TRT-2587: Revert #2219 "CNTRLPLANE-2769: Bump k8s dependencies to 1.35"#2236
Merged
openshift-merge-bot[bot] merged 2 commits intoopenshift:mainfrom Mar 23, 2026
Merged
Conversation
This reverts commit 05fa7bb, reversing changes made to cb542c51e1c9b5b6b1b0c14d0b6c3e5e5f6f7a8b. Note: The following dependent commit was also reverted because it conflicts with or depends on the original change: - a69f827 Merge pull request openshift#2222 from JoelSpeed/update-release-extract-inclusion (Implement feature gate and major version extraction for manifest inclusion)
openshift-ci-robot
added
the
jira/valid-reference
|
@smg247: This pull request references TRT-2587 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
1 similar comment
|
@smg247: This pull request references TRT-2587 which is a valid jira issue. Warning: The referenced jira issue has an invalid target version for the target branch this PR targets: expected the bug to target the "4.22.0" version, but no target version was set. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
WalkthroughA project-wide downgrade from Go 1.25 and Kubernetes v1.35.2 to Go 1.24 and v1.34.1, with corresponding dependency updates in go.mod. Docker base images are updated to use the earlier Go version. Additionally, feature-gate extraction logic in release tools is simplified, and CLI command handling is refactored with adjusted plugin discovery flow. Changes
Estimated code review effort🎯 4 (Complex) | ⏱️ ~60 minutes ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment Tip You can enable review details to help with troubleshooting, context usage and more.Enable the |
Member
Author
|
/payload-job periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn-conformance |
Contributor
|
@smg247: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/1c9b3620-264c-11f1-975a-1989bf53803b-0 |
Member
Author
|
/payload-aggregate periodic-ci-openshift-hypershift-release-4.22-periodics-e2e-aws-ovn-conformance 5 |
Contributor
|
@smg247: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/37b31810-264c-11f1-8acb-250bb962f0c2-0 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@go.mod`:
- Around line 194-196: The go.mod currently lists the indirect module
github.com/sigstore/fulcio at v1.4.5 which has known CVEs; update/pin that
indirect dependency to v1.8.5 (github.com/sigstore/fulcio@v1.8.5) once
Kubernetes 1.35 compatibility is resolved—either by running `go get
github.com/sigstore/fulcio@v1.8.5` and `go mod tidy` to refresh go.mod/go.sum or
temporarily adding a go.mod require/replace for github.com/sigstore/fulcio
v1.8.5 to mitigate the vulnerability; after updating, verify there are no
compatibility breaks with the related modules github.com/sigstore/rekor and
github.com/sigstore/sigstore and run tests.
In `@pkg/cli/admin/release/extract_tools.go`:
- Around line 1284-1286: The call in newIncluder to m.Include is missing the
platform filter so platform-specific CredentialsRequests get included when using
--included; update the includer to pass config.Platform into m.Include (i.e.,
call m.Include with config.ExcludeIdentifier, config.RequiredFeatureSet,
config.Profile, config.Capabilities, config.Platform, config.Overrides or
whatever order matches m.Include's signature) so the platform filtering honored
here (the provider-spec-kind filter in extract.go only runs for
--credentials-requests).
In `@pkg/cli/cli.go`:
- Around line 138-161: The error formatting is inconsistent: the earlier call to
kubecmd.HandlePluginCommand writes fmt.Fprintf(o.IOStreams.ErrOut, "%v\n", err)
while the later call uses "Error: %v\n"; update the earlier call to include the
same "Error: " prefix so both HandlePluginCommand failure paths produce
consistent output (modify the fmt.Fprintf call that prints err after
kubecmd.HandlePluginCommand in the first branch to use "Error: %v\n").
