remove docker package: CVE-2024-41110

cmd/locations.go

@@ -3,10 +3,10 @@ package cmd
 import (
 	"context"
 	"path/filepath"
+	"regexp"
 	"strings"
 	"time"
 
-	"github.com/docker/docker/builder/remotecontext/urlutil"
 	"github.com/pkg/errors"
 	"github.com/rs/zerolog/log"
 
@@ -35,7 +35,7 @@ var ErrCannotUseQueryWithFilePath = errors.New("relative and absolute file paths
 
 func maybeCloneGitUrl(ctx context.Context, repoManager cloner, repoRefreshDuration time.Duration, location, vcsUsername string) (string, error) {
 	result := strings.SplitN(location, "?", 2)
-	if !urlutil.IsGitURL(result[0]) {
+	if !isGitURL(result[0]) {
 		if len(result) > 1 {
 			return "", ErrCannotUseQueryWithFilePath
 		}
@@ -82,3 +82,26 @@ func maybeCloneGitUrl(ctx context.Context, repoManager cloner, repoRefreshDurati
 
 	return path, nil
 }
+
+func isGitURL(str string) bool {
+	if IsURL(str) && urlPathWithFragmentSuffix.MatchString(str) {
+		return true
+	}
+	for _, prefix := range []string{"git://", "github.com/", "git@"} {
+		if strings.HasPrefix(str, prefix) {
+			return true
+		}
+	}
+	return false
+}
+
+// urlPathWithFragmentSuffix matches fragments to use as Git reference and build
+// context from the Git repository. See IsGitURL for details.
+var urlPathWithFragmentSuffix = regexp.MustCompile(`\.git(?:#.+)?$`)
+
+// IsURL returns true if the provided str is an HTTP(S) URL by checking if it
+// has a http:// or https:// scheme. No validation is performed to verify if the
+// URL is well-formed.
+func IsURL(str string) bool {
+	return strings.HasPrefix(str, "https://") || strings.HasPrefix(str, "http://")
+}

go.mod

@@ -15,7 +15,6 @@ require (
 	github.com/cenkalti/backoff/v4 v4.3.0
 	github.com/chainguard-dev/git-urls v1.0.2
 	github.com/creasty/defaults v1.7.0
-	github.com/docker/docker v27.2.1+incompatible
 	github.com/ghodss/yaml v1.0.0
 	github.com/go-git/go-git-fixtures/v4 v4.3.2-0.20231010084843-55a94097c399
 	github.com/go-logr/zerologr v1.2.3
@@ -120,6 +119,7 @@ require (
 	github.com/dgryski/go-rendezvous v0.0.0-20200823014737-9f7001d12a5f // indirect
 	github.com/distribution/reference v0.5.0 // indirect
 	github.com/docker/distribution v2.8.3+incompatible // indirect
+	github.com/docker/docker v27.2.1+incompatible // indirect
 	github.com/docker/go-connections v0.4.0 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/emicklei/go-restful/v3 v3.10.2 // indirect