fix: [CI-19672]: fix vuln issue

.harness/harness.yaml

@@ -37,7 +37,7 @@ pipeline:
                       identifier: Build
                       spec:
                         connectorRef: Plugins_Docker_Hub_Connector
-                        image: golang:1.24.11
+                        image: golang:1.23.0
                         shell: Sh
                         command: |-
                           go test ./...
@@ -322,7 +322,7 @@ pipeline:
                       identifier: Build_and_Test
                       spec:
                         connectorRef: Plugins_Docker_Hub_Connector
-                        image: golang:1.24.11
+                        image: golang:1.23.0
                         shell: Sh
                         command: |-
                           go test ./...

cmd/kaniko-acr/main.go

@@ -254,7 +254,7 @@ func main() {
 		cli.StringFlag{
 			Name:   "platform",
 			Usage:  "Allows to build with another default platform than the host, similarly to docker build --platform",
-			EnvVar: "PLUGIN_PLATFORM,PLUGIN_CUSTOM_PLATFORM",
+			EnvVar: "PLUGIN_PLATFORM",
 		},
 		cli.BoolFlag{
 			Name:   "skip-unused-stages",
@@ -292,6 +292,11 @@ func main() {
 			Usage:  "Sub-path within the context to build.",
 			EnvVar: "PLUGIN_CONTEXT_SUB_PATH",
 		},
+		cli.StringFlag{
+			Name:   "custom-platform",
+			Usage:  "Platform to use for building.",
+			EnvVar: "PLUGIN_CUSTOM_PLATFORM",
+		},
 		cli.BoolFlag{
 			Name:   "force",
 			Usage:  "Force building the image even if it already exists.",
@@ -472,13 +477,14 @@ func run(c *cli.Context) error {
 			DigestFile:                  defaultDigestFile,
 			NoPush:                      noPush,
 			Verbosity:                   c.String("verbosity"),
-			CustomPlatform:              c.String("platform"),
+			Platform:                    c.String("platform"),
 			SkipUnusedStages:            c.Bool("skip-unused-stages"),
 			CacheDir:                    c.String("cache-dir"),
 			CacheCopyLayers:             c.Bool("cache-copy-layers"),
 			CacheRunLayers:              c.Bool("cache-run-layers"),
 			Cleanup:                     c.Bool("cleanup"),
 			ContextSubPath:              c.String("context-sub-path"),
+			CustomPlatform:              c.String("custom-platform"),
 			Force:                       c.Bool("force"),
 			ImageNameWithDigestFile:     c.String("image-name-with-digest-file"),
 			ImageNameTagWithDigestFile:  c.String("image-name-tag-with-digest-file"),
@@ -536,21 +542,21 @@ func setupAuth(tenantId, clientId, oidcIdToken, cert,
 		return "", fmt.Errorf("registry must be specified")
 	}
 
+	// Determine auth path: OIDC or Service Principal (secret/cert)
+	if tenantId == "" || clientId == "" {
+		if noPush {
+			logrus.Warnf("NO_PUSH mode: tenantId or clientId not provided")
+			return "", nil
+		}
+		return "", fmt.Errorf("tenantId and clientId must be provided")
+	}
+
 	var aadAccessToken string
 	var acrToken string
 	var publicUrl string
 	var err error
 