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository YAML (base), Organization UI (inherited)
Review profile: CHILL
Plan: Pro
Run ID: 1f5a7898-b8e8-45a1-9ae2-e54125c9d81c
⛔ Files ignored due to path filters (288)
go.sumis excluded by!**/*.sumvendor/github.com/asaskevich/govalidator/.gitignoreis excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/.travis.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/CODE_OF_CONDUCT.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/CONTRIBUTING.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/LICENSEis excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/arrays.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/converter.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/error.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/numerics.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/patterns.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/utils.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/validator.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/asaskevich/govalidator/wercker.ymlis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/credentials.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/middleware/user_agent.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/debug.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/encode.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/error.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/header.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/protocol/eventstream/header_value.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/aws/transport/http/timeout_read_closer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/resolve.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/resolve_credentials.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/config/shared_config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/logincreds/dpop.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/logincreds/file.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/logincreds/provider.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/credentials/logincreds/token.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_op_GetDynamicData.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_op_GetIAMInfo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_op_GetInstanceIdentityDocument.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_op_GetMetadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_op_GetRegion.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_op_GetToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/api_op_GetUserData.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/ec2/imds/request_middleware.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/default_read_seeker_write_to.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/default_writer_read_from.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/download.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/pool.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/read_seeker_write_to.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/upload.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/feature/s3/manager/writer_read_from.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/config.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/configsources/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/partitions.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/awsrulesfn/partitions.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/endpoints/v2/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/ini/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/ini/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/smithy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/internal/v4a/v4a.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/accept-encoding/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/checksum/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/checksum/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/checksum/middleware_add.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/checksum/middleware_compute_input_checksum.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/checksum/middleware_setup_context.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/presigned-url/middleware.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/s3shared/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/s3shared/arn_lookup.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/s3shared/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/internal/s3shared/response_error.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_AbortMultipartUpload.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_CompleteMultipartUpload.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_CopyObject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_CreateBucket.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_CreateBucketMetadataConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_CreateBucketMetadataTableConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_CreateMultipartUpload.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_CreateSession.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucket.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketAnalyticsConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketCors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketEncryption.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketIntelligentTieringConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketInventoryConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketLifecycle.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketMetadataConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketMetadataTableConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketMetricsConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketOwnershipControls.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketPolicy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketReplication.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketTagging.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteBucketWebsite.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteObject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteObjectTagging.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeleteObjects.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_DeletePublicAccessBlock.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketAbac.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketAccelerateConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketAcl.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketAnalyticsConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketCors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketEncryption.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketIntelligentTieringConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketInventoryConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketLifecycleConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketLocation.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketLogging.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketMetadataConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketMetadataTableConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketMetricsConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketNotificationConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketOwnershipControls.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketPolicy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketPolicyStatus.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketReplication.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketRequestPayment.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketTagging.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketVersioning.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetBucketWebsite.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetObject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetObjectAcl.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetObjectAttributes.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetObjectLegalHold.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetObjectLockConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetObjectRetention.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetObjectTagging.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetObjectTorrent.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_GetPublicAccessBlock.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_HeadBucket.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_HeadObject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListBucketAnalyticsConfigurations.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListBucketIntelligentTieringConfigurations.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListBucketInventoryConfigurations.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListBucketMetricsConfigurations.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListBuckets.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListDirectoryBuckets.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListMultipartUploads.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListObjectVersions.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListObjects.