Proposing changes to patch this base worker image

[sclinnell]

What is the problem that this PR is trying to fix?

Vulnerabilities in the base worker image

What approach did you choose and why?

Using trivy to scan the current image for vulnerabilities on the OS level and go dependencies

How can you test this?

Start a travis worker using a freshly built image with these changes

What feedback would you like, if any?

End to end testing by Travis as well as a fix to the remaining vulns that I was not able to patch

Remaining Vulns

Total: 2 (UNKNOWN: 0, LOW: 2, MEDIUM: 0, HIGH: 0, CRITICAL: 0)

┌────────────┬───────────────┬──────────┬────────┬───────────────────┬───────────────┬───────────────────────────────────────────────────────────┐
│  Library   │ Vulnerability │ Severity │ Status │ Installed Version │ Fixed Version │                           Title                           │
├────────────┼───────────────┼──────────┼────────┼───────────────────┼───────────────┼───────────────────────────────────────────────────────────┤
│ libcrypto3 │ CVE-2024-2511 │ LOW      │ fixed  │ 3.1.4-r5          │ 3.1.4-r6      │ openssl: Unbounded memory growth with session handling in │
│            │               │          │        │                   │               │ TLSv1.3                                                   │
│            │               │          │        │                   │               │ https://avd.aquasec.com/nvd/cve-2024-2511                 │
├────────────┤               │          │        │                   │               │                                                           │
│ libssl3    │               │          │        │                   │               │                                                           │
│            │               │          │        │                   │               │                                                           │
│            │               │          │        │                   │               │                                                           │
└────────────┴───────────────┴──────────┴────────┴───────────────────┴───────────────┴───────────────────────────────────────────────────────────┘

usr/local/bin/travis-worker (gobinary)

Total: 2 (UNKNOWN: 0, LOW: 0, MEDIUM: 2, HIGH: 0, CRITICAL: 0)

┌──────────────────────────┬────────────────┬──────────┬────────┬────────────────────────┬─────────────────────────────┬────────────────────────────────────────────────────────────┐
│         Library          │ Vulnerability  │ Severity │ Status │   Installed Version    │        Fixed Version        │                           Title                            │
├──────────────────────────┼────────────────┼──────────┼────────┼────────────────────────┼─────────────────────────────┼────────────────────────────────────────────────────────────┤
│ github.com/docker/docker │ CVE-2024-24557 │ MEDIUM   │ fixed  │ v20.10.27+incompatible │ 25.0.2, 24.0.9              │ moby: classic builder cache poisoning                      │
│                          │                │          │        │                        │                             │ https://avd.aquasec.com/nvd/cve-2024-24557                 │
│                          ├────────────────┤          │        │                        ├─────────────────────────────┼────────────────────────────────────────────────────────────┤
│                          │ CVE-2024-29018 │          │        │                        │ 26.0.0-rc3, 25.0.5, 23.0.11 │ moby: external DNS requests from 'internal' networks could │
│                          │                │          │        │                        │                             │ lead to data exfiltration...                               │
│                          │                │          │        │                        │                             │ https://avd.aquasec.com/nvd/cve-2024-29018                 │
└──────────────────────────┴────────────────┴──────────┴────────┴────────────────────────┴─────────────────────────────┴────────────────────────────────────────────────────────────┘