Remove debian12 builds

.github/ISSUE_TEMPLATE/actionable-debian-cve.md

@@ -8,9 +8,10 @@ assignees: ''
 ---
 
 - [ ] I am using a [currently supported image](https://github.com/GoogleContainerTools/distroless#what-images-are-available)
+- [ ] I have verified the tag or pinned hash matches the latest build for the image
 - [ ] I have read the [SECURITY.md](https://github.com/GoogleContainerTools/distroless/blob/main/SECURITY.md)
 - [ ] I understand that this repo tracks debian package releases and cannot fix debian CVEs on its own
-- [ ] I have verified this CVE shows a fix is available in the appropriate debian version (bookworm, trixie) and channel (main, security) *and* it has been more than 48 hours.
+- [ ] I have verified this CVE shows a fix is available in the appropriate debian version (trixie) and channel (main, security) *and* it has been more than 48 hours.
 
 Please describe the image you encountered this with and a link to the debian security tracker
 https://security-tracker.debian.org/tracker/CVE-XXXX-YYYYY

README.md

@@ -48,14 +48,6 @@ Debian 13 distroless images use the debian [UsrMerge](https://wiki.debian.org/Us
 | gcr.io/distroless/nodejs26-debian13   | latest, nonroot, debug, debug-nonroot | amd64, arm64, s390x, ppc64le               |
 | gcr.io/distroless/python3-debian13    | latest, nonroot, debug, debug-nonroot | amd64, arm64, riscv64                      |
 
-#### Debian 12
-
-| Image                                 | Tags                                  | Architecture Suffixes             |
-| ------------------------------------- | ------------------------------------- | --------------------------------- |
-| gcr.io/distroless/static-debian12     | latest, nonroot, debug, debug-nonroot | amd64, arm64, arm, s390x, ppc64le |
-| gcr.io/distroless/base-debian12       | latest, nonroot, debug, debug-nonroot | amd64, arm64, arm, s390x, ppc64le |
-| gcr.io/distroless/base-nossl-debian12 | latest, nonroot, debug, debug-nonroot | amd64, arm64, arm, s390x, ppc64le |
-| gcr.io/distroless/cc-debian12         | latest, nonroot, debug, debug-nonroot | amd64, arm64, arm, s390x, ppc64le |
 
 ## Why is distroless still using `gcr.io` instead of `pkg.dev`?
 

SECURITY.md

@@ -2,7 +2,7 @@
 
 ## Supported Versions
 
-Distroless currently tracks debian 12 ([bookworm](https://packages.debian.org/bookworm/allpackages)) and debian 13 ([trixie](https://packages.debian.org/trixie/allpackages)) packages.
+Distroless currently tracks debian 13 ([trixie](https://packages.debian.org/trixie/allpackages)) packages.
 
 Debian package versions used for the current build are found in https://github.com/GoogleContainerTools/distroless/blob/main/private/repos/deb. It can be parsed and printed into simple json data by invoking `./knife deb-versions` at the root of this project.
 

SUPPORT_POLICY.md

@@ -4,15 +4,15 @@ The current estimation of end of life for images with the pattern:
 
 `gcr.io/distroless/<image>-debian<version>:(latest|nonroot|debug|debug-nonroot)`
 
-| Image       | Debian 12 EOL  | Debian 13 EOL               |
-| ----------- | -------------- | --------------------------- |
-| static      | Sept 2026      | debian 14 release day + 1yr |
-| base        | Sept 2026      | debian 14 release day + 1yr |
-| base-nossl  | Sept 2026      | debian 14 release day + 1yr |
-| cc          | Sept 2026      | debian 14 release day + 1yr |
-| java*       | Jan 2026       | debian 14 release day + 3mo |
-| node*       | Jan 2026       | debian 14 release day + 3mo |
-| python*     | April 2026     | debian 14 release day + 3mo |
+| Image       | Debian 13 EOL               |
+| ----------- | --------------------------- |
+| static      | debian 14 release day + 1yr |
+| base        | debian 14 release day + 1yr |
+| base-nossl  | debian 14 release day + 1yr |
+| cc          | debian 14 release day + 1yr |
+| java*       | debian 14 release day + 3mo |
+| node*       | debian 14 release day + 3mo |
+| python*     | debian 14 release day + 3mo |
 