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListObjectsV2.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_ListParts.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketAbac.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketAccelerateConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketAcl.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketAnalyticsConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketCors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketEncryption.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketIntelligentTieringConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketInventoryConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketLifecycleConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketLogging.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketMetricsConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketNotificationConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketOwnershipControls.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketPolicy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketReplication.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketRequestPayment.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketTagging.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketVersioning.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutBucketWebsite.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutObject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutObjectAcl.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutObjectLegalHold.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutObjectLockConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutObjectRetention.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutObjectTagging.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_PutPublicAccessBlock.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_RenameObject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_RestoreObject.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_SelectObjectContent.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_UpdateBucketMetadataInventoryTableConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_UpdateBucketMetadataJournalTableConfiguration.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_UpdateObjectEncryption.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_UploadPart.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_UploadPartCopy.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/api_op_WriteGetObjectResponse.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/bucket_context.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/bucketer.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/express_default.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/presign_post.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/serializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/types/enums.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/types/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/types/types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/s3/validators.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/api_op_CreateOAuth2Token.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/doc.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/serializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/types/enums.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/types/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/types/types.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/signin/validators.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_GetRoleCredentials.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccountRoles.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_ListAccounts.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/api_op_Logout.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sso/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_CreateTokenWithIAM.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_RegisterClient.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/api_op_StartDeviceAuthorization.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/ssooidc/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_client.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRole.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithSAML.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoleWithWebIdentity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_AssumeRoot.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_DecodeAuthorizationMessage.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetAccessKeyInfo.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetCallerIdentity.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetDelegatedAccessToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetFederationToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetSessionToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/api_op_GetWebIdentityToken.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/auth.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/deserializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/generated.jsonis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/internal/endpoints/endpoints.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/options.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/serializers.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/types/errors.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/aws-sdk-go-v2/service/sts/validators.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/CHANGELOG.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/Makefileis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/README.mdis excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/go_module_metadata.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/metrics/nop.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/middleware/eventstream_middleware.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/middleware/ordered_group.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/middleware/step_build.gois excluded by!vendor/**,!**/vendor/**vendor/github.com/aws/smithy-go/middleware/step_deserialize.gois excluded by!vendor/**,!**/vendor/**
📒 Files selected for processing (12)
.ci-operator.yamlMakefilego.modimages/cli-artifacts/Dockerfile.rhelimages/cli/Dockerfile.rhelimages/recycler/Dockerfile.rhelimages/tools/Dockerfilepkg/cli/admin/release/extract.gopkg/cli/admin/release/extract_tools.gopkg/cli/cli.gopkg/cli/deployer/strategy/support/lifecycle_test.gopkg/helpers/describe/describer_test.go
💤 Files with no reviewable changes (1)
- pkg/helpers/describe/describer_test.go
Comment on lines
+194
to
+196
| github.com/sigstore/fulcio v1.4.5 // indirect | ||
| github.com/sigstore/rekor v1.3.6 // indirect | ||
| github.com/sigstore/sigstore v1.8.4 // indirect |
There was a problem hiding this comment.
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
# Check which direct dependencies pull in sigstore/fulcio
go mod why -m github.com/sigstore/fulcio 2>/dev/null || echo "Run 'go mod why -m github.com/sigstore/fulcio' locally to trace dependency"Repository: openshift/oc
Length of output: 227
🌐 Web query:
GO-2025-4193 sigstore fulcio vulnerability SSRF
💡 Result:
GO-2025-4193 is not the Fulcio SSRF issue. It maps to CVE-2025-66506 / GHSA-f83f-xpx7-ffpw and is a DoS-style bug where Fulcio can allocate excessive memory while parsing a malicious token (affected <= v1.8.2, fixed in v1.8.3). [1][2]
The Fulcio SSRF you’re referring to is a different advisory: CVE-2026-22772 / GHSA-59jp-pj84-45mr (published Jan 12–13, 2026). It’s caused by metaRegex() using an unanchored regex, allowing a crafted issuer (iss) to bypass MetaIssuer validation and ultimately trigger blind SSRF (GET-only; response not returned) to internal services (e.g., cloud metadata 169.254.169.254, internal Kubernetes APIs). Affected <= 1.8.4, fixed in 1.8.5; workaround: upgrade to v1.8.5. [3][4]
Sources
[1] https://pkg.go.dev/vuln/GO-2025-4193
[2] GHSA-f83f-xpx7-ffpw
[3] GHSA-59jp-pj84-45mr
[4] https://advisories.gitlab.com/pkg/golang/github.com/sigstore/fulcio/CVE-2026-22772/
🌐 Web query:
GO-2026-4311 sigstore fulcio vulnerability memory exhaustion
💡 Result:
GO-2026-4311 for github.com/sigstore/fulcio is not a memory-exhaustion issue—it’s an SSRF (server-side request forgery) vulnerability caused by a MetaIssuer regex bypass, tracked as CVE-2026-22772 / GHSA-59jp-pj84-45mr. It affects Fulcio versions before v1.8.5; upgrade to v1.8.5+ to fix. [1][2]
If what you meant is Fulcio memory exhaustion / excessive allocation, that is a different vuln: CVE-2025-66506 (GHSA-f83f-xpx7-ffpw), where parsing a malicious OIDC identity token can trigger excessive memory allocation; it affects versions before 1.8.3 and is fixed in 1.8.3+. [3]
🌐 Web query:
sigstore fulcio v1.4.5 vulnerabilities OSV
💡 Result:
Fulcio v1.4.5 is listed in OSV as affected by at least these vulnerabilities:
- CVE-2025-66506 (alias GHSA-f83f-xpx7-ffpw) — DoS via excessive memory allocation during OIDC token parsing; fixed in v1.8.3; OSV severity shows CVSS 7.5 (High). (osv.dev)
- CVE-2026-22772 (alias GHSA-59jp-pj84-45mr) — SSRF via MetaIssuer regex bypass (unanchored regex in
metaRegex()); fixed in v1.8.5; OSV severity shows CVSS 5.8 (Medium). (osv.dev)
Citations:
Indirect dependency sigstore/fulcio v1.4.5 has known vulnerabilities.
