Merge pull request #14 from solo-io/cve-8feb24-patch/v1.27

CVE 8feb24 patch/v1.27

.azure-pipelines/ci.yml

@@ -3,6 +3,10 @@ parameters:
   displayName: "CI target"
   type: string
   default: release
+- name: artifactName
+  displayName: "Artifact name"
+  type: string
+  default: ""
 - name: artifactSuffix
   displayName: "Suffix of artifact"
   type: string
@@ -338,6 +342,9 @@ steps:
 - task: PublishBuildArtifacts@1
   inputs:
     pathtoPublish: "$(Build.StagingDirectory)/envoy"
-    artifactName: ${{ parameters.ciTarget }}
+    ${{ if eq(parameters.artifactName, '') }}:
+      artifactName: ${{ parameters.ciTarget }}
+    ${{ if ne(parameters.artifactName, '') }}:
+      artifactName: ${{ parameters.artifactName }}
   timeoutInMinutes: 10
   condition: eq(${{ parameters.publishEnvoy }}, 'true')

.azure-pipelines/pipelines.yml

@@ -68,10 +68,6 @@ stages:
     parameters:
       buildStageDeps:
       - env
-      macBuildStageDeps:
-      - env
-      windowsBuildStageDeps:
-      - env
 
 # Scheduled run anywhere
 - ${{ if eq(variables.pipelineScheduled, true) }}:
@@ -87,10 +83,6 @@ stages:
       - env
       checkStageDeps:
       - env
-      macBuildStageDeps:
-      - env
-      windowsBuildStageDeps:
-      - env
 
 # Postsubmit main/release branches
 - ${{ if eq(variables.pipelinePostsubmit, true) }}:
@@ -103,7 +95,3 @@ stages:
       - env
       checkStageDeps:
       - env
-      macBuildStageDeps:
-      - env
-      windowsBuildStageDeps:
-      - env

.azure-pipelines/stage/linux.yml

@@ -60,6 +60,7 @@ jobs:
     name: target
   - template: ../ci.yml
     parameters:
+      artifactName: release
       managedAgent: ${{ parameters.managedAgent }}
       ciTarget: $(target.value)
       cacheName: "release"

.azure-pipelines/stage/publish.yml

@@ -292,6 +292,7 @@ jobs:
       publishEnvoy: false
       publishTestResults: false
       env:
+        ENVOY_REPO: $(Build.Repository.Name)
         ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
           ENVOY_HEAD_REF: "$(Build.SourceBranch)"
           ENVOY_BRANCH: "$(System.PullRequest.TargetBranch)"

.azure-pipelines/stages.yml

@@ -8,18 +8,6 @@ parameters:
   default:
   - env
   - prechecks
-- name: macBuildStageDeps
-  displayName: "macOS stage dependencies"
-  type: object
-  default:
-  - env
-  - prechecks
-- name: windowsBuildStageDeps
-  displayName: "Windows stage dependencies"
-  type: object
-  default:
-  - env
-  - prechecks
 - name: checkStageDeps
   displayName: "Check stage dependencies"
   type: object
@@ -158,25 +146,3 @@ stages:
   - template: stage/verify.yml
     parameters:
       authGCP: $(GcpServiceAccountKey)
-
-- stage: macos
-  displayName: macOS
-  dependsOn: ${{ parameters.macBuildStageDeps }}
-  variables:
-    RUN_BUILD: $[stageDependencies.env.repo.outputs['run.build']]
-  jobs:
-  - template: stage/macos.yml
-    parameters:
-      authGCP: $(GcpServiceAccountKey)
-      runBuild: variables['RUN_BUILD']
-
-- stage: windows
-  displayName: Windows
-  dependsOn: ${{ parameters.windowsBuildStageDeps }}
-  variables:
-    RUN_BUILD: $[stageDependencies.env.repo.outputs['run.build']]
-  jobs:
-  - template: stage/windows.yml
-    parameters:
-      authGCP: $(GcpServiceAccountKey)
-      runBuild: variables['RUN_BUILD']

.bazelrc

@@ -211,7 +211,8 @@ build:coverage --instrumentation_filter="^//source(?!/common/quic/platform)[/:],
 build:coverage --remote_download_minimal
 build:coverage --define=tcmalloc=gperftools
 build:coverage --define=no_debug_info=1
-build:coverage --linkopt=-Wl,-s
+# `--no-relax` is required for coverage to not err with `relocation R_X86_64_REX_GOTPCRELX`
+build:coverage --linkopt=-Wl,-s,--no-relax
 build:coverage --test_env=ENVOY_IP_TEST_VERSIONS=v4only
 
 build:test-coverage --test_arg="-l trace"