 	if oidcIdToken != "" {
-		// OIDC authentication flow requires tenantId and clientId
-		if tenantId == "" || clientId == "" {
-			if noPush {
-				logrus.Warnf("NO_PUSH mode: tenantId or clientId not provided for OIDC")
-				return "", nil
-			}
-			return "", fmt.Errorf("tenantId and clientId must be provided for OIDC authentication")
-		}
-		logrus.Debug("Using OIDC authentication flow")
 		// Exchange OIDC ID token for AAD access token via client_assertion
 		aadAccessToken, err = azureutil.GetAADAccessTokenViaClientAssertion(context.Background(), tenantId, clientId, oidcIdToken, authorityHost)
 		if err != nil {
@@ -565,21 +571,16 @@ func setupAuth(tenantId, clientId, oidcIdToken, cert,
 		if err != nil {
 			return handleError(noPush, err, "failed to fetch ACR token")
 		}
-	} else {
-		logrus.Debug("Using traditional Azure AD authentication flow")
-		// Validate that if tenantId is provided, clientId must also be provided
-		// (unless using managed identity with no explicit tenantId)
-		if tenantId != "" && clientId == "" && clientSecret == "" && cert == "" {
-			if noPush {
-				logrus.Warnf("NO_PUSH mode: tenantId provided but clientId is missing")
-				return "", nil
-			}
-			return "", fmt.Errorf("tenantId and clientId must be provided")
-		}
+	} else if clientSecret != "" || cert != "" {
 		acrToken, publicUrl, err = getACRToken(subscriptionId, tenantId, clientId, clientSecret, cert, registry)
 		if err != nil {
 			return handleError(noPush, err, "failed to fetch ACR Token")
 		}
+	} else {
+		if noPush {
+			return "", nil
+		}
+		return "", fmt.Errorf("managed authentication is not supported")
 	}
 
 	if err := setDockerAuth(username, acrToken, registry, dockerUsername, dockerPassword, dockerRegistry); err != nil {
@@ -598,46 +599,10 @@ func handleError(noPush bool, err error, msg string) (string, error) {
 }
 
 func getACRToken(subscriptionId, tenantId, clientId, clientSecret, cert, registry string) (string, string, error) {
-	// Handle managed identity (when no clientSecret or cert provided)
-	if clientSecret == "" && cert == "" {
-		if tenantId == "" {
-			tenantId = os.Getenv("AZURE_TENANT_ID")
-			if tenantId == "" {
-				tenantId = os.Getenv("TENANT_ID")
-			}
-		}
-		opts := &azidentity.DefaultAzureCredentialOptions{}
-		if tenantId != "" {
-			opts.TenantID = tenantId
-		}
-		cred, err := azidentity.NewDefaultAzureCredential(opts)
-		if err != nil {
-			return "", "", errors.Wrap(err, "failed to get credentials")
-		}
-		policy := policy.TokenRequestOptions{
-			Scopes: []string{"https://management.azure.com/.default"},
-		}
-		azToken, err := cred.GetToken(context.Background(), policy)
-		if err != nil {
-			return "", "", errors.Wrap(err, "failed to fetch access token")
-		}
-		publicUrl, err := getPublicUrl(azToken.Token, registry, subscriptionId)
-		if err != nil {
-			fmt.Fprintf(os.Stderr, "failed to get public url with error: %s\n", err)
-		}
-		if tenantId == "" {
-			return "", "", fmt.Errorf("tenantId cannot be empty for ACR token exchange")
-		}
-		ACRToken, err := fetchACRToken(tenantId, azToken.Token, registry)
-		if err != nil {
-			return "", "", errors.Wrap(err, "failed to fetch ACR token")
-		}
-		return ACRToken, publicUrl, nil
-	}
-
 	if tenantId == "" {
 		return "", "", fmt.Errorf("tenantId can't be empty for AAD authentication")
 	}
+
 	if clientId == "" {
 		return "", "", fmt.Errorf("clientId can't be empty for AAD authentication")
 	}

