Bump kaniko and remediate a CVE with a patch.

I sent this upstream at GoogleContainerTools/kaniko#2916

Signed-off-by: Dan Lorenc <dlorenc@chainguard.dev>

kaniko.yaml

@@ -1,7 +1,7 @@
 package:
  name: kaniko
- version: 1.19.0
- epoch: 1
+ version: 1.19.1
+ epoch: 0
  description: Build Container Images In Kubernetes
  copyright:
  - license: Apache-2.0
@@ -18,7 +18,15 @@ pipeline:
  with:
  repository: https://github.com/GoogleContainerTools/kaniko
  tag: v${{package.version}}
- expected-commit: 1556a56004ef630fc3d9a8671e95f62c30678c5c
+ expected-commit: 8d40aa97d95929de6b074d351cadcc5630842063
+
+ - uses: patch
+ with:
+ patches: bump-docker.patch switch-pkg.patch
+
+ - uses: go/bump
+ with:
+ deps: github.com/docker/docker@v24.0.7
 
  - runs: |
  mkdir -p "${{targets.destdir}}"/usr/bin

kaniko/bump-docker.patch

@@ -0,0 +1,15 @@
+diff --git a/pkg/commands/stopsignal.go b/pkg/commands/stopsignal.go
+index f73a70f4..964b6b70 100644
+--- a/pkg/commands/stopsignal.go
++++ b/pkg/commands/stopsignal.go
+@@ -19,9 +19,9 @@ package commands
+ import (
+ "github.com/GoogleContainerTools/kaniko/pkg/dockerfile"
+ "github.com/GoogleContainerTools/kaniko/pkg/util"
+- "github.com/docker/docker/pkg/signal"
+ v1 "github.com/google/go-containerregistry/pkg/v1"
+ "github.com/moby/buildkit/frontend/dockerfile/instructions"
++ "github.com/moby/sys/signal"
+ "github.com/sirupsen/logrus"
+ )
+

kaniko/switch-pkg.patch

@@ -0,0 +1,25 @@
+diff --git a/pkg/util/fs_util.go b/pkg/util/fs_util.go
+index 992eeaa5..058558b7 100644
+--- a/pkg/util/fs_util.go
++++ b/pkg/util/fs_util.go
+@@ -33,10 +33,10 @@ import (
+ "github.com/GoogleContainerTools/kaniko/pkg/config"
+ "github.com/GoogleContainerTools/kaniko/pkg/timing"
+ "github.com/docker/docker/pkg/archive"
+- "github.com/docker/docker/pkg/fileutils"
+ v1 "github.com/google/go-containerregistry/pkg/v1"
+ "github.com/karrick/godirwalk"
+ "github.com/moby/buildkit/frontend/dockerfile/dockerignore"
++ "github.com/moby/patternmatcher"
+ otiai10Cpy "github.com/otiai10/copy"
+ "github.com/pkg/errors"
+ "github.com/sirupsen/logrus"
+@@ -788,7 +788,7 @@ func (c FileContext) ExcludesFile(path string) bool {
+ return false
+ }
+ }
+- match, err := fileutils.Matches(path, c.ExcludedFiles)
++ match, err := patternmatcher.Matches(path, c.ExcludedFiles)
+ if err != nil {
+ logrus.Errorf("Error matching, including %s in build: %v", path, err)
+ return false