v1.4.5 is affected by CVE-2025-66506 (HIGH severity, DoS via excessive memory allocation during token parsing) and CVE-2026-22772 (MEDIUM severity, SSRF via regex bypass). Both are fixed in v1.8.5. Since this is an indirect dependency restored by the revert, track for update once k8s 1.35 compatibility constraints are resolved.
🧰 Tools
🪛 OSV Scanner (2.3.3)
[HIGH] 194-194: github.com/sigstore/fulcio 1.4.5: Fulcio allocates excessive memory during token parsing in github.com/sigstore/fulcio
(GO-2025-4193)
[HIGH] 194-194: github.com/sigstore/fulcio 1.4.5: Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass in github.com/sigstore/fulcio
(GO-2026-4311)
[HIGH] 194-194: github.com/sigstore/fulcio 1.4.5: Fulcio is vulnerable to Server-Side Request Forgery (SSRF) via MetaIssuer Regex Bypass
[HIGH] 194-194: github.com/sigstore/fulcio 1.4.5: Fulcio allocates excessive memory during token parsing
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@go.mod` around lines 194 - 196, The go.mod currently lists the indirect
module github.com/sigstore/fulcio at v1.4.5 which has known CVEs; update/pin
that indirect dependency to v1.8.5 (github.com/sigstore/fulcio@v1.8.5) once
Kubernetes 1.35 compatibility is resolved—either by running `go get
github.com/sigstore/fulcio@v1.8.5` and `go mod tidy` to refresh go.mod/go.sum or
temporarily adding a go.mod require/replace for github.com/sigstore/fulcio
v1.8.5 to mitigate the vulnerability; after updating, verify there are no
compatibility breaks with the related modules github.com/sigstore/rekor and
github.com/sigstore/sigstore and run tests.
Comment on lines
1284
to
+1286
| func newIncluder(config manifestInclusionConfiguration) includer { | ||
| return func(m *manifest.Manifest) error { | ||
| return m.Include(config.ExcludeIdentifier, config.RequiredFeatureSet, config.Profile, config.Capabilities, config.Overrides, config.EnabledFeatureGates, config.RequiredMajorVersion) | ||
| } | ||
| } | ||
|
|
||
| // extractFeatureGatesFromFiles extracts FeatureGate manifests from the release payload | ||
| // cached files and returns the set of enabled feature gates for the specified version and profile. | ||
| func extractFeatureGatesFromFiles(files []extractedFile, version, featureSet, profile string) (sets.Set[string], *uint64, error) { | ||
| enabledFeatureGates := sets.Set[string]{} | ||
|
|
||
| // Validate the version | ||
| if version == "" { | ||
| return enabledFeatureGates, nil, fmt.Errorf("version cannot be empty") | ||
| } | ||
|
|
||
| featureGateManifests := []configv1.FeatureGate{} | ||
| releaseMetadata := struct { | ||
| Version string `json:"version"` | ||
| }{} | ||
|
|
||
| for _, file := range files { | ||
| // Extract the release metadata so that we can work out the release version. | ||
| if file.name == "release-metadata" { | ||
| if err := json.Unmarshal(file.rawData, &releaseMetadata); err != nil { | ||
