Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump golang to 1.11.3 (CVE-2018-16875) #72035

Merged
merged 1 commit into from
Dec 15, 2018

Conversation

seemethere
Copy link
Contributor

@seemethere seemethere commented Dec 14, 2018

What type of PR is this?
/kind cleanup

What this PR does / why we need it:

In the same vein as #70665

Which issue(s) this PR fixes:

Fixes #72032

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Update to use go1.11.3 with fix for CVE-2018-16875

@k8s-ci-robot k8s-ci-robot added kind/bug Categorizes issue or PR as related to a bug. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Dec 14, 2018
@k8s-ci-robot
Copy link
Contributor

Hi @seemethere. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. label Dec 14, 2018
@k8s-ci-robot k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels Dec 14, 2018
@cblecker
Copy link
Member

@seemethere Has the Docker Hub tag for golang:1.11.3 been pushed yet?

/assign cblecker ixdy
/uncc jbeda

@k8s-ci-robot k8s-ci-robot removed the request for review from jbeda December 14, 2018 02:12
@cblecker
Copy link
Member

We also need to bump the rules_go version. The new tags are in the referenced issue.

@seemethere
Copy link
Contributor Author

seemethere commented Dec 14, 2018

Yup images for amd64 were pushed around 3pm PST

@ixdy
Copy link
Member

ixdy commented Dec 14, 2018

yeah, can you please bump rules_go (in the WORKSPACE file) to 0.16.4?

@seemethere
Copy link
Contributor Author

@cblecker @ixdy just pushed with rules_go updated to 0.16.4

build/root/WORKSPACE Outdated Show resolved Hide resolved
@k8s-ci-robot k8s-ci-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. and removed size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. labels Dec 14, 2018
@ixdy
Copy link
Member

ixdy commented Dec 14, 2018

also test/images/Makefile?

we definitely specify the Go version in too many places :\

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Dec 14, 2018
@ixdy
Copy link
Member

ixdy commented Dec 14, 2018

I'm working on building the crossbuild image now.

@@ -4,8 +4,8 @@ load("//build:workspace.bzl", "CNI_VERSION", "CRI_TOOLS_VERSION")

http_archive(
name = "io_bazel_rules_go",
sha256 = "f87fa87475ea107b3c69196f39c82b7bbf58fe27c62a338684c20ca17d1d8613",
urls = mirror("https://github.com/bazelbuild/rules_go/releases/download/0.16.2/rules_go-0.16.2.tar.gz"),
sha256 = "62ec3496a00445889a843062de9930c228b770218c735eca89c67949cd967c3f"
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

oh, a comma was dropped here

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

re-added the comma

@seemethere
Copy link
Contributor Author

seemethere commented Dec 14, 2018

Updated the test image as well!

Yeah the GOLANG_VERSION should probably just be driven by a top level file

@k8s-ci-robot k8s-ci-robot added sig/testing Categorizes an issue or PR as relevant to SIG Testing. and removed needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels Dec 14, 2018
@ixdy
Copy link
Member

ixdy commented Dec 14, 2018

The cross-build image is failing to build:

Step 7/12 : RUN echo "deb http://archive.ubuntu.com/ubuntu xenial main universe" > /etc/apt/sources.list.d/cgocrosscompiling.list   && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32   && apt-get update   && apt-get install -y build-essential   && for platform in ${KUBE_DYNAMIC_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done   && apt-get clean && rm -rf /var/lib/apt/lists/*
 ---> Running in 540f2d08fdbf
Warning: apt-key output should not be parsed (stdout is not a terminal)
Executing: /tmp/apt-key-gpghome.WdHS7PRkq5/gpg.1.sh --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32
gpg: cannot open '/dev/tty': No such device or address
The command '/bin/sh -c echo "deb http://archive.ubuntu.com/ubuntu xenial main universe" > /etc/apt/sources.list.d/cgocrosscompiling.list   && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32   && apt-get update   && apt-get install -y build-essential   && for platform in ${KUBE_DYNAMIC_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done   && apt-get clean && rm -rf /var/lib/apt/lists/*' returned a non-zero code: 2
Makefile:24: recipe for target 'build' failed

I'm not sure what is wrong. I can't build cross-build:v1.11.2-1 anymore either, so I don't think it's related to this change.

@ixdy
Copy link
Member

ixdy commented Dec 14, 2018

aha, just found https://stackoverflow.com/questions/53371626/apt-key-command-works-on-shell-but-fails-on-dockerfile.

Can you add --no-tty to the apt-key command in the Dockerfile?

basically this:

diff --git a/build/build-image/cross/Dockerfile b/build/build-image/cross/Dockerfile
index 8e4bc0f884..70e42cf87e 100644
--- a/build/build-image/cross/Dockerfile
+++ b/build/build-image/cross/Dockerfile
@@ -44,7 +44,7 @@ RUN apt-get update \
 # Use dynamic cgo linking for architectures other than amd64 for the server platforms
 # To install crossbuild essential for other architectures add the following repository.
 RUN echo "deb http://archive.ubuntu.com/ubuntu xenial main universe" > /etc/apt/sources.list.d/cgocrosscompiling.list \
-  && apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32 \
+  && apt-key adv --no-tty --keyserver keyserver.ubuntu.com --recv-keys 40976EAF437D05B5 3B4FE6ACC0B21F32 \
   && apt-get update \
   && apt-get install -y build-essential \
   && for platform in ${KUBE_DYNAMIC_CROSSPLATFORMS}; do apt-get install -y crossbuild-essential-${platform}; done \

@seemethere
Copy link
Contributor Author

Have added the --no-tty flag

@seemethere
Copy link
Contributor Author

/retest

1 similar comment
@cblecker
Copy link
Member

/retest

@ixdy
Copy link
Member

ixdy commented Dec 15, 2018

/lgtm
/priority important-soon

@k8s-ci-robot k8s-ci-robot added lgtm "Looks good to me", indicates that a PR is ready to be merged. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. and removed needs-priority Indicates a PR lacks a `priority/foo` label and requires one. labels Dec 15, 2018
@ixdy
Copy link
Member

ixdy commented Dec 15, 2018

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: ixdy, seemethere

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Dec 15, 2018
@k8s-ci-robot k8s-ci-robot merged commit 1513877 into kubernetes:master Dec 15, 2018
@ixdy ixdy mentioned this pull request Dec 15, 2018
k8s-ci-robot added a commit that referenced this pull request Dec 29, 2018
…pstream-release-1.13

Automated cherry pick of #72035 and #72084: bump golang to 1.11.4 (CVE-2018-16875)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/bug Categorizes issue or PR as related to a bug. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. priority/important-soon Must be staffed and worked on either currently, or very soon, ideally in time for the next release. release-note Denotes a PR that will be considered when it comes time to generate release notes. sig/testing Categorizes an issue or PR as relevant to SIG Testing. size/S Denotes a PR that changes 10-29 lines, ignoring generated files.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Update to go1.11.4
4 participants