Commit graph

20 commits

Author SHA1 Message Date
Milos Gajdos
777ad03208
Update docs GHA
Add missing steps to the job, pick up the path automatically, trigger
the job on config file changes.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2023-10-15 11:03:23 +01:00
David Karlsson
1596da6813 docs: add tests
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
2023-10-12 09:32:55 +02:00
David Karlsson
e2ae76f1f2 docs: add hugo site
Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com>
2023-10-11 16:45:16 +02:00
Sebastiaan van Stijn
23115ff634
update to go1.20.8
go1.20.8 (released 2023-09-06) includes two security fixes to the html/template
package, as well as bug fixes to the compiler, the go command, the runtime,
and the crypto/tls, go/types, net/http, and path/filepath packages. See the
Go 1.20.8 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.20.8+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.20.7...go1.20.8

From the security mailing:

[security] Go 1.21.1 and Go 1.20.8 are released

Hello gophers,

We have just released Go versions 1.21.1 and 1.20.8, minor point releases.

These minor releases include 4 security fixes following the security policy:

- cmd/go: go.mod toolchain directive allows arbitrary execution
  The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to
  execute scripts and binaries relative to the root of the module when the "go"
  command was executed within the module. This applies to modules downloaded using
  the "go" command from the module proxy, as well as modules downloaded directly
  using VCS software.

  Thanks to Juho Nurminen of Mattermost for reporting this issue.

  This is CVE-2023-39320 and Go issue https://go.dev/issue/62198.

- html/template: improper handling of HTML-like comments within script contexts
  The html/template package did not properly handle HMTL-like "<!--" and "-->"
  comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may
  cause the template parser to improperly interpret the contents of <script>
  contexts, causing actions to be improperly escaped. This could be leveraged to
  perform an XSS attack.

  Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this
  issue.

  This is CVE-2023-39318 and Go issue https://go.dev/issue/62196.

- html/template: improper handling of special tags within script contexts
  The html/template package did not apply the proper rules for handling occurrences
  of "<script", "<!--", and "</script" within JS literals in <script> contexts.
  This may cause the template parser to improperly consider script contexts to be
  terminated early, causing actions to be improperly escaped. This could be
  leveraged to perform an XSS attack.

  Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this
  issue.

  This is CVE-2023-39319 and Go issue https://go.dev/issue/62197.

- crypto/tls: panic when processing post-handshake message on QUIC connections
  Processing an incomplete post-handshake message for a QUIC connection caused a panic.

  Thanks to Marten Seemann for reporting this issue.

  This is CVE-2023-39321 and CVE-2023-39322 and Go issue https://go.dev/issue/62266.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-09-12 00:07:34 +02:00
James Hewitt
1a3e73cb84
Handle rand deprecations in go 1.20
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
2023-08-28 09:33:12 +01:00
James Hewitt
0eb8fee87e
Update to go 1.20
Signed-off-by: James Hewitt <james.hewitt@uk.ibm.com>
2023-08-27 10:32:00 +01:00
Milos Gajdos
3f1859af26
Remove oss storage driver and alicdn storage driver middleware
This commit removes `oss` storage driver from distribution as well as
`alicdn` storage middleware which only works with the `oss` driver.

There are several reasons for it:
* no real-life expertise among the maintainers
* oss is compatible with S3 API operations required by S3 storage driver

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2023-08-16 08:39:20 +01:00
Wang Yan
ac79c0d94a
Merge pull request #3952 from bmanuel/golang1.19.10
Update to golang 1.19.10
2023-07-06 14:29:36 +08:00
Ben Manuel
36dd5b79ca
Update to golang 1.19.10
This addresses CVE-2023-29402, CVE-2023-29403, CVE-2023-29404, CVE-2023-29405
which were patched in 1.19.10.

Signed-off-by: Ben Manuel <ben.manuel@procore.com>
2023-06-29 15:49:27 -05:00
Milos Gajdos
6b388b1ba6
Enable Go build tags
This enables go build tags so the GCS and OSS driver support is
available in the binary distributed via the image build by Dockerfile.

This led to quite a few fixes in the GCS and OSS packages raised as
warning by golang-ci linter.

Signed-off-by: Milos Gajdos <milosthegajdos@gmail.com>
2023-06-28 11:41:22 +01:00
Sebastiaan van Stijn
322eb4eecf
update to go1.19.9
Added back minor versions in these, so that we have a somewhat more
reproducible state in the repository when tagging releases.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-05-09 17:29:31 +02:00
Sebastiaan van Stijn
dec03ea3d8
update golangci-lint to v1.52
Removing the "structcheck" and "varcheck" linters as they've been deprecated.

    level=warning msg="[runner] The linter 'structcheck' is deprecated (since v1.49.0) due to: The owner seems to have abandoned the linter. Replaced by unused."
    level=warning msg="[runner] The linter 'varcheck' is deprecated (since v1.49.0) due to: The owner seems to have abandoned the linter. Replaced by unused."

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-05-09 16:04:17 +02:00
CrazyMax
0e17e54091
dockerfiles: formatting
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-07-20 16:44:31 +02:00
CrazyMax
b066451b40
dockerfiles: set ALPINE_VERSION
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-07-20 14:19:39 +02:00
CrazyMax
1a905ab966
ci: git validation target
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-07-20 14:18:27 +02:00
Sebastiaan van Stijn
6e8dd268a8
update to go 1.18 (continue testing against 1.17)
Go 1.16 reached end of life, so update to the current version of Go, but also
run CI on the previous version (which is still supported).

We should probably also decide wether or not we want the Dockerfiles to pin to
a specific minor version; this makes the releases more deterministic.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 10:36:28 +02:00
Sebastiaan van Stijn
18b4da91a4
Update golang-ci-lint to v1.45.x
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-05-05 10:27:39 +02:00
CrazyMax
26a586cf39
lint target and workflow job
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-05-04 11:12:19 +02:00
CrazyMax
c052659543
mod-outdated target to check for outdated dependencies
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-04-22 16:24:54 +02:00
CrazyMax
ffa3019c1f
validate and update vendor target
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-04-22 15:32:01 +02:00