
+           image: ghcr.io/kubereboot/kured:1.14.2
 -          imagePullPolicy: IfNotPresent
 +          imagePullPolicy: Always
            securityContext:
              privileged: true # Give permission to nsenter /proc/1/ns/mnt
-           ports:
--- 
-2.17.1
-
+             readOnlyRootFilesystem: true

SPECS/kured/kured.signatures.json

@@ -1,6 +1,6 @@
 {
  "Signatures": {
-  "kured-1.13.2-vendor.tar.gz": "be2c5510693081a35abf911fd1bf0b7f202b1e59e3857e6f889fa101756cb7b5",
-  "kured-1.13.2.tar.gz": "9b90a12d2343387800f9e83690c01e2f2012b512c4b8d591334e78984b3a1528"
+  "kured-1.14.2-vendor.tar.gz": "42cb8ada114c4415e17b8904f714678cbedba2c196f91e694f9eb5a51427e6d0",
+  "kured-1.14.2.tar.gz": "bdf1cde40637039d643990c8c5a5dc8be643c11d05ee6139688bbab27868650d"
  }
 }

SPECS/kured/kured.spec

@@ -24,7 +24,7 @@
 %global debug_package %{nil}
 Summary:        Kubernetes daemonset to perform safe automatic node reboots
 Name:           kured
-Version:        1.13.2
+Version:        1.14.2
 Release:        1%{?dist}
 License:        Apache-2.0
 Vendor:         Microsoft Corporation
@@ -122,6 +122,9 @@ sed -i -e 's|image: .*|image: registry.opensuse.org/kubic/kured:%{version}|g' %{
 %{_datarootdir}/k8s-yaml/kured/kured.yaml
 
 %changelog
+* Tue Jan 16 2024 Mandeep Plaha <mandeepplaha@microsoft.com> - 1.14.2-1
+- Upgrade to 1.14.2 for vendored go CVE-2023-39325
+
 * Mon Nov 06 2023 Rachel Menge <rachelmenge@microsoft.com> - 1.13.2-1
 - Upgrade to 1.13.2 for vendored go CVEs
 

cgmanifest.json

@@ -8411,8 +8411,8 @@
         "type": "other",
         "other": {
           "name": "kured",
-          "version": "1.13.2",
-          "downloadUrl": "https://github.com/weaveworks/kured/archive/refs/tags/1.13.2.tar.gz"
+          "version": "1.14.2",
+          "downloadUrl": "https://github.com/weaveworks/kured/archive/refs/tags/1.14.2.tar.gz"
         }
       }
     },