OCPBUGS-16482: Update dependencies to remove goproxy dependency #701

rwsu · 2023-08-16T21:55:58Z

A Denial of service (DoS) via unspecified vectors issue was found in goproxy (CVE-2023-37788). This module is pulled in by k8s.io/apimachinery which in turn is pulled in by machine-config-operator.

goproxy is no longer used by k8s.io/apimachinery starting with v0.27.0. We can remove this potential issue by moving to newer versions.

Updated dependencies to newer versions to remove the goproxy dep.

go get -u github.com/openshift/api@release-4.13
go get -u github.com/openshift/machine-config-operator@release-4.13
go get -u k8s.io/client-go@v0.28.0
Remove replace for api in go.mod
go get -u sigs.k8s.io/controller-runtime@v0.15.1
go get -u github.com/openshift/machine-api-operator@release-4.13
replace imports of "github.com/openshift/machine-api-operator/pkg/apis/machine/v1beta1" with "github.com/openshift/api/machine/v1beta1" as it moved to the openshift/api repo.
update replace baremetal-operator/apis and baremetal-operator/pkg/hardwareutils to v0.0.0-20230531194024-8dde0991ffdd in go.mod to match the other version changes

openshift-ci-robot · 2023-08-16T21:56:04Z

@rwsu: This pull request references Jira Issue OCPBUGS-16482, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state ASSIGNED, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @mhanss

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

A Denial of service (DoS) via unspecified vectors issue was found in goproxy. This module is pulled in by k8s.io/apimachinery which in turn is pulled in by machine-config-operator.

goproxy is no longer used by k8s.io/apimachinery starting with v0.27.0. We can remove this potential issue by moving to newer versions.

Updated dependencies to newer versions to remove the goproxy dep.

go get -u github.com/openshift/api@release-4.13

go get -u github.com/openshift/machine-config-operator@release-4.13

go get -u k8s.io/client-go@v0.28.0

Remove replace for api in go.mod

go get -u sigs.k8s.io/controller-runtime@v0.15.1

go get -u github.com/openshift/machine-api-operator@release-4.13

replace imports of "github.com/openshift/machine-api-operator/pkg/apis/machine/v1beta1" with "github.com/openshift/api/machine/v1beta1" as it moved to the openshift/api repo.

update replace baremetal-operator/apis and baremetal-operator/pkg/hardwareutils to v0.0.0-20230531194024-8dde0991ffdd in go.mod to match the other version changes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

codecov · 2023-08-16T22:08:56Z

Codecov Report

Merging #701 (97b8ac8) into master (10f4681) will increase coverage by 0.10%.
Report is 1 commits behind head on master.
The diff coverage is n/a.

Additional details and impacted files

@@            Coverage Diff             @@
##           master     #701      +/-   ##
==========================================
+ Coverage   55.59%   55.70%   +0.10%     
==========================================
  Files          14       14              
  Lines        3119     3129      +10     
==========================================
+ Hits         1734     1743       +9     
- Misses       1224     1226       +2     
+ Partials      161      160       -1

Files	Coverage Δ
...taller_controller/assisted_installer_controller.go	`76.37% <ø> (ø)`

... and 2 files with indirect coverage changes

openshift-ci-robot · 2023-08-16T22:12:56Z

@rwsu: This pull request references Jira Issue OCPBUGS-16482, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @mhanss

In response to this:

A Denial of service (DoS) via unspecified vectors issue was found in goproxy (CVE-2023-37788). This module is pulled in by k8s.io/apimachinery which in turn is pulled in by machine-config-operator.

goproxy is no longer used by k8s.io/apimachinery starting with v0.27.0. We can remove this potential issue by moving to newer versions.

Updated dependencies to newer versions to remove the goproxy dep.

go get -u github.com/openshift/api@release-4.13

go get -u github.com/openshift/machine-config-operator@release-4.13

go get -u k8s.io/client-go@v0.28.0

Remove replace for api in go.mod

go get -u sigs.k8s.io/controller-runtime@v0.15.1

go get -u github.com/openshift/machine-api-operator@release-4.13

replace imports of "github.com/openshift/machine-api-operator/pkg/apis/machine/v1beta1" with "github.com/openshift/api/machine/v1beta1" as it moved to the openshift/api repo.

update replace baremetal-operator/apis and baremetal-operator/pkg/hardwareutils to v0.0.0-20230531194024-8dde0991ffdd in go.mod to match the other version changes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

eranco74 · 2023-08-17T07:14:27Z

lgtm, just need to pass lint...

