Update fleetdm/fleetctl, fleetdm/wix and fleetdm/bomutils docker images

[lucasmrod]

#20571

Summary of changes

We have a few moving parts in fleetctl land (fleetdm/wix is used to build msis and fleetdm/bomutils is used to build pkgs, and fleetdm/fleetctl can be used to build packages using docker, no need for fleetctl executable):

graph LR

fleetctl_exec[fleetctl<br>executable];
wix_image[fleetdm/wix<br>docker image];
bomutils_image[fleetdm/bomutils<br>docker image];
fleetctl_image[fleetdm/fleetctl<br>docker image];

fleetctl_exec -- uses --> wix_image;

fleetctl_image -- COPY dependencies<br>FROM --> wix_image;

fleetctl_exec -- uses --> bomutils_image;

fleetctl_image -- COPY dependencies<br>FROM --> bomutils_image;

Loading

So, we'll need to update the three images: fleetdm/bomutils, fleetdm/wix & fleetdm/fleetctl.

• tools/bomutils-docker/Dockerfile, tools/wix-docker/Dockerfile and tools/fleetctl-docker/Dockerfile: Updating the base image to fix the CRITICAL vulnerabilities.
• Modified existing+unused .github/workflows/build-and-check-fleetctl-docker-and-deps.yml to run every day to check for CRITICAL vulnerabilities in fleetdm/wix, fleetdm/bomutils and fleetdm/fleetctl.
• .github/workflows/goreleaser-fleetctl-docker-deps.yaml: fleetdm/bomutils and fleetdm/wix were pushed manually a few years ago (most likely by Zach), so I've added a new action to release them when we have changes to release (like now). It will basically release fleetctl/bomutils and fleetdm/wix when pushing a tag of the form fleetctl-docker-deps-* (we'll need to protect such tag prefix).
• Changes in .github/workflows/test-native-tooling-packaging.yml to build fleetdm/bomutils and fleetdm/wix for fleetdm/fleetctl to use them instead of the ones in docker hub.

--

Build before upgrading debian:stable-slim:
https://github.com/fleetdm/fleet/actions/runs/10255391418/job/28372231837

Build after upgrading debian:stable-slim: https://github.com/fleetdm/fleet/actions/runs/10255550034

• Changes file added for user-visible changes in changes/, orbit/changes/ or ee/fleetd-chrome/changes.
  See Changes files for more information.
• Manual QA for all new/changed functionality

[lukeheath]

Thanks for this, great idea!

[lukeheath]

Thanks for the thorough PR description and adding the additional workflows. The fleetctl-docker-deps-* tag is now protected.