 \* see below for language specific runtime notes
 

base/base.bzl

@@ -88,10 +88,6 @@ def base_image(distro, arch, packages):
         distro: name of the distribution
         arch: the target architecture
     """
-    LIBSSL = {
-        "debian12": "libssl3",
-        "debian13": "libssl3t64",
-    }
 
     [
         oci_image(

base/config.bzl

@@ -1,14 +1,9 @@
-BASE_DISTROS = ["debian12", "debian13"]
+BASE_DISTROS = ["debian13"]
 BASE_ARCHITECTURES = {
-    "debian12": ["amd64", "arm64", "arm", "s390x", "ppc64le"],
     "debian13": ["amd64", "arm64", "arm", "s390x", "ppc64le", "riscv64"],
 }
 
 BASE_PACKAGES = {
-    "debian12": [
-        "libc6",
-        "libssl3",
-    ],
     "debian13": [
         "libc6",
         "libssl3t64",
@@ -18,9 +13,6 @@ BASE_PACKAGES = {
 }
 
 BASE_NOSSL_PACKAGES = {
-    "debian12": [
-        "libc6",
-    ],
     "debian13": [
         "libc6",
     ],

cc/config.bzl

@@ -1,16 +1,9 @@
-CC_DISTROS = ["debian12", "debian13"]
+CC_DISTROS = ["debian13"]
 CC_ARCHITECTURES = {
-    "debian12": ["amd64", "arm64", "arm", "s390x", "ppc64le"],
     "debian13": ["amd64", "arm64", "arm", "s390x", "ppc64le", "riscv64"],
 }
 
 CC_PACKAGES = {
-    "debian12": [
-        "libgomp1",
-        "libstdc++6",
-        "libgcc-s1",
-        "gcc-12-base",
-    ],
     "debian13": [
         "libgomp1",
         "libstdc++6",

common/BUILD.bazel

@@ -9,13 +9,6 @@ package(default_visibility = ["//visibility:public"])
 COMMON_DISTROS = ALL_DISTROS
 
 COMMON_ARCHITECTURES = {
-    "debian12": [
-        "amd64",
-        "arm64",
-        "arm",
-        "s390x",
-        "ppc64le",
-    ],
     "debian13": [
         "amd64",
         "arm64",

distro.bzl

@@ -1,5 +1,4 @@
 VERSIONS = [
-    ("debian12", "bookworm", "12"),
     ("debian13", "trixie", "13"),
 ]
 
@@ -9,4 +8,4 @@ VARIANTS = {
 }
 
 ALL_ARCHITECTURES = ["amd64", "arm64", "arm", "s390x", "ppc64le", "riscv64"]
-ALL_DISTROS = ["debian12", "debian13"]
+ALL_DISTROS = ["debian13"]

examples/go/BUILD

@@ -9,7 +9,7 @@ package(default_visibility = ["//visibility:public"])
 go_image(
     name = "go_example",
     srcs = ["main.go"],
-    base = "//base:base_root_amd64_debian12",
+    base = "//base:base_root_amd64_debian13",
 )
 
 # Run

examples/go/Dockerfile

@@ -9,7 +9,7 @@ RUN go test -v
 
 RUN CGO_ENABLED=0 go build -o /go/bin/app
 
-FROM gcr.io/distroless/static-debian12
+FROM gcr.io/distroless/static-debian13
 
 COPY --from=build /go/bin/app /
 CMD ["/app"]

examples/nonroot/BUILD

@@ -37,7 +37,7 @@ home(
 # Include it in our image as a tar.
 oci_image(
     name = "passwd_image",
-    base = "//base:base_root_amd64_debian12",
+    base = "//base:base_root_amd64_debian13",
     tars = [
         ":passwd",
         ":home",

examples/rust/BUILD

@@ -12,7 +12,7 @@ package(default_visibility = ["//visibility:public"])
 rust_image(
     name = "rust_example",
     srcs = ["src/main.rs"],
-    base = "//cc:cc_root_amd64_debian12",
+    base = "//cc:cc_root_amd64_debian13",
     tags = [
         "amd64",
         "manual",