Cannot update golangci-lint in the same PR as one exhibiting issues because the CI still uses the previous version. Updating k8s.io/apimachinery module to a newer version causes the old linter to throw nil pointer error. Example openshift#701

Cannot update golangci-lint in the same PR as one exhibiting issues because the CI still uses the previous version. Updating k8s.io/apimachinery module to a newer version causes the old linter to throw nil pointer error. Example #701

rwsu · 2023-08-21T15:01:40Z

/retest-required

openshift-ci · 2023-09-28T06:23:18Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: osherdp, rwsu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [osherdp]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

rwsu · 2023-10-02T19:48:15Z

@osherdp Can the downstream-change-needed label be removed?

osherdp · 2023-10-02T21:04:08Z

@osherdp Can the downstream-change-needed label be removed?

In this case, yes
/remove-label downstream-change-needed

openshift-ci-robot · 2023-10-02T21:04:35Z

@rwsu: This pull request references Jira Issue OCPBUGS-16482, which is invalid:

expected the bug to target the "4.15.0" version, but it targets "4.14.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

In response to this:

A Denial of service (DoS) via unspecified vectors issue was found in goproxy (CVE-2023-37788). This module is pulled in by k8s.io/apimachinery which in turn is pulled in by machine-config-operator.

goproxy is no longer used by k8s.io/apimachinery starting with v0.27.0. We can remove this potential issue by moving to newer versions.

Updated dependencies to newer versions to remove the goproxy dep.

go get -u github.com/openshift/api@release-4.13

go get -u github.com/openshift/machine-config-operator@release-4.13

go get -u k8s.io/client-go@v0.28.0

Remove replace for api in go.mod

go get -u sigs.k8s.io/controller-runtime@v0.15.1

go get -u github.com/openshift/machine-api-operator@release-4.13

replace imports of "github.com/openshift/machine-api-operator/pkg/apis/machine/v1beta1" with "github.com/openshift/api/machine/v1beta1" as it moved to the openshift/api repo.

update replace baremetal-operator/apis and baremetal-operator/pkg/hardwareutils to v0.0.0-20230531194024-8dde0991ffdd in go.mod to match the other version changes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

A Denial of service (DoS) via unspecified vectors issue was found in goproxy. This module is pulled in by k8s.io/apimachinery which in turn is pulled in by machine-config-operator. goproxy is no longer used by k8s.io/apimachinery starting with v0.27.0. We can remove this potential issue by moving to newer versions. Updated dependencies to newer versions to remove the goproxy dep. * go get -u github.com/openshift/api@release-4.13 * go get -u github.com/openshift/machine-config-operator@release-4.13 * go get -u k8s.io/client-go@v0.28.0 * Remove replace for api in go.mod * go get -u sigs.k8s.io/controller-runtime@v0.15.1 * go get -u github.com/openshift/machine-api-operator@release-4.13 * replace imports of "github.com/openshift/machine-api-operator/pkg/apis/machine/v1beta1" with "github.com/openshift/api/machine/v1beta1" as it moved to the openshift/api repo. * update replace baremetal-operator/apis and baremetal-operator/pkg/hardwareutils to v0.0.0-20230531194024-8dde0991ffdd in go.mod to match the other version changes

rwsu · 2023-10-16T16:06:02Z

/jira refresh

openshift-ci-robot · 2023-10-16T16:06:08Z

@rwsu: This pull request references Jira Issue OCPBUGS-16482, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.15.0) matches configured target version for branch (4.15.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @mhanss

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

omertuc · 2023-10-18T22:18:58Z

/lgtm

openshift-ci-robot · 2023-10-18T23:32:10Z

/retest-required

Remaining retests: 0 against base HEAD dc35bcb and 2 for PR HEAD 97b8ac8 in total

omertuc · 2023-10-19T09:31:08Z

Known issue with edge-e2e-metal-assisted, let's wait for it to be fixed

gamli75 · 2023-10-19T11:46:28Z

/test edge-e2e-metal-assisted

openshift-ci · 2023-10-19T13:17:54Z

@rwsu: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-10-19T13:29:58Z

@rwsu: Jira Issue OCPBUGS-16482: All pull requests linked via external trackers have merged:

Jira Issue OCPBUGS-16482 has been moved to the MODIFIED state.

In response to this:

A Denial of service (DoS) via unspecified vectors issue was found in goproxy (CVE-2023-37788). This module is pulled in by k8s.io/apimachinery which in turn is pulled in by machine-config-operator.

goproxy is no longer used by k8s.io/apimachinery starting with v0.27.0. We can remove this potential issue by moving to newer versions.