cmd/kaniko-acr/main_test.go

@@ -387,52 +387,3 @@ func TestSetupAuth_NoCreds_NoPushTrue(t *testing.T) {
 	assert.NoError(t, err)
 	assert.Equal(t, "", pub)
 }
-
-// Test cases for managed identity support
-
-func TestSetupAuth_ManagedIdentity_NoPush_Positive(t *testing.T) {
-	// Positive test: Managed identity flow with noPush=true should succeed
-	// This tests the new managed identity support when no credentials are provided
-	pub, err := setupAuth("tenant123", "", "", "", "", "sub", "myregistry.azurecr.io", "", "", "", "", true)
-	assert.NoError(t, err)
-	assert.Equal(t, "", pub)
-}
-
-func TestSetupAuth_TenantIdButNoClientId_ManagedIdentity(t *testing.T) {
-	// Negative test: When tenantId is provided but clientId is missing for managed identity,
-	// it should fail (unless noPush is true)
-	pub, err := setupAuth("tenant123", "", "", "", "", "sub", "myregistry.azurecr.io", "", "", "", "", false)
-	assert.Error(t, err)
-	assert.Contains(t, err.Error(), "tenantId and clientId must be provided")
-	assert.Equal(t, "", pub)
-}
-
-func TestGetACRToken_ManagedIdentity_NoTenantId(t *testing.T) {
-	// Negative test: Managed identity requires tenantId for ACR token exchange
-	// Clear environment variables to ensure tenantId is not available
-	originalTenantId := os.Getenv("AZURE_TENANT_ID")
-	originalTenantId2 := os.Getenv("TENANT_ID")
-	defer func() {
-		if originalTenantId != "" {
-			os.Setenv("AZURE_TENANT_ID", originalTenantId)
-		} else {
-			os.Unsetenv("AZURE_TENANT_ID")
-		}
-		if originalTenantId2 != "" {
-			os.Setenv("TENANT_ID", originalTenantId2)
-		} else {
-			os.Unsetenv("TENANT_ID")
-		}
-	}()
-	os.Unsetenv("AZURE_TENANT_ID")
-	os.Unsetenv("TENANT_ID")
-
-	// Managed identity path without tenantId should fail
-	// The failure occurs when DefaultAzureCredential tries to acquire a token
-	// since tenantId is required for ACR token exchange but not available
-	_, _, err := getACRToken("sub", "", "", "", "", "myregistry.azurecr.io")
-	assert.Error(t, err)
-	// The error will be from DefaultAzureCredential failing to acquire a token
-	// because tenantId is missing and no credentials are available
-	assert.Contains(t, err.Error(), "failed to fetch access token")
-}

cmd/kaniko-docker/main.go

@@ -213,7 +213,7 @@ func main() {
 		cli.StringFlag{
 			Name:   "platform",
 			Usage:  "Allows to build with another default platform than the host, similarly to docker build --platform",
-			EnvVar: "PLUGIN_PLATFORM,PLUGIN_CUSTOM_PLATFORM",
+			EnvVar: "PLUGIN_PLATFORM",
 		},
 		cli.BoolFlag{
 			Name:   "skip-unused-stages",
@@ -257,6 +257,11 @@ func main() {
 			Usage:  "Sub-path within the context to build.",
 			EnvVar: "PLUGIN_CONTEXT_SUB_PATH",
 		},
+		cli.StringFlag{
+			Name:   "custom-platform",
+			Usage:  "Platform to use for building.",
+			EnvVar: "PLUGIN_CUSTOM_PLATFORM",
+		},
 		cli.BoolFlag{
 			Name:   "force",
 			Usage:  "Force building the image even if it already exists.",
@@ -444,7 +449,7 @@ func run(c *cli.Context) error {
 			NoPush:                      noPush,
 			TarPath:                     c.String("tar-path"),
 			Verbosity:                   c.String("verbosity"),
-			CustomPlatform:              c.String("platform"),
+			Platform:                    c.String("platform"),
 			PushOnly:                    c.Bool("push-only"),
 			SkipUnusedStages:            c.Bool("skip-unused-stages"),
 			CacheDir:                    c.String("cache-dir"),
@@ -452,6 +457,7 @@ func run(c *cli.Context) error {
 			CacheRunLayers:              c.Bool("cache-run-layers"),
 			Cleanup:                     c.Bool("cleanup"),
 			ContextSubPath:              c.String("context-sub-path"),
+			CustomPlatform:              c.String("custom-platform"),
 			Force:                       c.Bool("force"),
 			ImageNameWithDigestFile:     c.String("image-name-with-digest-file"),
 			ImageNameTagWithDigestFile:  c.String("image-name-tag-with-digest-file"),