examples/rust/Dockerfile

@@ -3,6 +3,6 @@ WORKDIR /app
 COPY . /app
 RUN cargo build --release
 
-FROM gcr.io/distroless/cc-debian12
+FROM gcr.io/distroless/cc-debian13
 COPY --from=build-env /app/target/release/hello-world-distroless /
 CMD ["./hello-world-distroless"]

private/pkg/test/oci_image/BUILD.bazel

@@ -8,7 +8,7 @@ oci_image(
     architecture = "arm64",
     os = "linux",
     tars = [
-        deb.package("arm64", "debian12", "base-files"),
+        deb.package("arm64", "debian13", "base-files"),
     ],
 )
 
@@ -22,7 +22,7 @@ oci_image(
     architecture = "amd64",
     os = "linux",
     tars = [
-        deb.package("amd64", "debian12", "netbase"),
+        deb.package("amd64", "debian13", "netbase"),
     ],
 )
 

private/pkg/test/oci_image/image_amd64.spdx.json

@@ -1 +1 @@
-{"spdxVersion":"SPDX-2.3","dataLicense":"CC0-1.0","SPDXID":"SPDXRef-DOCUMENT","name":"//private/pkg/test/oci_image:image_amd64","documentNamespace":"http://spdx.org/spdxdocs/distroless/-slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","creationInfo":{"licenseListVersion":"NOASSERTION","creators":["Organization: distroless"],"created":"1970-01-01T00:00:00Z"},"packages":[{"name":"//private/pkg/test/oci_image:image_amd64","SPDXID":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION"},{"name":"netbase","SPDXID":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-netbase-underscore-6.4-underscore-amd64","versionInfo":"6.4","supplier":"Person: Marco d'Itri \\u003cmd@linux.it\\u003e","downloadLocation":"https://snapshot.debian.org/archive/debian/20260809T204446Z/pool/main/n/netbase/netbase_6.4_all.deb","checksums":[{"algorithm":"SHA256","checksumValue":"29b23c48c0fe6f878e56c5ddc9f65d1c05d729360f3690a593a8c795031cd867"}],"copyrightText":"Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/\nComment:\n This package was created by Peter Tobias tobias@et-inf.fho-emden.de on\n Wed, 24 Aug 1994 21:33:28 +0200 and maintained by Anthony Towns\n \u003cajt@debian.org\u003e until 2001.\n It is currently maintained by Marco d'Itri \u003cmd@linux.it\u003e.\n\nFiles: *\nCopyright:\n Copyright (c) 1994-1998 Peter Tobias\n Copyright (c) 1998-2001 Anthony Towns\n Copyright (c) 2002-2022 Marco d'Itri\nLicense: GPL-2\n This program is free software; you can redistribute it and/or modify\n it under the terms of the GNU General Public License, version 2, as\n published by the Free Software Foundation.\n .\n This program is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n GNU General Public License for more details.\n .\n You should have received a copy of the GNU General Public License along\n with this program; if not, write to the Free Software Foundation,\n Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.\n .\n On Debian systems, the complete text of the GNU General Public License\n version 2 can be found in '/usr/share/common-licenses/GPL-2'.\n","summary":"Basic TCP/IP networking system","description":"Basic TCP/IP networking system\nThis package provides the necessary infrastructure for basic TCP/IP based\nnetworking.\n.\nIn particular, it supplies common name-to-number mappings in /etc/services,\n/etc/rpc, /etc/protocols and /etc/ethertypes.","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:deb/debian/netbase@6.4?arch=all"}]},{"name":"@bookworm//netbase/amd64:spdx","SPDXID":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION","description":"Generated from netbase@6.4"}],"relationships":[{"spdxElementId":"SPDXRef-DOCUMENT","relatedSpdxElement":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","relationshipType":"DESCRIBES"},{"spdxElementId":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","relatedSpdxElement":"SPDXRef--at-rules-underscore-distroless~~apt~bookworm-underscore-netbase-underscore-6.4-underscore-amd64","relationshipType":"GENERATED_FROM"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","relatedSpdxElement":"SPDXRef--at-bookworm-slash--slash-netbase-slash-amd64-colon-spdx","relationshipType":"DEPENDS_ON"}]}
