Skip to content

Commit 0ffcbf1

Browse files
spathlavathkb-newrelicgmanandhar-nrpkulkarni-newrelicgithub-actions[bot]
authored
Sync upstream updates (#32)
* fix: allow windows style storage paths (newrelic#158) This commit fixes two critical security issues identified by the security team: 1. TOCTOU Race Condition: Added symlink re-validation immediately before write operations in fileStorage.Save() to prevent attackers from creating symlinks between validation and file write. 2. Permission Error Bypass: Removed silent bypassing of permission errors during symlink validation. Now returns an error if path security cannot be verified, preventing potential attacks through unreadable directories. Changes: - Enhanced fileStorage struct with allowedBaseDir and skipValidation fields - Added newFileStorageForTesting() for test isolation - Implemented symlink re-validation before write operations - Removed permission error bypass in checkPathForSymlinks() - Added comprehensive tests: TestTOCTOUProtection and TestPermissionErrorHandling All existing tests pass. No breaking changes to public API or behavior. --------- Co-authored-by: gmanandhar-nr <gmanandhar@newrelic.com> Co-authored-by: Palash Kulkarni <pkulkarni@newrelic.com> * feat: remove processor from atp type name (newrelic#153) * feat: remove processor from atp type name * docs: add PR to existing atp changelog * docs: update changelog entry * docs: update chloggen entry for atp (newrelic#151) * [chore] Prepare release 0.142.2 (newrelic#162) * [chore] Prepare release 0.143.0 (newrelic#168) * ci: pin OTel collector to highest release tag at candidate minor version When preparing a release with SYNC_UPSTREAM=true, checkout the highest published tag of opentelemetry-collector matching the candidate minor version before running multimod sync. This ensures the collector beta modules (e.g. v0.143.0) are paired with the highest stable patch release of the collector at that minor, rather than an arbitrary main HEAD that may contain unreleased development work. Falls back to HEAD with a warning if no matching tag exists. * [chore] multimod update stable modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] multimod update beta modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] update contrib modules to v0.143.0 Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] mod and toolchain tidy Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * update core modules list * changelog update 0.143.0 * update version.yaml 0.143.0 * builder config changes 0.143.0 * Prepare beta for version v0.143.0 * fix: patch GO-2026-4394 by pinning otel/sdk to v1.40.0 * chore: run gotidy to sync transitive otel/sdk version bump --------- Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Mailo Arsac <marsac@newrelic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] Prepare release 0.144.0 (newrelic#170) * [chore] multimod update stable modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] multimod update beta modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] update contrib modules to v0.144.0 Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] mod and toolchain tidy Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * update core modules list * changelog update 0.144.0 * update version.yaml 0.144.0 * builder config changes 0.144.0 * Prepare beta for version v0.144.0 * fix: update confighttp.ServerConfig.Endpoint to NetAddr for v0.144.0 --------- Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Mailo Arsac <marsac@newrelic.com> * [chore] Prepare release 0.145.0 (newrelic#171) * [chore] multimod update stable modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] multimod update beta modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] update contrib modules to v0.145.0 Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] mod and toolchain tidy Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * update core modules list * changelog update 0.145.0 * update version.yaml 0.145.0 * builder config changes 0.145.0 * Prepare beta for version v0.145.0 --------- Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] Prepare release 0.146.0 (newrelic#172) * [chore] multimod update stable modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] multimod update beta modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] update contrib modules to v0.146.0 Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] mod and toolchain tidy Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * update core modules list * changelog update 0.146.0 * update version.yaml 0.146.0 * builder config changes 0.146.0 * Prepare beta for version v0.146.0 * remove otel sdk replace directives for GO-2026-4394 * fix: update correctness test PICT files for otlp_grpc rename in v0.146.0 --------- Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: Mailo Arsac <marsac@newrelic.com> * [chore] Prepare release 0.147.0 (newrelic#173) * [chore] multimod update stable modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] multimod update beta modules Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] update contrib modules to v0.147.0 Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] mod and toolchain tidy Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * update core modules list * changelog update 0.147.0 * update version.yaml 0.147.0 * builder config changes 0.147.0 * Prepare beta for version v0.147.0 --------- Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> * [chore] automatically generate third party notice overrides (newrelic#159) * ci: autobump golang when updating otel (newrelic#176) * [chore] autobump golang (newrelic#178) * chore: autobump golang when updating otel * trigger checks * use sed syntax that is portable to both mac and linux (which github actions uses) * move logic out into script and add a os check * Apply suggestions from code review Co-authored-by: kb-newrelic <121687305+kb-newrelic@users.noreply.github.com> * move sed_inplace function out of find statement for clarity --------- Co-authored-by: kb-newrelic <121687305+kb-newrelic@users.noreply.github.com> * chore(ci): fix license paths on windows (newrelic#182) --------- Signed-off-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: kb-newrelic <121687305+kb-newrelic@users.noreply.github.com> Co-authored-by: gmanandhar-nr <gmanandhar@newrelic.com> Co-authored-by: Palash Kulkarni <pkulkarni@newrelic.com> Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Mailo Arsac <marsac@newrelic.com> Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com> Co-authored-by: agarvin-nr <agarvin@newrelic.com> Co-authored-by: Emilia Ferreyra <110185663+emiliaFer@users.noreply.github.com>
1 parent b77d6a6 commit 0ffcbf1

