k3d/5.6.0-r9: cve remediation

[octo-sts]

k3d/5.6.0-r9: fix GHSA-6q6q-88xp-6f2r/GHSA-ppp9-7jff-5vj2/GHSA-8c26-wmh5-6g9v/GHSA-j2rp-gmqv-frhv/GHSA-m425-mq94-257g/GHSA-c3h9-896r-86jm/GHSA-7f33-f4f5-xwgw/GHSA-vvpx-j8f3-3w6h/GHSA-m69r-9g56-7mv8/

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/k3d.advisories.yaml

[debasishbsws]

These CVE's are not present in the ain k3d package it is in the k3d-proxy and it come from https://github.com/iwilltry42/confd which is not getting maintained I think. the last commit was 2 years ago.
I am looking if there is any way to update go modules.

[github-actions]

Package k3d: Click to expand/collapse

Package k3d:
Modified: /usr/bin/k3d

Package k3d-tools: Click to expand/collapse

Package k3d-tools:
Modified: /usr/bin/k3d-tools

Package k3d-proxy: Click to expand/collapse

Package k3d-proxy:
Modified: /usr/bin/confd

bincapz found differences: Click to expand/collapse

Changed: k3d-proxy/usr/bin/confd

Previous Risk: 🚨 4/CRITICAL
New Risk: ✅ 2/MEDIUM

RISK	KEY	DESCRIPTION
-4/CRITICAL	ref/site/tor_onion	contains hardcoded TOR onion address: "rtexistscgetvsgetenvnetdnsdomaingophertelnetreturnlisten.onion"
+2/MEDIUM	ref/path/root	references paths within /root: "/root/sign-self-issued
		/root/sys/sealincrement%w"
+2/MEDIUM	ref/program/sudo	calls sudo: "sudo"
+2/MEDIUM	ref/words/intercept	references interception: "interceptor"
-1/LOW	compression/bzip2	works with bzip2 files

[debasishbsws]

K3d was using a fork of kelseyhightower/confd with almost no code update, they just updated go version with go.mod file that is not present in the original repo's last release.

As there are a lot of CVE in the forked confd k3d is using compared to the original confd that has been updated with new dependencies it is better to use that one. ISSUE is that the latest release was in 2018 May. And the changes are recent. I avoid git-checkout to the last tag and instead use simple git commands in the runs statement.

It fixes all the CVE's but not sure if there Is any better way.