+{"spdxVersion":"SPDX-2.3","dataLicense":"CC0-1.0","SPDXID":"SPDXRef-DOCUMENT","name":"//private/pkg/test/oci_image:image_amd64","documentNamespace":"http://spdx.org/spdxdocs/distroless/-slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","creationInfo":{"licenseListVersion":"NOASSERTION","creators":["Organization: distroless"],"created":"1970-01-01T00:00:00Z"},"packages":[{"name":"//private/pkg/test/oci_image:image_amd64","SPDXID":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION"},{"name":"netbase","SPDXID":"SPDXRef--at-rules-underscore-distroless~~apt~trixie-underscore-netbase-underscore-6.5-underscore-amd64","versionInfo":"6.5","supplier":"Person: Marco d'Itri \\u003cmd@linux.it\\u003e","downloadLocation":"https://snapshot.debian.org/archive/debian/20260809T204446Z/pool/main/n/netbase/netbase_6.5_all.deb","checksums":[{"algorithm":"SHA256","checksumValue":"76bafa92947ebd37b0a6f9ec6570412041f56edebc1c66d323731216d318471e"}],"copyrightText":"Format: https://www.debian.org/doc/packaging-manuals/copyright-format/1.0/\nComment:\n This package was created by Peter Tobias tobias@et-inf.fho-emden.de on\n Wed, 24 Aug 1994 21:33:28 +0200 and maintained by Anthony Towns\n \u003cajt@debian.org\u003e until 2001.\n It is currently maintained by Marco d'Itri \u003cmd@linux.it\u003e.\n\nFiles: *\nCopyright:\n Copyright (c) 1994-1998 Peter Tobias\n Copyright (c) 1998-2001 Anthony Towns\n Copyright (c) 2002-2022 Marco d'Itri\nLicense: GPL-2\n This program is free software; you can redistribute it and/or modify\n it under the terms of the GNU General Public License, version 2, as\n published by the Free Software Foundation.\n .\n This program is distributed in the hope that it will be useful,\n but WITHOUT ANY WARRANTY; without even the implied warranty of\n MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the\n GNU General Public License for more details.\n .\n You should have received a copy of the GNU General Public License along\n with this program; if not, write to the Free Software Foundation,\n Inc., 51 Franklin Street, Fifth Floor, Boston, MA 02110-1301, USA.\n .\n On Debian systems, the complete text of the GNU General Public License\n version 2 can be found in '/usr/share/common-licenses/GPL-2'.\n","summary":"Basic TCP/IP networking system","description":"Basic TCP/IP networking system\nThis package provides the necessary infrastructure for basic TCP/IP based\nnetworking.\n.\nIn particular, it supplies common name-to-number mappings in /etc/services,\n/etc/rpc, /etc/protocols and /etc/ethertypes.","externalRefs":[{"referenceCategory":"PACKAGE-MANAGER","referenceType":"purl","referenceLocator":"pkg:deb/debian/netbase@6.5?arch=all"}]},{"name":"@trixie//netbase/amd64:spdx","SPDXID":"SPDXRef--at-trixie-slash--slash-netbase-slash-amd64-colon-spdx","downloadLocation":"NOASSERTION","copyrightText":"NOASSERTION","description":"Generated from netbase@6.5"}],"relationships":[{"spdxElementId":"SPDXRef-DOCUMENT","relatedSpdxElement":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","relationshipType":"DESCRIBES"},{"spdxElementId":"SPDXRef--at-trixie-slash--slash-netbase-slash-amd64-colon-spdx","relatedSpdxElement":"SPDXRef--at-rules-underscore-distroless~~apt~trixie-underscore-netbase-underscore-6.5-underscore-amd64","relationshipType":"GENERATED_FROM"},{"spdxElementId":"SPDXRef--slash--slash-private-slash-pkg-slash-test-slash-oci-underscore-image-colon-image-underscore-amd64","relatedSpdxElement":"SPDXRef--at-trixie-slash--slash-netbase-slash-amd64-colon-spdx","relationshipType":"DEPENDS_ON"}]}