cmd/kaniko-docker/main_test.go

@@ -206,64 +206,6 @@ func TestDockerBuildArgsProcessing(t *testing.T) {
 	}
 }
 
-func TestPlatformEnvVarMapping(t *testing.T) {
-	tests := []struct {
-		name          string
-		envVar        string
-		envValue      string
-		expectedValue string
-	}{
-		{
-			name:          "PLUGIN_PLATFORM env var",
-			envVar:        "PLUGIN_PLATFORM",
-			envValue:      "linux/amd64",
-			expectedValue: "linux/amd64",
-		},
-		{
-			name:          "PLUGIN_CUSTOM_PLATFORM env var",
-			envVar:        "PLUGIN_CUSTOM_PLATFORM",
-			envValue:      "linux/arm64",
-			expectedValue: "linux/arm64",
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			// Set the environment variable
-			os.Setenv(tt.envVar, tt.envValue)
-			defer os.Unsetenv(tt.envVar)
-
-			app := cli.NewApp()
-			app.Name = "kaniko-docker-test"
-
-			var capturedPlatform string
-
-			app.Flags = []cli.Flag{
-				cli.StringFlag{
-					Name:   "platform",
-					Usage:  "Allows to build with another default platform than the host",
-					EnvVar: "PLUGIN_PLATFORM,PLUGIN_CUSTOM_PLATFORM",
-				},
-			}
-
-			app.Action = func(c *cli.Context) error {
-				capturedPlatform = c.String("platform")
-				return nil
-			}
-
-			err := app.Run([]string{"kaniko-docker-test"})
-			if err != nil {
-				t.Errorf("CLI run error = %v, want nil", err)
-				return
-			}
-
-			if capturedPlatform != tt.expectedValue {
-				t.Errorf("Got platform = %v, want %v", capturedPlatform, tt.expectedValue)
-			}
-		})
-	}
-}
-
 func TestCreateDockerConfig(t *testing.T) {
 	config := docker.NewConfig()
 	tempDir, err := ioutil.TempDir("", "docker-config-test")

cmd/kaniko-ecr/main.go

@@ -244,7 +244,7 @@ func main() {
 		cli.StringFlag{
 			Name:   "platform",
 			Usage:  "Allows to build with another default platform than the host, similarly to docker build --platform",
-			EnvVar: "PLUGIN_PLATFORM,PLUGIN_CUSTOM_PLATFORM",
+			EnvVar: "PLUGIN_PLATFORM",
 		},
 		cli.BoolFlag{
 			Name:   "skip-unused-stages",
@@ -282,6 +282,11 @@ func main() {
 			Usage:  "Sub-path within the context to build.",
 			EnvVar: "PLUGIN_CONTEXT_SUB_PATH",
 		},
+		cli.StringFlag{
+			Name:   "custom-platform",
+			Usage:  "Platform to use for building.",
+			EnvVar: "PLUGIN_CUSTOM_PLATFORM",
+		},
 		cli.BoolFlag{
 			Name:   "force",
 			Usage:  "Force building the image even if it already exists.",
@@ -513,13 +518,14 @@ func run(c *cli.Context) error {
 			DigestFile:                  defaultDigestFile,
 			NoPush:                      noPush,
 			Verbosity:                   c.String("verbosity"),
-			CustomPlatform:              c.String("platform"),
+			Platform:                    c.String("platform"),
 			SkipUnusedStages:            c.Bool("skip-unused-stages"),
 			CacheDir:                    c.String("cache-dir"),
 			CacheCopyLayers:             c.Bool("cache-copy-layers"),
 			CacheRunLayers:              c.Bool("cache-run-layers"),
 			Cleanup:                     c.Bool("cleanup"),
 			ContextSubPath:              c.String("context-sub-path"),
+			CustomPlatform:              c.String("custom-platform"),
 			Force:                       c.Bool("force"),
 			ImageNameWithDigestFile:     c.String("image-name-with-digest-file"),
 			ImageNameTagWithDigestFile:  c.String("image-name-tag-with-digest-file"),

