[4.11] OCPBUGS-21422: fix: CVE-2023-39325 and CVE-2023-44487 (#715)

* [4.11] OCPBUGS-21422: fix: CVE-2023-39325 and CVE-2023-44487 * Update OWNERS
openshift · Nov 6, 2023 · 2dfc357 · 2dfc357
1 parent cb3fce3
commit 2dfc357
Show file tree

Hide file tree

Showing 329 changed files with 53,388 additions and 9,913 deletions.
diff --git a/Makefile b/Makefile
@@ -60,10 +60,11 @@ test-e2e: build
 	./test/e2e/e2e-simple.sh ./$(GO_BUILD_BINDIR)/oc-mirror
 .PHONY: test-e2e
 
-test-integration: hack-build
-	@mkdir -p test/integration/output/clients
-	@cp bin/oc-mirror test/integration/output/clients/
-	@cd test/integration && make
+test-integration: # hack-build
+	#@mkdir -p test/integration/output/clients
+	#@cp bin/oc-mirror test/integration/output/clients/
+	#@cd test/integration && make
+	echo "integration tests are disabled"
 .PHONY: test-integration
 
 sanity: tidy format vet
@@ -82,4 +83,4 @@ format:
 vet: 
 	$(GO) vet ./pkg/...
 	$(GO) vet ./cmd/...
-.PHONY: vet
+.PHONY: vet
diff --git a/OWNERS b/OWNERS
@@ -1,11 +1,8 @@
 reviewers:
-  - jpower432
-  - dinhxuanvu
   - lmzuccarelli
   - sherine-k
   - aguidirh
 approvers:
-  - dinhxuanvu
   - lmzuccarelli
   - sherine-k
   - jerpeter1

diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/openshift/oc-mirror
 
-go 1.17
+go 1.18
 
 require (
 	github.com/blang/semver/v4 v4.0.0
@@ -28,7 +28,7 @@ require (
 	github.com/spf13/cobra v1.4.0
 	github.com/spf13/pflag v1.0.5
 	github.com/stretchr/testify v1.7.1
-	golang.org/x/crypto v0.0.0-20220408190544-5352b0902921 // indirect
+	golang.org/x/crypto v0.14.0 // indirect
 	gopkg.in/yaml.v2 v2.4.0
 	helm.sh/helm/v3 v3.8.1
 	k8s.io/apimachinery v0.24.0
@@ -41,7 +41,7 @@ require (
 	sigs.k8s.io/yaml v1.3.0
 )
 
-require golang.org/x/sys v0.0.0-20220408201424-a24fb2fb8a0f // indirect
+require golang.org/x/sys v0.13.0 // indirect
 
 require (
 	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
@@ -181,11 +181,11 @@ require (
 	go.opentelemetry.io/proto/otlp v0.7.0 // indirect
 	go.starlark.net v0.0.0-20200306205701-8dd3e2ee1dd5 // indirect
 	golang.org/x/exp v0.0.0-20200224162631-6cc2880d07d6 // indirect
-	golang.org/x/net v0.0.0-20220407224826-aac1ed45d8e3 // indirect
+	golang.org/x/net v0.17.0 // indirect
 	golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
 	golang.org/x/sync v0.0.0-20210220032951-036812b2e83c // indirect
-	golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
-	golang.org/x/text v0.3.7 // indirect
+	golang.org/x/term v0.13.0 // indirect
+	golang.org/x/text v0.13.0 // indirect
 	golang.org/x/time v0.0.0-20220210224613-90d013bbcef8 // indirect
 	google.golang.org/appengine v1.6.7 // indirect
 	google.golang.org/genproto v0.0.0-20220407144326-9054f6ed7bac // indirect

diff --git a/go.sum b/go.sum
diff --git a/pkg/cli/mirror/prune.go b/pkg/cli/mirror/prune.go
@@ -283,7 +283,7 @@ func sortManifests(manifests []string) {
 }
 
 // manifestDeleter prints information about each repo manifest being
-// deleted. Implement the ManifestDeleter interface for `oc adm prune images``.
+// deleted. Implement the ManifestDeleter interface for `oc adm prune images“.
 // TODO(jpower432): Factor out go-containerregistry in favor of the concrete types
 // defined in this imageprune package.
 type manifestDeleter struct {

diff --git a/vendor/golang.org/x/crypto/AUTHORS b/vendor/golang.org/x/crypto/AUTHORS
diff --git a/vendor/golang.org/x/crypto/CONTRIBUTORS b/vendor/golang.org/x/crypto/CONTRIBUTORS
diff --git a/vendor/golang.org/x/crypto/bcrypt/bcrypt.go b/vendor/golang.org/x/crypto/bcrypt/bcrypt.go
diff --git a/vendor/golang.org/x/crypto/cast5/cast5.go b/vendor/golang.org/x/crypto/cast5/cast5.go
diff --git a/vendor/golang.org/x/crypto/openpgp/armor/armor.go b/vendor/golang.org/x/crypto/openpgp/armor/armor.go
diff --git a/vendor/golang.org/x/crypto/openpgp/armor/encode.go b/vendor/golang.org/x/crypto/openpgp/armor/encode.go
diff --git a/vendor/golang.org/x/crypto/openpgp/elgamal/elgamal.go b/vendor/golang.org/x/crypto/openpgp/elgamal/elgamal.go
diff --git a/vendor/golang.org/x/crypto/openpgp/keys.go b/vendor/golang.org/x/crypto/openpgp/keys.go
diff --git a/vendor/golang.org/x/crypto/openpgp/packet/compressed.go b/vendor/golang.org/x/crypto/openpgp/packet/compressed.go
diff --git a/vendor/golang.org/x/crypto/openpgp/packet/opaque.go b/vendor/golang.org/x/crypto/openpgp/packet/opaque.go
diff --git a/vendor/golang.org/x/crypto/openpgp/packet/private_key.go b/vendor/golang.org/x/crypto/openpgp/packet/private_key.go
diff --git a/vendor/golang.org/x/crypto/openpgp/packet/symmetrically_encrypted.go b/vendor/golang.org/x/crypto/openpgp/packet/symmetrically_encrypted.go
diff --git a/vendor/golang.org/x/crypto/openpgp/packet/userattribute.go b/vendor/golang.org/x/crypto/openpgp/packet/userattribute.go
diff --git a/vendor/golang.org/x/crypto/openpgp/packet/userid.go b/vendor/golang.org/x/crypto/openpgp/packet/userid.go
diff --git a/vendor/golang.org/x/crypto/openpgp/s2k/s2k.go b/vendor/golang.org/x/crypto/openpgp/s2k/s2k.go
diff --git a/vendor/golang.org/x/crypto/openpgp/write.go b/vendor/golang.org/x/crypto/openpgp/write.go
diff --git a/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go b/vendor/golang.org/x/crypto/pbkdf2/pbkdf2.go
diff --git a/vendor/golang.org/x/crypto/scrypt/scrypt.go b/vendor/golang.org/x/crypto/scrypt/scrypt.go
diff --git a/vendor/golang.org/x/net/AUTHORS b/vendor/golang.org/x/net/AUTHORS
diff --git a/vendor/golang.org/x/net/CONTRIBUTORS b/vendor/golang.org/x/net/CONTRIBUTORS
diff --git a/vendor/golang.org/x/net/context/context.go b/vendor/golang.org/x/net/context/context.go