56 files changed

Lines changed: 2528 additions & 1605 deletions

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

.chloggen/config.yaml

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -9,8 +9,12 @@ summary_template: .chloggen/summary.tmpl
99
components:
1010
- all
1111
- cmd/codecovgen
12-
- exporter/nopexporter
12+
- cmd/nrdotcol
13+
- cmd/oteltestbedcol
14+
- exporter/nop
1315
- internal/common
1416
- internal/coreinternal
15-
- receiver/nopreceiver
17+
- internal/tools
18+
- processor/adaptivetelemetry
19+
- receiver/nop
1620
- testbed

.chloggen/feature_atp.yaml

Lines changed: 0 additions & 27 deletions
This file was deleted.

.github/actionlint.yaml

Lines changed: 3 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,9 +1,8 @@
1-
self-hosted-runner:
2-
labels:
3-
- oracle-bare-metal-64cpu-512gb-x86-64
4-
51
config-variables: null
62

73
paths:
84
.github/workflows/**/*.{yml,yaml}:
95
ignore:
6+
# only report warning/errors
7+
- 'SC\d+:info'
8+
- 'SC\d+:style'

.github/lychee.toml

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,13 @@ exclude = [
88
"^https://dev.mysql.com",
99
"^https://bugs.mysql.com",
1010
"^https://techdocs.akamai.com",
11-
"^https://www.vultr.com"
11+
"^https://www.vultr.com",
12+
# disabled
13+
"^https://github.com/newrelic/nrdot-collector-components/discussions",
14+
# private org links
15+
"^https://www.github.com/newrelic/dbi",
16+
"^https://www.github.com/newrelic/ohai"
17+
1218
]
1319

1420
# better to be safe and avoid failures

.github/workflows/build-and-test.yml

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -71,7 +71,6 @@ jobs:
7171
id: go-setup
7272
with:
7373
go-version: oldstable
74-
cache-dependency-path: "**/*.sum"
7574
- name: Install dependencies
7675
if: steps.go-setup.outputs.cache-hit != 'true'
7776
run: make -j2 gomoddownload

