kserve-modelmesh/0.12.0-r6: cve remediation

[octo-sts]

kserve-modelmesh/0.12.0-r6: fix GHSA-4g8c-wm8x-jfhw

Advisory data: https://github.com/wolfi-dev/advisories/blob/main/kserve-modelmesh.advisories.yaml

Source code for this service: https://go/cve-remedy-automation-source

Logs for this execution: https://go/cve-remedy-automation-logs

Docs for this service: (not provided yet)

[octo-sts]

⚠️ EXPERIMENTAL

Please use 👍 or 👎 on this comment to indicate if you agree or disagree with the recommendation.

To provide more detailed feedback please comment on the recommendation prefixed with /ai-verify:

e.g. /ai-verify partially helpful but I also added bash to the build environment

Gen AI suggestions to solve the build error:

• Detected Error: Multiple compilation errors related to missing Netty SSL packages, primarily:

package io.netty.handler.ssl does not exist

• Error Category: Dependency

• Failure Point: Maven compile phase during package build

• Root Cause Analysis: The project requires Netty's SSL handler dependencies which are not included in the project's dependencies. The errors show missing classes from io.netty.handler.ssl package.

• Suggested Fix: Add the required Netty SSL dependency to the project's pom.xml by examining the upstream project's pom.xml and adding the missing dependencies to the environment section:

environment:
  contents:
    packages:
      - build-base
      - busybox
      - maven-3.9
      - openjdk-17
      - netty-tcnative # Add this package

• Explanation: The compilation errors indicate missing Netty SSL classes that are required for the SSL/TLS functionality in the ModelMesh codebase. The netty-tcnative package provides the native SSL implementation that Netty uses.

• Additional Notes:

• The errors are consistent across multiple files (ModelMesh.java, ModelMeshApi.java, NettyServer.java)
• All errors relate to SSL/TLS functionality
• This is a common issue when building applications that use Netty's SSL features

• References:

• Upstream ModelMesh repo: https://github.com/kserve/modelmesh/
• Netty SSL Documentation: https://netty.io/wiki/requirements-for-4.x.html#tls-with-openssl
• Related KServe issue: https://github.com/kserve/modelmesh/issues/254