| return enabledFeatureGates, nil, fmt.Errorf("unable to load release metadata from release payload: %w", err) | ||
| } | ||
|
|
||
| continue | ||
| } | ||
|
|
||
| // Process each manifest in the file | ||
| for _, m := range file.manifests { | ||
| if m.GVK.Group == "config.openshift.io" && m.GVK.Version == "v1" && m.GVK.Kind == "FeatureGate" { | ||
| // Extract feature gate data | ||
| featureGate := &configv1.FeatureGate{} | ||
| if err := k8sruntime.DefaultUnstructuredConverter.FromUnstructured(m.Obj.Object, featureGate); err != nil { | ||
| klog.V(4).Infof("Failed to convert FeatureGate %s: %v", file.name, err) | ||
| continue | ||
| } | ||
|
|
||
| featureGateManifests = append(featureGateManifests, *featureGate) | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if releaseMetadata.Version == "" { | ||
| return enabledFeatureGates, nil, fmt.Errorf("release metadata version is empty") | ||
| } | ||
|
|
||
| parsedVersion, err := semver.Parse(releaseMetadata.Version) | ||
| if err != nil { | ||
| return enabledFeatureGates, nil, fmt.Errorf("failed to parse release metadata version %s: %w", releaseMetadata.Version, err) | ||
| } | ||
|
|
||
| for _, featureGate := range featureGateManifests { | ||
| if !appliesToVersion(&featureGate, parsedVersion.Major) || | ||
| !appliesToClusterProfile(&featureGate, profile) || | ||
| !appliesToFeatureSet(&featureGate, featureSet) { | ||
| continue | ||
| } | ||
|
|
||
| // There will only be a single version in the feature gate manifests. | ||
| for _, featuregateVersion := range featureGate.Status.FeatureGates { | ||
| for _, enabled := range featuregateVersion.Enabled { | ||
| enabledFeatureGates.Insert(string(enabled.Name)) | ||
| } | ||
| } | ||
| return m.Include(config.ExcludeIdentifier, config.RequiredFeatureSet, config.Profile, config.Capabilities, config.Overrides) |
There was a problem hiding this comment.
Platform-specific CredentialsRequests are no longer filtered for plain --included.
Line 1286 ignores config.Platform, even though both config builders still populate it. The remaining provider-spec-kind filter lives in extract.go and only runs when --credentials-requests is set, so oc adm release extract --included now over-extracts cloud-specific credential requests.
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pkg/cli/admin/release/extract_tools.go` around lines 1284 - 1286, The call in
newIncluder to m.Include is missing the platform filter so platform-specific
CredentialsRequests get included when using --included; update the includer to
pass config.Platform into m.Include (i.e., call m.Include with
config.ExcludeIdentifier, config.RequiredFeatureSet, config.Profile,
config.Capabilities, config.Platform, config.Overrides or whatever order matches
m.Include's signature) so the platform filtering honored here (the
provider-spec-kind filter in extract.go only runs for --credentials-requests).