cmd/kaniko-gar/main.go

@@ -207,7 +207,7 @@ func main() {
 		cli.StringFlag{
 			Name:   "platform",
 			Usage:  "Allows to build with another default platform than the host, similarly to docker build --platform",
-			EnvVar: "PLUGIN_PLATFORM,PLUGIN_CUSTOM_PLATFORM",
+			EnvVar: "PLUGIN_PLATFORM",
 		},
 		cli.BoolFlag{
 			Name:   "skip-unused-stages",
@@ -245,6 +245,11 @@ func main() {
 			Usage:  "Sub-path within the context to build.",
 			EnvVar: "PLUGIN_CONTEXT_SUB_PATH",
 		},
+		cli.StringFlag{
+			Name:   "custom-platform",
+			Usage:  "Platform to use for building.",
+			EnvVar: "PLUGIN_CUSTOM_PLATFORM",
+		},
 		cli.BoolFlag{
 			Name:   "force",
 			Usage:  "Force building the image even if it already exists.",
@@ -425,13 +430,14 @@ func run(c *cli.Context) error {
 			SourceTarPath:               c.String("source-tar-path"),
 			TarPath:                     c.String("tar-path"),
 			Verbosity:                   c.String("verbosity"),
-			CustomPlatform:              c.String("platform"),
+			Platform:                    c.String("platform"),
 			SkipUnusedStages:            c.Bool("skip-unused-stages"),
 			CacheDir:                    c.String("cache-dir"),
 			CacheCopyLayers:             c.Bool("cache-copy-layers"),
 			CacheRunLayers:              c.Bool("cache-run-layers"),
 			Cleanup:                     c.Bool("cleanup"),
 			ContextSubPath:              c.String("context-sub-path"),
+			CustomPlatform:              c.String("custom-platform"),
 			Force:                       c.Bool("force"),
 			ImageNameWithDigestFile:     c.String("image-name-with-digest-file"),
 			ImageNameTagWithDigestFile:  c.String("image-name-tag-with-digest-file"),

cmd/kaniko-gcr/main.go

@@ -176,7 +176,7 @@ func main() {
 		cli.StringFlag{
 			Name:   "platform",
 			Usage:  "Allows to build with another default platform than the host, similarly to docker build --platform",
-			EnvVar: "PLUGIN_PLATFORM,PLUGIN_CUSTOM_PLATFORM",
+			EnvVar: "PLUGIN_PLATFORM",
 		},
 		cli.BoolFlag{
 			Name:   "skip-unused-stages",
@@ -214,6 +214,11 @@ func main() {
 			Usage:  "Sub-path within the context to build.",
 			EnvVar: "PLUGIN_CONTEXT_SUB_PATH",
 		},
+		cli.StringFlag{
+			Name:   "custom-platform",
+			Usage:  "Platform to use for building.",
+			EnvVar: "PLUGIN_CUSTOM_PLATFORM",
+		},
 		cli.BoolFlag{
 			Name:   "force",
 			Usage:  "Force building the image even if it already exists.",
@@ -399,13 +404,14 @@ func run(c *cli.Context) error {
 			DigestFile:                  defaultDigestFile,
 			NoPush:                      noPush,
 			Verbosity:                   c.String("verbosity"),
-			CustomPlatform:              c.String("platform"),
+			Platform:                    c.String("platform"),
 			SkipUnusedStages:            c.Bool("skip-unused-stages"),
 			CacheDir:                    c.String("cache-dir"),
 			CacheCopyLayers:             c.Bool("cache-copy-layers"),
 			CacheRunLayers:              c.Bool("cache-run-layers"),
 			Cleanup:                     c.Bool("cleanup"),
 			ContextSubPath:              c.String("context-sub-path"),
+			CustomPlatform:              c.String("custom-platform"),
 			Force:                       c.Bool("force"),
 			ImageNameWithDigestFile:     c.String("image-name-with-digest-file"),
 			ImageNameTagWithDigestFile:  c.String("image-name-tag-with-digest-file"),

docker/gcr/Dockerfile.linux.amd64

@@ -1,4 +1,4 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-amd64
+FROM gcr.io/kaniko-project/executor:v1.23.2
 
 ENV KANIKO_VERSION=1.23.2
 ADD release/linux/amd64/kaniko-gcr /kaniko/

docker/gcr/Dockerfile.linux.arm64

@@ -1,4 +1,4 @@
-FROM harnesscommunity/kaniko-executor:1.25.0-linux-arm64
+FROM gcr.io/kaniko-project/executor:v1.23.2
 
