From 99c622331a115c017d0050ba541884504e1cd4f6 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Wenkai=20Yin=28=E5=B0=B9=E6=96=87=E5=BC=80=29?=
 <yinw@vmware.com>
Date: Wed, 1 Mar 2023 09:27:11 +0800
Subject: [PATCH 1/4] Switch the base image to distroless/base-nossl-debian11
 to reduce the CVE triage efforts
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Switch the base image to distroless/base-nossl-debian11 to reduce the CVE triage efforts

Fixes #5902

Signed-off-by: Wenkai Yin(尹文开) <yinw@vmware.com>
---
 Dockerfile                           | 2 +-
 changelogs/unreleased/5939-ywk253100 | 1 +
 2 files changed, 2 insertions(+), 1 deletion(-)
 create mode 100644 changelogs/unreleased/5939-ywk253100

diff --git a/Dockerfile b/Dockerfile
index 3e80dfc5f..e39e4cfa3 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -66,7 +66,7 @@ RUN mkdir -p /output/usr/bin && \
     /go/src/github.com/vmware-tanzu/velero/hack/build-restic.sh
 
 # Velero image packing section
-FROM gcr.io/distroless/base-debian11@sha256:99133cb0878bb1f84d1753957c6fd4b84f006f2798535de22ebf7ba170bbf434
+FROM gcr.io/distroless/base-nossl-debian11:nonroot
 
 LABEL maintainer="Nolan Brubaker <brubakern@vmware.com>"
 
diff --git a/changelogs/unreleased/5939-ywk253100 b/changelogs/unreleased/5939-ywk253100
new file mode 100644
index 000000000..28f47f191
--- /dev/null
+++ b/changelogs/unreleased/5939-ywk253100
@@ -0,0 +1 @@
+Switch the base image to distroless/base-nossl-debian11 to reduce the CVE triage efforts
\ No newline at end of file

From 3c671a7c09b7caa4bd729d557aa6cb63ef397805 Mon Sep 17 00:00:00 2001
From: DingRui Yang <abserari@gmail.com>
Date: Thu, 2 Mar 2023 21:11:45 +0800
Subject: [PATCH 2/4] Fix miss ${GOARM}" parameter in build-restic.sh

Signed-off-by: DingRui Yang <abserari@gmail.com>
---
 hack/build-restic.sh | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/hack/build-restic.sh b/hack/build-restic.sh
index 5859414fd..3e7f4287f 100755
--- a/hack/build-restic.sh
+++ b/hack/build-restic.sh
@@ -50,6 +50,10 @@ fi
 mkdir ${build_path}/restic
 git clone -b v${RESTIC_VERSION} https://github.com/restic/restic.git ${build_path}/restic
 pushd ${build_path}/restic
-go run build.go --goos "${GOOS}" --goarch "${GOARCH}" --goarm "${GOARM}" -o ${restic_bin}
+if [ -z "${GOARM}" ]; then
+    go run build.go --goos "${GOOS}" --goarch "${GOARCH}" -o ${restic_bin}
+else
+    go run build.go --goos "${GOOS}" --goarch "${GOARCH}" --goarm "${GOARM}" -o ${restic_bin}
+fi
 chmod +x ${restic_bin}
 popd

From c6c6908b1ab770ede9853732ef2751ccab7fb686 Mon Sep 17 00:00:00 2001
From: DingRui Yang <abserari@gmail.com>
Date: Fri, 3 Mar 2023 17:42:58 +0800
Subject: [PATCH 3/4] Update build-restic.sh

Signed-off-by: DingRui Yang <abserari@gmail.com>
---
 hack/build-restic.sh | 6 +-----
 1 file changed, 1 insertion(+), 5 deletions(-)

diff --git a/hack/build-restic.sh b/hack/build-restic.sh
index 3e7f4287f..5859414fd 100755
--- a/hack/build-restic.sh
+++ b/hack/build-restic.sh
@@ -50,10 +50,6 @@ fi
 mkdir ${build_path}/restic
 git clone -b v${RESTIC_VERSION} https://github.com/restic/restic.git ${build_path}/restic
 pushd ${build_path}/restic
-if [ -z "${GOARM}" ]; then
-    go run build.go --goos "${GOOS}" --goarch "${GOARCH}" -o ${restic_bin}
-else
-    go run build.go --goos "${GOOS}" --goarch "${GOARCH}" --goarm "${GOARM}" -o ${restic_bin}
-fi
+go run build.go --goos "${GOOS}" --goarch "${GOARCH}" --goarm "${GOARM}" -o ${restic_bin}
 chmod +x ${restic_bin}
 popd

From 9d42c1a408c1e1a3accf8757a7d7704fff3b26de Mon Sep 17 00:00:00 2001
From: DingRui Yang <abserari@gmail.com>
Date: Fri, 3 Mar 2023 17:43:46 +0800
Subject: [PATCH 4/4] Update Tiltfile

Signed-off-by: DingRui Yang <abserari@gmail.com>
---
 Tiltfile | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/Tiltfile b/Tiltfile
index 3ce9aedf7..848f25afc 100644
--- a/Tiltfile
+++ b/Tiltfile
@@ -103,7 +103,7 @@ local_resource(
 
 local_resource(
     "restic_binary",
-    cmd = 'cd ' + '.' + ';mkdir -p _tiltbuild/restic; BIN=velero GOOS=linux GOARCH=amd64 RESTIC_VERSION=0.13.1 OUTPUT_DIR=_tiltbuild/restic ./hack/download-restic.sh',
+    cmd = 'cd ' + '.' + ';mkdir -p _tiltbuild/restic; BIN=velero GOOS=linux GOARCH=amd64 GOARM="" RESTIC_VERSION=0.13.1 OUTPUT_DIR=_tiltbuild/restic ./hack/download-restic.sh',
 )
 
 # Note: we need a distro with a bash shell to exec into the Velero container