Comment on lines
138
to
+161
| if err := kubecmd.HandlePluginCommand(o.PluginHandler, cmdPathPieces, 1); err != nil { | ||
| fmt.Fprintf(o.IOStreams.ErrOut, "Error: %v\n", err) | ||
| fmt.Fprintf(o.IOStreams.ErrOut, "%v\n", err) | ||
| os.Exit(1) | ||
| } | ||
| } | ||
| } | ||
| // Command exists(e.g. kubectl create), but it is not certain that | ||
| // subcommand also exists (e.g. kubectl create networkpolicy) | ||
| // we also have to eliminate kubectl create -f | ||
| if kubecmd.IsSubcommandPluginAllowed(foundCmd.Name()) && len(foundArgs) >= 1 && !strings.HasPrefix(foundArgs[0], "-") { | ||
| subcommand := foundArgs[0] | ||
| builtinSubcmdExist := false | ||
| for _, subcmd := range foundCmd.Commands() { | ||
| if subcmd.Name() == subcommand { | ||
| builtinSubcmdExist = true | ||
| break | ||
| } else if err == nil { | ||
| // Command exists(e.g. kubectl create), but it is not certain that | ||
| // subcommand also exists (e.g. kubectl create networkpolicy) | ||
| // we also have to eliminate kubectl create -f | ||
| if kubecmd.IsSubcommandPluginAllowed(foundCmd.Name()) && len(foundArgs) >= 1 && !strings.HasPrefix(foundArgs[0], "-") { | ||
| subcommand := foundArgs[0] | ||
| builtinSubcmdExist := false | ||
| for _, subcmd := range foundCmd.Commands() { | ||
| if subcmd.Name() == subcommand { | ||
| builtinSubcmdExist = true | ||
| break | ||
| } | ||
| } | ||
| } | ||
|
|
||
| if !builtinSubcmdExist { | ||
| if err := kubecmd.HandlePluginCommand(o.PluginHandler, cmdPathPieces, len(cmdPathPieces)-len(foundArgs)+1); err != nil { | ||
| fmt.Fprintf(o.IOStreams.ErrOut, "Error: %v\n", err) | ||
| os.Exit(1) | ||
| if !builtinSubcmdExist { | ||
| if err := kubecmd.HandlePluginCommand(o.PluginHandler, cmdPathPieces, len(cmdPathPieces)-len(foundArgs)+1); err != nil { | ||
| fmt.Fprintf(o.IOStreams.ErrOut, "Error: %v\n", err) | ||
| os.Exit(1) | ||
| } |
There was a problem hiding this comment.
Inconsistent error output formatting.
Line 139 omits the "Error: " prefix while line 159 includes it, though both handle the same HandlePluginCommand failure scenario.
Proposed fix to make error formatting consistent
Either add the prefix to line 139:
- fmt.Fprintf(o.IOStreams.ErrOut, "%v\n", err)
+ fmt.Fprintf(o.IOStreams.ErrOut, "Error: %v\n", err)Or remove it from line 159:
- fmt.Fprintf(o.IOStreams.ErrOut, "Error: %v\n", err)
+ fmt.Fprintf(o.IOStreams.ErrOut, "%v\n", err)📝 Committable suggestion
‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.
Suggested change
| if err := kubecmd.HandlePluginCommand(o.PluginHandler, cmdPathPieces, 1); err != nil { | |
| fmt.Fprintf(o.IOStreams.ErrOut, "Error: %v\n", err) | |
| fmt.Fprintf(o.IOStreams.ErrOut, "%v\n", err) | |
| os.Exit(1) | |
| } | |
| } | |
| } | |
| // Command exists(e.g. kubectl create), but it is not certain that | |
| // subcommand also exists (e.g. kubectl create networkpolicy) | |
| // we also have to eliminate kubectl create -f | |
| if kubecmd.IsSubcommandPluginAllowed(foundCmd.Name()) && len(foundArgs) >= 1 && !strings.HasPrefix(foundArgs[0], "-") { | |
| subcommand := foundArgs[0] | |
| builtinSubcmdExist := false | |
| for _, subcmd := range foundCmd.Commands() { | |
| if subcmd.Name() == subcommand { | |
| builtinSubcmdExist = true | |
| break | |
| } else if err == nil { | |
| // Command exists(e.g. kubectl create), but it is not certain that | |
| // subcommand also exists (e.g. kubectl create networkpolicy) | |
| // we also have to eliminate kubectl create -f | |
| if kubecmd.IsSubcommandPluginAllowed(foundCmd.Name()) && len(foundArgs) >= 1 && !strings.HasPrefix(foundArgs[0], "-") { | |
| subcommand := foundArgs[0] | |
| builtinSubcmdExist := false | |
| for _, subcmd := range foundCmd.Commands() { | |
| if subcmd.Name() == subcommand { | |
| builtinSubcmdExist = true | |
| break | |
| } | |
| } | |
| } | |
| if !builtinSubcmdExist { | |
