[High] Patch moby-engine for CVE-2026-84445 and CVE-2026-84304 by upgrading grpc vendor module

[Akhila Guruju (akhila-guruju)]

Summary

Patch moby-engine for CVE-2026-84445 and CVE-2026-84304 by upgrading the google.golang.org/grpc vendored module.

1. Vendored dependencies upgraded via a new vendor tarball

• Added generate_source_tarball.sh, which unpacks the upstream source, forces google.golang.org/grpc@v1.82.2 and google.golang.org/api@v0.155.0, runs go mod tidy, and vendors the tree.
• moby 25.0.3 has no go.mod — it keeps its module definition in vendor.mod/vendor.sum. The script therefore drives every go mod subcommand through hack/with-go-mod.sh, which materialises a throwaway go.mod so the tooling can locate the module root, and passes -modfile=vendor.mod so the real manifest is the one updated.
• New Source1: moby-engine-25.0.3-vendor.tar.gz; hash recorded in moby-engine.signatures.json.

2. %prep reworked

• %autosetup -p1 split into %autosetup -N + rm -rf vendor + extract vendor tarball + %autopatch -p1, so the remaining CVE patches apply on top of the regenerated vendor tree rather than the stale in-tree one. Source1/Source2 shifted to Source2/Source3 with %install updated to match.

3. New patch

• CVE-2026-84445.patch bumps vendor.mod/vendor.sum to match the regenerated vendor tree.

4. BuildRequires: golang → golang >= 1.25

• The refreshed modules declare go 1.25.0 (up from go 1.20).

5. 5 CVE patches dropped, each verified as already fixed in the upgraded vendored code:

golang.org/x/net | v0.17.0 → v0.53.0 | CVE-2023-45288
google.golang.org/protobuf | v1.31.0 → v1.36.11 | CVE-2024-24786
golang.org/x/crypto | v0.17.0 → v0.50.0 | CVE-2024-45337, CVE-2025-22869
golang.org/x/oauth2 | v0.10.0 → v0.36.0 | CVE-2025-22868

Change Log

• deleted: CVE-2023-45288.patch
• deleted: CVE-2024-24786.patch
• deleted: CVE-2024-45337.patch
• deleted: CVE-2025-22868.patch
• deleted: CVE-2025-22869.patch
• modified: CVE-2026-39821.patch
• modified: CVE-2026-56852.patch
• new file: CVE-2026-84445.patch
• new file: generate_source_tarball.sh
• modified: moby-engine.signatures.json
• modified: moby-engine.spec

Does this affect the toolchain?

NO

Links to CVEs

• https://nvd.nist.gov/vuln/detail/CVE-2026-84445 and CVE-2026-84304
• https://nvd.nist.gov/vuln/detail/CVE-2026-84304

Test Methodology

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.