heketi-deps release tarball bundles x/net/html with CVE

[nixpanic]

Kind of issue

Bug

Observed behavior

Bug 1633022 has been reported against the Heketi package in Fedora. CVE-2018-17142 relates to the fix in golang/go#27702.

It seems Heketi itself does not call html.Parse() itself, nor is x/net/html listed in the glide.lock. However, it still gets included in the heketi-deps tarball. Probably some other package depends on it?

Expected/desired behavior

No known CVEs in the latest release tarballs.

[nixpanic]

@phlogistonjohn it is much appreciated if an updated heketi-deps tarball can get released!

[phlogistonjohn]

I'm not sure what the best approach for handling this will be. Let's discuss with @obnoxxx @raghavendra-talur .

[sidhax]

Does Heketi provide any html interface/api or use x/net/html ?

[phlogistonjohn]

Does Heketi provide any html interface/api or use x/net/html ?

No. It's bundled in because of golang's wonderful approach to dependencies. I hope to do a dependency refresh soon (famous last words). I hope that will allow us to close this issue.

[phlogistonjohn]

(Ahh. closed too many issues I had an itchy trigger finger)

[phlogistonjohn]

A full refresh of dependencies was done for heketi v10.4.0. Soon is a relative term. Closing.