| if err := kubecmd.HandlePluginCommand(o.PluginHandler, cmdPathPieces, len(cmdPathPieces)-len(foundArgs)+1); err != nil { | |
| fmt.Fprintf(o.IOStreams.ErrOut, "Error: %v\n", err) | |
| os.Exit(1) | |
| if !builtinSubcmdExist { | |
| if err := kubecmd.HandlePluginCommand(o.PluginHandler, cmdPathPieces, len(cmdPathPieces)-len(foundArgs)+1); err != nil { | |
| fmt.Fprintf(o.IOStreams.ErrOut, "Error: %v\n", err) | |
| os.Exit(1) | |
| } | |
| if err := kubecmd.HandlePluginCommand(o.PluginHandler, cmdPathPieces, 1); err != nil { | |
| fmt.Fprintf(o.IOStreams.ErrOut, "%v\n", err) | |
| os.Exit(1) | |
| } | |
| } | |
| } else if err == nil { | |
| // Command exists(e.g. kubectl create), but it is not certain that | |
| // subcommand also exists (e.g. kubectl create networkpolicy) | |
| // we also have to eliminate kubectl create -f | |
| if kubecmd.IsSubcommandPluginAllowed(foundCmd.Name()) && len(foundArgs) >= 1 && !strings.HasPrefix(foundArgs[0], "-") { | |
| subcommand := foundArgs[0] | |
| builtinSubcmdExist := false | |
| for _, subcmd := range foundCmd.Commands() { | |
| if subcmd.Name() == subcommand { | |
| builtinSubcmdExist = true | |
| break | |
| } | |
| } | |
| if !builtinSubcmdExist { | |
| if err := kubecmd.HandlePluginCommand(o.PluginHandler, cmdPathPieces, len(cmdPathPieces)-len(foundArgs)+1); err != nil { | |
| fmt.Fprintf(o.IOStreams.ErrOut, "%v\n", err) | |
| os.Exit(1) | |
| } |
🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed.
In `@pkg/cli/cli.go` around lines 138 - 161, The error formatting is inconsistent:
the earlier call to kubecmd.HandlePluginCommand writes
fmt.Fprintf(o.IOStreams.ErrOut, "%v\n", err) while the later call uses "Error:
%v\n"; update the earlier call to include the same "Error: " prefix so both
HandlePluginCommand failure paths produce consistent output (modify the
fmt.Fprintf call that prints err after kubecmd.HandlePluginCommand in the first
branch to use "Error: %v\n").
Member
|
/lgtm The payload agent went back and forth a couple times if this was the cause of permafailing hypershift, but it didn't pick any other PR's. Tagging in case testing confirms |
openshift-ci
bot
added
do-not-merge/hold
openshift-ci
bot
added
lgtm
Member
Author
|
/retest |
Member
|
That is unfortunate but currently there is no other way |
openshift-ci
bot
removed
the
do-not-merge/hold
Member
|
/lgtm |
Contributor
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: ardaguclu, smg247, stbenjam The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
Member
Author
|
/hold until we hear back from hypershift |
openshift-ci
bot
added
the
do-not-merge/hold
Contributor
|
@smg247: all tests passed! Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
Member
|
/hold cancel |
openshift-ci
bot
removed
the
do-not-merge/hold
openshift-ci-robot
added
the
verified
|
@stbenjam: This PR has been marked as verified by DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Reverts #2219 ; tracked by TRT-2587
Per OpenShift policy, we are reverting this breaking change to get CI and/or nightly payloads flowing again.
This PR is causing blocking job failures (aggregated-hypershift-ovn-conformance-4.22) in the nightly amd64 payload 4.22.0-0.nightly-2026-03-22-134704. 4 sig-cli tests (oc adm new-project, oc adm storage-admin, oc adm ui-project-commands, templates different namespaces) consistently time out after 15 minutes in hypershift clusters. The oc binary hangs in pidfdWait when executing RBAC/project commands against the hosted API server.
Note: PR #2222 (feature gate and major version extraction for manifest inclusion) was also reverted because it depends on API changes introduced by the k8s 1.35 bump.
To unrevert this, revert this PR, and layer an additional separate commit on top that addresses the problem. Before merging the unrevert, please run these jobs on the PR and check the result of these jobs to confirm the fix has corrected the problem:
CC: @ardaguclu @JoelSpeed