solr/9.8.0-r0: cve remediation

[octo-sts]

solr/9.8.0-r0: fix GHSA-4g8c-wm8x-jfhw

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/solr.advisories.yaml

Source code for this service: https://go/cve-remedy-automation-source

Logs for this execution: https://go/cve-remedy-automation-logs

Docs for this service: (not provided yet)

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

Based on the error output, let me analyze and provide a solution:

• Detected Error: Implicit failure in git-checkout step with no tag found (The build stops after attempting git clone)

• Error Category: Version/Configuration

• Failure Point: git-checkout pipeline step failing to find the specified tag

• Root Cause Analysis: The tag format specified in the git-checkout step (releases/solr/9.8.0) doesn't match Apache Solr's actual release tag format. Apache Solr uses different tag naming conventions.

• Suggested Fix:
Modify the git-checkout step in the YAML to use the correct tag format:

  - uses: git-checkout
    with:
      repository: https://github.com/apache/solr
      expected-commit: 8bf0100e502ade4b8161e4b90f762b117a6ef442
      tag: rel/solr/${{package.version}}

Also update the update section accordingly:

update:
  enabled: true
  github:
    use-tag: true
    identifier: apache/solr
    strip-prefix: rel/solr/
    tag-filter: rel/solr/

• Explanation: Apache Solr uses the prefix rel/solr/ for their release tags rather than releases/solr/. This can be verified in their GitHub repository tags section. The fix changes the tag format to match the actual format used by the upstream repository.

• Additional Notes:

• The commit hash appears correct but the tag format is preventing checkout
• This is a common issue when upstream projects change their tag naming conventions
• The rest of the build configuration looks correct for Solr 9.8.0

• References:

• Apache Solr GitHub Tags: https://github.com/apache/solr/tags
• Solr 9.8.0 Release Tag: https://github.com/apache/solr/releases/tag/rel/solr/9.8.0

[jamie-albert]

wolfi-dev/advisories#13097