Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Use patched protobuf with RUSTSEC-2019-0003 fix. #7770

Merged
merged 1 commit into from May 20, 2019

Conversation

Projects
None yet
3 participants
@jsirois
Copy link
Member

commented May 20, 2019

A crates index patch was needed here to ensure both our crates and
transitive dependent crates saw the same rust-protobuf. Without this we
hit many errors like:

   Compiling bazel_protos v0.0.1 (/home/jsirois/dev/pantsbuild/jsirois-pants/src/rust/engine/process_execution/bazel_protos)
error[E0277]: the trait bound `gen::bytestream::ReadRequest: protobuf::core::Message` is not satisfied
  --> process_execution/bazel_protos/src/gen/bytestream_grpc.rs:23:42
   |
23 |     req_mar: ::grpcio::Marshaller { ser: ::grpcio::pb_ser, de: ::grpcio::pb_de },
   |                                          ^^^^^^^^^^^^^^^^ the trait `protobuf::core::Message` is not implemented for `gen::bytestream::ReadRequest`
   |
   = note: required by `grpcio::codec::pb_codec::ser`

Fixes #7760

Use patched protobuf with RUSTSEC-2019-0003 fix.
A crates index patch was needed here to ensure both our crates and
transitive dependent crates saw the same rust-protobuf. Without this we
hit many errors like:
```
   Compiling bazel_protos v0.0.1 (/home/jsirois/dev/pantsbuild/jsirois-pants/src/rust/engine/process_execution/bazel_protos)
error[E0277]: the trait bound `gen::bytestream::ReadRequest: protobuf::core::Message` is not satisfied
  --> process_execution/bazel_protos/src/gen/bytestream_grpc.rs:23:42
   |
23 |     req_mar: ::grpcio::Marshaller { ser: ::grpcio::pb_ser, de: ::grpcio::pb_de },
   |                                          ^^^^^^^^^^^^^^^^ the trait `protobuf::core::Message` is not implemented for `gen::bytestream::ReadRequest`
   |
   = note: required by `grpcio::codec::pb_codec::ser`
```

Fixes #7760
@@ -24,7 +24,7 @@ lazy_static = "1"
lmdb = { git = "https://github.com/pantsbuild/lmdb-rs.git", rev = "06bdfbfc6348f6804127176e561843f214fc17f8" }
log = "0.4"
parking_lot = "0.6"
protobuf = { version = "2.0.4", features = ["with-bytes"] }
protobuf = { version = "2.0.6", features = ["with-bytes"] }

This comment has been minimized.

Copy link
@jsirois

jsirois May 20, 2019

Author Member

NB: We already were being floated up to 2.0.6 by cargo (see Cargo.lock) - I just edited these to make it more clear how the cargo index patch applies.

@jsirois jsirois requested review from illicitonion and Eric-Arellano May 20, 2019

@Eric-Arellano
Copy link
Contributor

left a comment

I think we can kill this --ignore flag below now, right?

# TODO(John Sirois): Kill --ignore RUSTSEC-2019-0003 when we can upgrade to an official released
# version of protobuf with a fix.
# See: https://github.com/pantsbuild/pants/issues/7760 for context.
"${REPO_ROOT}/build-support/bin/native/cargo" audit \
-f "${REPO_ROOT}/src/rust/engine/Cargo.lock" \
--ignore RUSTSEC-2019-0003

While the TODO says to wait until the official patch is landed, with us now using Pants' version of protobuf I think we can clean that part up now. The only remaining cleanup once the patch lands would be to update Cargo.toml.

@jsirois

This comment has been minimized.

Copy link
Member Author

commented May 20, 2019

I think we can kill this --ignore flag below now, right?

Nope. There is no remedy recognized by the database. We'd need to clone the database, edit RUSTSEC-2019-0003 and cron refreshes of the db.

Edit: They just committed remedies: https://github.com/RustSec/advisory-db/commits/master/crates/protobuf/RUSTSEC-2019-0003.toml however we'll need to upgrade through several minor versions to get there. I've filed #7771 to track that yak. I need to be moving on at the moment to other work.

@jsirois jsirois merged commit d4d8f4c into pantsbuild:master May 20, 2019

1 check passed

continuous-integration/travis-ci/pr The Travis CI build passed
Details

@jsirois jsirois deleted the jsirois:issues/7760 branch May 20, 2019

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.