Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Release-4.4] BUG 1854385: Update golang/crypto to bring CVE-2020-9283 #76

Merged
merged 1 commit into from Jul 16, 2020
Merged

[Release-4.4] BUG 1854385: Update golang/crypto to bring CVE-2020-9283 #76

merged 1 commit into from Jul 16, 2020

Conversation

JoelSpeed
Copy link
Contributor

This library is not used here for doing ssh client/server connections
though still want to bring the library version with recent security
fixes. golang/crypto@bac4c82

@openshift-ci-robot
Copy link
Contributor

@JoelSpeed: This pull request references Bugzilla bug 1854385, which is valid. The bug has been moved to the POST state. The bug has been updated to refer to the pull request using the external bug tracker.

6 validation(s) were run on this bug
  • bug is open, matching expected state (open)
  • bug target release (4.4.z) matches configured target release for branch (4.4.z)
  • bug is in the state NEW, which is one of the valid states (NEW, ASSIGNED, ON_DEV, POST, POST)
  • dependent bug Bugzilla bug 1808177 is in the state VERIFIED, which is one of the valid states (VERIFIED, RELEASE_PENDING, CLOSED (ERRATA))
  • dependent Bugzilla bug 1808177 targets the "4.5.0" release, which is one of the valid target releases: 4.5.0, 4.5.z
  • bug has dependents

In response to this:

[Release-4.4] BUG 1854385: Update golang/crypto to bring CVE-2020-9283

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@openshift-ci-robot openshift-ci-robot added bugzilla/severity-low Referenced Bugzilla bug's severity is low for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. labels Jul 7, 2020
@enxebre
Copy link
Member

enxebre commented Jul 7, 2020

have we considered to use this to move to go mod as in #69?

@JoelSpeed
Copy link
Contributor Author

If you think that's a better approach, I'm happy to do that, was hoping this would be a smaller diff but glide is not making this easy

@enxebre @JoelSpeed
Run go mod init/vendor
0b87f93 
This drops glide in favour of go mod: I run go mod init, go mod tidy, go mod vendor.
To get api machinery transitive dependencies happy I took the chance to drop deprecated openshift/cluster-api in favour of openshift/machine-api-operator.
@JoelSpeed
Copy link
Contributor Author

I cherry-picked the 4.5 switch to go.mod and then fought it into working with this codebase by adding a bunch of replacements. Seems to build on my machine now.

@JoelSpeed
Copy link
Contributor Author

/retest

@enxebre
Copy link
Member

enxebre commented Jul 9, 2020 •
edited

I cherry-picked the 4.5 switch to go.mod

this would bring kube 1.18 libraries here though, right?

by adding a bunch of replacements

You mean in go mod, not in our code base right?

@JoelSpeed
Copy link
Contributor Author

this would bring kube 1.18 libraries here though, right?

It would, except after cherry picking, I set up go mod replacements to point all the kube dependencies back to the ones they were on before
https://github.com/openshift/cluster-machine-approver/pull/76/files#diff-37aff102a57d3d7b797f152915a6dc16R36-R46

@enxebre
Copy link
Member

enxebre commented Jul 13, 2020

/approve

@openshift-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: enxebre

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-ci-robot openshift-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Jul 13, 2020
michaelgugino
michaelgugino approved these changes Jul 13, 2020
View reviewed changes
Copy link
Contributor

@michaelgugino michaelgugino left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci-robot openshift-ci-robot added the lgtm Indicates that a PR is ready to be merged. label Jul 13, 2020
@sdodson sdodson added the cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. label Jul 15, 2020
@openshift-merge-robot openshift-merge-robot merged commit 5bd52b5 into openshift:release-4.4 Jul 16, 2020
@openshift-ci-robot
Copy link
Contributor

@JoelSpeed: All pull requests linked via external trackers have merged: openshift/cluster-machine-approver#76. Bugzilla bug 1854385 has been moved to the MODIFIED state.

In response to this:

[Release-4.4] BUG 1854385: Update golang/crypto to bring CVE-2020-9283

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@michaelgugino michaelgugino michaelgugino approved these changes

@enxebre enxebre Awaiting requested review from enxebre

@frobware frobware Awaiting requested review from frobware

Assignees

@michaelgugino michaelgugino

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. bugzilla/severity-low Referenced Bugzilla bug's severity is low for the branch this PR is targeting. bugzilla/valid-bug Indicates that a referenced Bugzilla bug is valid for the branch this PR is targeting. cherry-pick-approved Indicates a cherry-pick PR into a release branch has been approved by the release branch manager. lgtm Indicates that a PR is ready to be merged.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.

None yet
6 participants
@JoelSpeed @openshift-ci-robot @enxebre @michaelgugino @sdodson @openshift-merge-robot