 ENV HOME /root
 ENV USER root

go.mod

@@ -58,4 +58,6 @@ require (
 	gopkg.in/yaml.v3 v3.0.1 // indirect
 )
 
-go 1.24.11
+go 1.23.0
+
+toolchain go1.23.8

kaniko.go

@@ -37,6 +37,7 @@ type (
 		Labels              []string // Label map
 		Mirrors             []string // Docker repository mirrors
 		NoPush              bool     // Set this flag if you only want to build the image, without pushing to a registry
+		Platform            string   // Allows to build with another default platform than the host, similarly to docker build --platform
 		PushOnly            bool     // Specify if the operation is push-only.
 		Repo                string   // Docker build repository
 		SkipTlsVerify       bool     // Docker skip tls certificate verify for registry
@@ -227,15 +228,7 @@ func (p Plugin) Exec() error {
 	}
 
 	if _, err := os.Stat(p.Build.Dockerfile); os.IsNotExist(err) {
-
-		// Get absolute path for better error message. If path is empty, this will
-		// return the current working directory, showing where the plugin looked.
-		absPath, absErr := filepath.Abs(p.Build.Dockerfile)
-		if absErr != nil {
-			absPath = p.Build.Dockerfile
-		}
-
-		return fmt.Errorf("dockerfile does not exist at path: %s", absPath)
+		return fmt.Errorf("dockerfile does not exist at path: %s", p.Build.Dockerfile)
 	}
 
 	var tags = p.Build.Tags
@@ -318,6 +311,10 @@ func (p Plugin) Exec() error {
 		cmdArgs = append(cmdArgs, fmt.Sprintf("--verbosity=%s", p.Build.Verbosity))
 	}
 
+	if p.Build.Platform != "" {
+		cmdArgs = append(cmdArgs, fmt.Sprintf("--customPlatform=%s", p.Build.Platform))
+	}
+
 	if p.Build.SkipUnusedStages {
 		cmdArgs = append(cmdArgs, "--skip-unused-stages")
 	}

kaniko_test.go

@@ -283,57 +283,6 @@ func TestTarPathValidation(t *testing.T) {
 	}
 }
 
-func TestCustomPlatformFlag(t *testing.T) {
-	tests := []struct {
-		name           string
-		customPlatform string
-		expectFlag     bool
-	}{
-		{
-			name:           "with_custom_platform",
-			customPlatform: "linux/amd64",
-			expectFlag:     true,
-		},
-		{
-			name:           "with_custom_platform_arm",
-			customPlatform: "linux/arm64",
-			expectFlag:     true,
-		},
-		{
-			name:           "empty_custom_platform",
-			customPlatform: "",
-			expectFlag:     false,
-		},
-	}
-
-	for _, tt := range tests {
-		t.Run(tt.name, func(t *testing.T) {
-			p := Plugin{
-				Build: Build{
-					Dockerfile:     "Dockerfile",
-					Context:        ".",
-					Repo:           "test/repo",
-					Tags:           []string{"latest"},
-					CustomPlatform: tt.customPlatform,
-					NoPush:         true, // Don't actually push
-				},
-			}
-
-			// We can't actually run Exec() without kaniko installed,
-			// but we can verify the logic by checking the field is set correctly
-			if tt.expectFlag && p.Build.CustomPlatform == "" {
-				t.Errorf("Expected CustomPlatform to be set to %q, but got empty string", tt.customPlatform)
-			}
-			if !tt.expectFlag && p.Build.CustomPlatform != "" {
-				t.Errorf("Expected CustomPlatform to be empty, but got %q", p.Build.CustomPlatform)
-			}
-			if tt.expectFlag && p.Build.CustomPlatform != tt.customPlatform {
-				t.Errorf("Expected CustomPlatform to be %q, but got %q", tt.customPlatform, p.Build.CustomPlatform)
-			}
-		})
-	}
-}
-
 func TestSourceTarballPush(t *testing.T) {
 	tests := []struct {
 		name          string