RDX Rentals Demo MinIO corresponding-source offer ================================================ RDX Rentals Demo runs a source-built MinIO object server behind the public asset domain. The build updates vulnerable Go dependencies without changing MinIO's application source files. MinIO and the MinIO Client are licensed under the GNU Affero General Public License, version 3. You may obtain, build, modify, and redistribute the corresponding source under that license. RDX modification date: 2026-07-21 RDX modifications: dependency version selection and build metadata only; the pinned upstream MinIO and MinIO Client application source files are unchanged. MinIO server ------------ Release: RELEASE.2025-10-15T17-29-55Z Commit: 9e49d5e7a648f00e26f2246f4dc28e6b07f8c84a Source: https://codeload.github.com/minio/minio/tar.gz/9e49d5e7a648f00e26f2246f4dc28e6b07f8c84a Source archive SHA-256: 45521908307306e925c98d629e1c17d78c8b72b6ee242b1bfb1409f7d8ee5841 MinIO Client ------------ Release: RELEASE.2025-08-13T08-35-41Z Commit: 7394ce0dd2a80935aded936b09fa12cbb3cb8096 Source: https://codeload.github.com/minio/mc/tar.gz/7394ce0dd2a80935aded936b09fa12cbb3cb8096 Source archive SHA-256: 95cd293c7119f16921a6dc515a1fb74a2227f19fd994b9c8b770a154e802ac44 License: https://www.gnu.org/licenses/agpl-3.0.html The complete, machine-readable modification and build recipes used for the running binaries follow. Each recipe pins the upstream source archive, verifies its SHA-256 digest, records every dependency update, and builds the executable. The referenced public module sources are fetched by Go while executing the recipe. No private source, patch, or build step is required. Build either image from a directory containing the corresponding Dockerfile: docker build --file scripts/minio.Dockerfile --tag rdx-minio:RELEASE.2025-10-15T17-29-55Z . docker build --file scripts/minio-client.Dockerfile --tag rdx-minio-client:RELEASE.2025-08-13T08-35-41Z . --- scripts/minio.Dockerfile --- # CVE-2026-39821 + CVE-2026-46600: HIGH Go stdlib findings fixed in Go 1.26.6 — the # previous golang:1.26.5 digest pin was itself the exposure, so the toolchain moves here. # CVE-2026-78667 (net/http DoS via crafted HTTP Range headers), CVE-2026-78669 (DoS via # excessive HTTP/2 SETTINGS frames, in net/http's bundled http2 and in golang.org/x/net/http2) # and CVE-2026-97031 (crypto/tls DoS via multiple ECH outer extension references): HIGH Go # stdlib findings published after 2026-10-06, all three fixed in 1.26.9 / 1.27.2, so 1.26.6 aged # into the exposure in turn. # 1.26.10 since 2026-10-20: the go1.26.9...go1.26.10 compare on golang/go is three commits, and # one of them, aa64342a9e ("crypto/x509: distrust a handful of intermediates"), says it fixes # CVE-2026-111943. OSV, vuln.go.dev, cve.org and NVD had no record of that CVE when read on # 2026-10-20. On 2026-10-20, 1.26.10-alpine3.24 and 1.26-alpine3.24 resolve to the # docker.io/library/golang index digest below, the official-images library/golang file lists that # tag at docker-library/golang commit 650cf2f3 (1.26/alpine3.24), and 1.26.11-alpine3.24 is not # found. FROM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS builder ARG TARGETOS=linux ARG TARGETARCH WORKDIR /src RUN wget -q -O /tmp/minio.tar.gz \ https://codeload.github.com/minio/minio/tar.gz/9e49d5e7a648f00e26f2246f4dc28e6b07f8c84a \ && echo '45521908307306e925c98d629e1c17d78c8b72b6ee242b1bfb1409f7d8ee5841 /tmp/minio.tar.gz' | sha256sum -c - \ && tar -xzf /tmp/minio.tar.gz --strip-components=1 \ && rm -f /tmp/minio.tar.gz RUN --mount=type=cache,target=/go/pkg/mod \ --mount=type=cache,target=/root/.cache/go-build \ # CVE-2026-56854 (CRITICAL, published 2026-08-31): x/crypto v0.53.0 — previously the FIXED # version — became the finding; first fixed is v0.55.0, which requires x/text >= v0.41.0 # (still carrying the v0.39.0 fix). Same-day fleet event: caddy and minio-client move in # this commit too. # x/net moves v0.56.0 -> v0.57.0 on the same resolver requirement; a later version keeps # whatever v0.56.0 fixed. # CVE-2026-43871 (HIGH, apache/thrift < 0.24.0 — DoS via infinite loop) and CVE-2026-79921 # (rabbitmq/amqp091-go < 1.13.0 — DoS). Both are vendored transitively by the MinIO source # build; thrift was already pinned here at the then-fixed 0.23.0 and aged into the exposure, # which is the recorded 'pinned remediation becomes the next exposure' shape. amqp091-go was # not pinned at all and is added so the scan has a version to hold. GOTOOLCHAIN=local go get \ github.com/apache/thrift@v0.24.0 \ github.com/rabbitmq/amqp091-go@v1.13.0 \ github.com/buger/jsonparser@v1.1.2 \ github.com/go-jose/go-jose/v4@v4.1.4 \ github.com/prometheus/prometheus@v0.311.3 \ go.opentelemetry.io/otel/sdk@v1.44.0 \ go.opentelemetry.io/otel/sdk/metric@v1.44.0 \ # CVE-2026-78669 (HIGH, golang.org/x/net, published after 2026-10-06): the x/net v0.58.0 pin # below aged into the finding; first fixed is v0.60.0. x/net v0.60.0 requires x/crypto v0.57.0 # and x/text v0.42.0, and `go get` refuses it beside the old pins (measured on the minio-client # recipe: "golang.org/x/net@v0.60.0 requires golang.org/x/crypto@v0.57.0, not # golang.org/x/crypto@v0.55.0"), so x/crypto v0.55.0 -> v0.57.0 and x/text v0.41.0 -> v0.42.0 # move with it. Both are later versions, so each keeps the fix its old pin was holding. golang.org/x/crypto@v0.57.0 \ golang.org/x/net@v0.60.0 \ golang.org/x/text@v0.42.0 \ # CVE-2026-84304 (HIGH, gRPC-Go): v1.82.1 was itself added as the FIX for an earlier # advisory and has now become the finding. First fixed is v1.83.1. The Alpine layer of # these images scans 0 -- the finding is inside the Go binary, so only a rebuild against # a fixed module clears it; there is nothing to apk upgrade. # grpc v1.83.1 in turn requires otel/sdk >= v1.44.0, so the two otel pins move with it -- # the same transitive shape the x/crypto -> x/text note above records. # CVE-2026-84445 (HIGH, gRPC-Go xDS server DoS, 2026-09-14): v1.83.1 -- the fix above -- aged # into the finding in turn; first fixed on this line is v1.83.2. v1.83.2 requires # golang.org/x/net >= v0.58.0 and `go get` refuses it beside the old x/net v0.57.0 pin # ("requires golang.org/x/net@v0.58.0, not golang.org/x/net@v0.57.0", measured on the # minio-client recipe, which carries the same pin), so x/net moves v0.57.0 -> v0.58.0 with # it. x/net v0.58.0 asked x/crypto v0.55.0 and x/text v0.41.0, the pins above at the time # (x/net v0.60.0 moved all three on 2026-10-19; see above). google.golang.org/grpc@v1.83.2 \ # CVE-2026-63209 (HIGH, github.com/klauspost/compress, fixed 1.18.7): on 2026-10-22 `go version -m` # on the built binary showed v1.18.5, and trivy 0.74.0 reported it. github.com/klauspost/compress@v1.18.7 \ && GOTOOLCHAIN=local go list -mod=mod -deps -tags kqueue . >/dev/null \ && GOTOOLCHAIN=local go mod verify \ && case "$TARGETARCH" in amd64|arm64) ;; *) echo "Unsupported target architecture: $TARGETARCH" >&2; exit 1 ;; esac \ && GOMAXPROCS=2 CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" GOTOOLCHAIN=local \ go build -p=2 -trimpath -mod=readonly -tags kqueue \ -ldflags '-s -w -buildid= -X github.com/minio/minio/cmd.Version=2025-10-15T17:29:55Z -X github.com/minio/minio/cmd.CopyrightYear=2025 -X github.com/minio/minio/cmd.ReleaseTag=RELEASE.2025-10-15T17-29-55Z -X github.com/minio/minio/cmd.CommitID=9e49d5e7a648f00e26f2246f4dc28e6b07f8c84a -X github.com/minio/minio/cmd.ShortCommitID=9e49d5e7a648 -X github.com/minio/minio/cmd.GOPATH=/go -X github.com/minio/minio/cmd.GOROOT=/usr/local/go' \ -o /out/minio . FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt COPY --from=builder /out/minio /usr/bin/minio COPY --from=builder /src/dockerscripts/docker-entrypoint.sh /usr/bin/docker-entrypoint.sh COPY --from=builder /src/CREDITS /licenses/CREDITS COPY --from=builder /src/LICENSE /licenses/LICENSE COPY --from=builder /src/go.mod /licenses/upstream-hardened-go.mod COPY --from=builder /src/go.sum /licenses/upstream-hardened-go.sum RUN addgroup -S -g 10002 minio \ && adduser -S -D -h /home/minio -u 10002 -G minio minio \ && mkdir -p /data /home/minio/.minio \ && chown -R 10002:10002 /data /home/minio \ && chmod 0755 /usr/bin/minio /usr/bin/docker-entrypoint.sh \ && /usr/bin/minio --version | grep -F 'RELEASE.2025-10-15T17-29-55Z' ENV MINIO_ACCESS_KEY_FILE=access_key ENV MINIO_SECRET_KEY_FILE=secret_key ENV MINIO_ROOT_USER_FILE=access_key ENV MINIO_ROOT_PASSWORD_FILE=secret_key ENV MINIO_KMS_SECRET_KEY_FILE=kms_master_key ENV MINIO_UPDATE_MINISIGN_PUBKEY=RWTx5Zr1tiHQLwG9keckT0c45M3AGeHD6IvimQHpyRywVWGbP1aVSGav ENV MINIO_CONFIG_ENV_FILE=config.env ENV HOME=/home/minio ENV MINIO_CONFIG_DIR=/home/minio/.minio EXPOSE 9000 9001 VOLUME ["/data"] USER 10002:10002 ENTRYPOINT ["/usr/bin/docker-entrypoint.sh"] CMD ["minio"] ARG RDX_SOURCE_SHA=development LABEL org.opencontainers.image.revision="$RDX_SOURCE_SHA" --- scripts/minio-client.Dockerfile --- # CVE-2026-39821 + CVE-2026-46600: HIGH Go stdlib findings fixed in Go 1.26.6 — the # previous golang:1.26.5 digest pin was itself the exposure, so the toolchain moves here. # CVE-2026-78667 (net/http DoS via crafted HTTP Range headers), CVE-2026-78669 (DoS via # excessive HTTP/2 SETTINGS frames, in net/http's bundled http2 and in golang.org/x/net/http2) # and CVE-2026-97031 (crypto/tls DoS via multiple ECH outer extension references): HIGH Go # stdlib findings published after 2026-10-06, all three fixed in 1.26.9 / 1.27.2, so 1.26.6 aged # into the exposure in turn. # 1.26.10 since 2026-10-20: the go1.26.9...go1.26.10 compare on golang/go is three commits, and # one of them, aa64342a9e ("crypto/x509: distrust a handful of intermediates"), says it fixes # CVE-2026-111943. OSV, vuln.go.dev, cve.org and NVD had no record of that CVE when read on # 2026-10-20. On 2026-10-20, 1.26.10-alpine3.24 and 1.26-alpine3.24 resolve to the # docker.io/library/golang index digest below, the official-images library/golang file lists that # tag at docker-library/golang commit 650cf2f3 (1.26/alpine3.24), and 1.26.11-alpine3.24 is not # found. FROM golang:1.26.10-alpine3.24@sha256:9ce231b28998b32e116927c61aa5c406183061d4f3f2d61b292c88e7f6bdf7ca AS builder ARG TARGETOS=linux ARG TARGETARCH WORKDIR /src RUN wget -q -O /tmp/mc.tar.gz \ https://codeload.github.com/minio/mc/tar.gz/7394ce0dd2a80935aded936b09fa12cbb3cb8096 \ && echo '95cd293c7119f16921a6dc515a1fb74a2227f19fd994b9c8b770a154e802ac44 /tmp/mc.tar.gz' | sha256sum -c - \ && tar -xzf /tmp/mc.tar.gz --strip-components=1 \ && rm -f /tmp/mc.tar.gz RUN --mount=type=cache,target=/go/pkg/mod \ --mount=type=cache,target=/root/.cache/go-build \ # CVE-2026-56854 (CRITICAL, published 2026-08-31): x/crypto v0.53.0 — previously the FIXED # version — became the finding; first fixed is v0.55.0, which requires x/text >= v0.41.0 # (still carrying the v0.39.0 fix). Same-day fleet event: caddy and minio-client move in # this commit too. # x/net moves v0.56.0 -> v0.57.0 on the same resolver requirement; a later version keeps # whatever v0.56.0 fixed. GOTOOLCHAIN=local go get \ github.com/prometheus/prometheus@v0.311.3 \ # CVE-2026-78669 (HIGH, golang.org/x/net, published after 2026-10-06): the x/net v0.58.0 pin # below aged into the finding; first fixed is v0.60.0. x/net v0.60.0 requires x/crypto v0.57.0 # and x/text v0.42.0, and `go get` refuses it beside the old pins (measured on this # recipe: "golang.org/x/net@v0.60.0 requires golang.org/x/crypto@v0.57.0, not # golang.org/x/crypto@v0.55.0"), so x/crypto v0.55.0 -> v0.57.0 and x/text v0.41.0 -> v0.42.0 # move with it. Both are later versions, so each keeps the fix its old pin was holding. golang.org/x/crypto@v0.57.0 \ golang.org/x/net@v0.60.0 \ golang.org/x/text@v0.42.0 \ # CVE-2026-84304 (HIGH, gRPC-Go): v1.82.1 was itself added as the FIX for an earlier # advisory and has now become the finding. First fixed is v1.83.1. The Alpine layer of # these images scans 0 -- the finding is inside the Go binary, so only a rebuild against # a fixed module clears it; there is nothing to apk upgrade. # CVE-2026-84445 (HIGH, gRPC-Go xDS server DoS, 2026-09-14): v1.83.1 -- the fix above -- aged # into the finding in turn; first fixed on this line is v1.83.2, which requires # golang.org/x/net >= v0.58.0. `go get` refuses v1.83.2 beside the old x/net v0.57.0 pin # (measured: "requires golang.org/x/net@v0.58.0, not golang.org/x/net@v0.57.0"), so x/net # moves with it. x/net v0.58.0 asked x/crypto v0.55.0 and x/text v0.41.0, the pins at the # time (x/net v0.60.0 moved all three on 2026-10-19; see above). google.golang.org/grpc@v1.83.2 \ # CVE-2026-63209 (HIGH, github.com/klauspost/compress, fixed 1.18.7): on 2026-10-22 `go version -m` # on the built binary showed v1.18.5, and trivy 0.74.0 reported it. github.com/klauspost/compress@v1.18.7 \ && GOTOOLCHAIN=local go list -mod=mod -deps -tags kqueue . >/dev/null \ && GOTOOLCHAIN=local go mod verify \ && case "$TARGETARCH" in amd64|arm64) ;; *) echo "Unsupported target architecture: $TARGETARCH" >&2; exit 1 ;; esac \ && GOMAXPROCS=2 CGO_ENABLED=0 GOOS="$TARGETOS" GOARCH="$TARGETARCH" GOTOOLCHAIN=local \ go build -p=2 -trimpath -mod=readonly -tags kqueue \ -ldflags '-s -w -buildid= -X github.com/minio/mc/cmd.Version=2025-08-13T08:35:41Z -X github.com/minio/mc/cmd.CopyrightYear=2025 -X github.com/minio/mc/cmd.ReleaseTag=RELEASE.2025-08-13T08-35-41Z -X github.com/minio/mc/cmd.CommitID=7394ce0dd2a80935aded936b09fa12cbb3cb8096 -X github.com/minio/mc/cmd.ShortCommitID=7394ce0dd2a8' \ -o /out/mc . FROM alpine:3.24@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 COPY --from=builder /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt COPY --from=builder /out/mc /usr/bin/mc COPY --from=builder /src/CREDITS /licenses/CREDITS COPY --from=builder /src/LICENSE /licenses/LICENSE COPY --from=builder /src/go.mod /licenses/upstream-hardened-go.mod COPY --from=builder /src/go.sum /licenses/upstream-hardened-go.sum RUN addgroup -S -g 10003 minioclient \ && adduser -S -D -h /home/minioclient -u 10003 -G minioclient minioclient \ && mkdir -p /home/minioclient \ && chown -R 10003:10003 /home/minioclient \ && chmod 0755 /usr/bin/mc \ && /usr/bin/mc --version | grep -F 'RELEASE.2025-08-13T08-35-41Z' ENV MC_CONFIG_DIR=/tmp/.mc ENV HOME=/home/minioclient USER 10003:10003 ENTRYPOINT ["/usr/bin/mc"] ARG RDX_SOURCE_SHA=development LABEL org.opencontainers.image.revision="$RDX_SOURCE_SHA"