Set Alpine base image tag to 3.23.0

[mlim19]

Update Alpine base image tag to 3.23.0 to address security vulnerabilities.
Set it explicitly to avoid old version being used from cache

Description

Related Issue

Motivation and Context

How Has This Been Tested?

Screenshots

Checklist:

• I have read the CONTRIBUTING document.
• I have updated the relevant documentation.
• I have added tests for new logic.

[skamerintel]

PR #1010 Review: Incomplete Alpine 3.23.0 Security Update

CRITICAL ISSUE

The PR only updates container.Dockerfile to Alpine 3.23.0 but misses the executable build process, leaving security vulnerabilities unaddressed in the build environment.

KEY FINDING

The executable build process uses SHA-pinned variables instead of version tags:

• container.Dockerfile: FROM alpine:3.23.0 ✅ (Updated)
• executable.Dockerfile: FROM alpine${AP_BUILDER_ALPINE} ❌ (Still uses Alpine 3.14.2)

The ${AP_BUILDER_ALPINE} variable contains a SHA256 hash that resolves to Alpine 3.14.2, not 3.23.0.

HOW THE CORRECT SHA WAS DETERMINED

docker pull alpine:3.23.0
docker inspect alpine:3.23.0 | grep -A 1 RepoDigests

Returns: sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375

REQUIRED FIXES

Update these SHA variables to Alpine 3.23.0 (sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375):

1. scripts/build_x86_64_executable.sh line 47:
   OLD: AP_BUILDER_ALPINE=@sha256:69704ef328d05a9f806b6b8502915e6a0a4faa4d72018dc42343f511490daf8a
   NEW: AP_BUILDER_ALPINE=@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375

2. scripts/build_aarch64_executable.sh line 39:
   OLD: ALPINE_VERSION=@sha256:b06a5cf61b2956088722c4f1b9a6f71dfe95f0b1fe285d44195452b8a1627de7
   NEW: ALPINE_VERSION=@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375

IMPACT

Without these changes:

• Build environment remains vulnerable to Alpine 3.14.2 CVEs
• Inconsistent Alpine versions between build (3.14.2) and runtime (3.23.0)
• Security update is only partially effective

[mlim19]

PR #1010 Review: Incomplete Alpine 3.23.0 Security Update

CRITICAL ISSUE

The PR only updates container.Dockerfile to Alpine 3.23.0 but misses the executable build process, leaving security vulnerabilities unaddressed in the build environment.

KEY FINDING

The executable build process uses SHA-pinned variables instead of version tags:

• container.Dockerfile: FROM alpine:3.23.0 ✅ (Updated)
• executable.Dockerfile: FROM alpine${AP_BUILDER_ALPINE} ❌ (Still uses Alpine 3.14.2)

The ${AP_BUILDER_ALPINE} variable contains a SHA256 hash that resolves to Alpine 3.14.2, not 3.23.0.

HOW THE CORRECT SHA WAS DETERMINED

docker pull alpine:3.23.0 docker inspect alpine:3.23.0 | grep -A 1 RepoDigests

Returns: sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375

REQUIRED FIXES

Update these SHA variables to Alpine 3.23.0 (sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375):

1. scripts/build_x86_64_executable.sh line 47:
   OLD: AP_BUILDER_ALPINE=@sha256:69704ef328d05a9f806b6b8502915e6a0a4faa4d72018dc42343f511490daf8a
   NEW: AP_BUILDER_ALPINE=@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375
2. scripts/build_aarch64_executable.sh line 39:
   OLD: ALPINE_VERSION=@sha256:b06a5cf61b2956088722c4f1b9a6f71dfe95f0b1fe285d44195452b8a1627de7
   NEW: ALPINE_VERSION=@sha256:51183f2cfa6320055da30872f211093f9ff1d3cf06f39a0bdb212314c5dc7375

IMPACT

Without these changes:

• Build environment remains vulnerable to Alpine 3.14.2 CVEs
• Inconsistent Alpine versions between build (3.14.2) and runtime (3.23.0)
• Security update is only partially effective

I think this report is false positive because the alpine image used in executable.Dockerfile is only for internal build purpose which is not shipped when creating gprofiler docker image. So, The Alpine versions in executable.Dockerfile are irrelevant for runtime security scanning since they don't ship in the final image.

[skamerintel]

agree that alpine 3.14 is only part of build chain and doesnt affect runtime security, but it could impact build security (supply chain attacks) lower pri to fix - ok to merge.