Updated dependencies to newer versions to remove the goproxy dep.

go get -u github.com/openshift/api@release-4.13

go get -u github.com/openshift/machine-config-operator@release-4.13

go get -u k8s.io/client-go@v0.28.0

Remove replace for api in go.mod

go get -u sigs.k8s.io/controller-runtime@v0.15.1

go get -u github.com/openshift/machine-api-operator@release-4.13

replace imports of "github.com/openshift/machine-api-operator/pkg/apis/machine/v1beta1" with "github.com/openshift/api/machine/v1beta1" as it moved to the openshift/api repo.

update replace baremetal-operator/apis and baremetal-operator/pkg/hardwareutils to v0.0.0-20230531194024-8dde0991ffdd in go.mod to match the other version changes

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-merge-robot · 2023-10-25T05:33:16Z

Fix included in accepted release 4.15.0-0.nightly-2023-10-24-230302

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Aug 16, 2023

openshift-ci bot requested a review from mhanss August 16, 2023 21:56

openshift-ci bot added the size/XXL Denotes a PR that changes 1000+ lines, ignoring generated files. label Aug 16, 2023

openshift-ci bot requested review from carbonin and mkowalski August 16, 2023 21:57

openshift-ci bot added the downstream-change-needed Requires updating downstream image label Aug 17, 2023

rwsu mentioned this pull request Aug 17, 2023

OCPBUGS-16482: bump golangci-lint to 1.53.1 #702

Merged

openshift-ci-robot mentioned this pull request Sep 20, 2023

OCPBUGS-16482: bump golangci-lint to v1.53.1 openshift/assisted-installer-agent#591

Merged

osherdp approved these changes Sep 28, 2023

View reviewed changes

openshift-ci bot assigned osherdp Sep 28, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Sep 28, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Sep 28, 2023

openshift-ci bot removed the downstream-change-needed Requires updating downstream image label Oct 2, 2023

openshift-ci-robot added jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. and removed jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. labels Oct 2, 2023

rwsu added 2 commits October 16, 2023 10:59

Update golangci-lint to v1.53.1 to fix nil pointer

97b8ac8

rwsu force-pushed the OCPBUGS-16482 branch from 4764d82 to 97b8ac8 Compare October 16, 2023 16:03

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Oct 16, 2023

openshift-ci-robot added jira/valid-bug Indicates that a referenced Jira bug is valid for the branch this PR is targeting. and removed jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Oct 16, 2023

openshift-ci bot assigned omertuc Oct 18, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Oct 18, 2023

openshift-ci bot merged commit 2d99fad into openshift:master Oct 19, 2023
10 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-16482: Update dependencies to remove goproxy dependency #701

OCPBUGS-16482: Update dependencies to remove goproxy dependency #701

rwsu commented Aug 16, 2023 •

edited

openshift-ci-robot commented Aug 16, 2023

codecov bot commented Aug 16, 2023 •

edited

openshift-ci-robot commented Aug 16, 2023

eranco74 commented Aug 17, 2023

rwsu commented Aug 21, 2023

openshift-ci bot commented Sep 28, 2023

rwsu commented Oct 2, 2023

osherdp commented Oct 2, 2023

openshift-ci-robot commented Oct 2, 2023

rwsu commented Oct 16, 2023

openshift-ci-robot commented Oct 16, 2023

omertuc commented Oct 18, 2023

openshift-ci-robot commented Oct 18, 2023

omertuc commented Oct 19, 2023

gamli75 commented Oct 19, 2023

openshift-ci bot commented Oct 19, 2023

openshift-ci-robot commented Oct 19, 2023

openshift-merge-robot commented Oct 25, 2023

OCPBUGS-16482: Update dependencies to remove goproxy dependency #701

OCPBUGS-16482: Update dependencies to remove goproxy dependency #701

Conversation

rwsu commented Aug 16, 2023 • edited

openshift-ci-robot commented Aug 16, 2023

codecov bot commented Aug 16, 2023 • edited

Codecov Report

openshift-ci-robot commented Aug 16, 2023

eranco74 commented Aug 17, 2023

rwsu commented Aug 21, 2023

openshift-ci bot commented Sep 28, 2023

rwsu commented Oct 2, 2023

osherdp commented Oct 2, 2023

openshift-ci-robot commented Oct 2, 2023

rwsu commented Oct 16, 2023

openshift-ci-robot commented Oct 16, 2023

omertuc commented Oct 18, 2023

openshift-ci-robot commented Oct 18, 2023

omertuc commented Oct 19, 2023

gamli75 commented Oct 19, 2023

openshift-ci bot commented Oct 19, 2023

openshift-ci-robot commented Oct 19, 2023

openshift-merge-robot commented Oct 25, 2023

rwsu commented Aug 16, 2023 •

edited

codecov bot commented Aug 16, 2023 •

edited