.github/workflows/changelog.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -67,10 +67,10 @@ jobs:
6767
- name: Ensure ./.chloggen/*.yaml addition(s)
6868
if: ${{ !contains(github.event.pull_request.labels.*.name, 'dependencies') && !contains(github.event.pull_request.labels.*.name, 'Skip Changelog') && !contains(github.event.pull_request.title, '[chore]')}}
6969
run: |
70-
if [[ 1 -gt "$(git diff --diff-filter=A --name-only "$(git merge-base origin/main "$PR_HEAD")" "$PR_HEAD" ./.chloggen | grep -c \\.yaml)" ]]
70+
if [[ 1 -gt "$(git diff --diff-filter=AM --name-only "$(git merge-base origin/main "$PR_HEAD")" "$PR_HEAD" ./.chloggen | grep -c \\.yaml)" ]]
7171
then
72-
echo "No changelog entry was added to the ./.chloggen/ directory."
73-
echo "Please add a .yaml file to the ./.chloggen/ directory."
72+
echo "No changelog entry was added or changed in the ./.chloggen/ directory."
73+
echo "Please add or edit an existing .yaml file in the ./.chloggen/ directory."
7474
echo "See CONTRIBUTING.md for more details."
7575
echo "Alternately, add either \"[chore]\" to the title of the pull request or add the \"Skip Changelog\" label if this job should be skipped."
7676
false

.github/workflows/scoped-test.yaml

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,6 @@ jobs:
1919
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
2020
with:
2121
fetch-depth: 0
22-
2322
- name: Get changes
2423
shell: bash
2524
id: changes
@@ -69,6 +68,8 @@ jobs:
6968
echo "go_sources: ${{ needs.changedfiles.outputs.go_sources }}"
7069
echo "go_tests: ${{ needs.changedfiles.outputs.go_tests }}"
7170
- uses: actions/checkout@93cb6efe18208431cddfb8368fd83d5badbf9bfd # v5
71+
with:
72+
fetch-depth: 0
7273
- run: ./.github/workflows/scripts/free-disk-space.sh
7374
- uses: actions/setup-go@44694675825211faa026b3c33043df3e48a5fa00 # v6
7475
id: go-setup

.github/workflows/scripts/release-prepare-release.sh

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,24 @@ BRANCH="prepare-release-prs/${CANDIDATE_BETA}"
2727
git checkout -b "${BRANCH}"
2828

2929
if [[ ${SYNC_UPSTREAM} == "true" ]]; then
30+
# Resolve the highest published OTel release tag at the candidate minor version so that
31+
# multimod sync operates against a known stable release rather than a floating main HEAD.
32+
# We query the Go module proxy directly rather than relying on local git tags, since a
33+
# shallow clone will not have historical tags for older minor versions.
34+
CANDIDATE_MINOR=$(echo "${CANDIDATE_BETA}" | cut -d. -f1-2)
35+
HIGHEST_OTEL_VERSION=$(cd cmd/nrdotcol && go list -m -versions go.opentelemetry.io/collector 2>/dev/null \
36+
| tr ' ' '\n' | grep "^v${CANDIDATE_MINOR}\." | grep -v -- '-' | sort -V | tail -1)
37+
if [[ -n "${HIGHEST_OTEL_VERSION}" ]]; then
38+
echo "Using OTel collector version: ${HIGHEST_OTEL_VERSION}"
39+
pushd ../opentelemetry-collector
40+
git fetch --depth=1 origin "refs/tags/${HIGHEST_OTEL_VERSION}:refs/tags/${HIGHEST_OTEL_VERSION}"
41+
git checkout "${HIGHEST_OTEL_VERSION}"
42+
popd
43+
else
44+
echo "Error: No published version found for v${CANDIDATE_MINOR}.x on the Go module proxy"
45+
exit 1
46+
fi
47+
3048
# If the version is blank, multimod will use the version from upstream versions.yaml
3149
make update-otel OTEL_VERSION="" OTEL_STABLE_VERSION="" CONTRIB_VERSION=""
3250

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
#!/bin/bash
2+
set -e
3+
4+
VERSION=''
5+
6+
while getopts v: flag
7+
do
8+
case "${flag}" in
9+
v) VERSION=${OPTARG};;
10+
*) exit 1;;
11+
esac
12+
done
13+
14+
if [ -z "$VERSION" ]; then
15+
echo "Error: VERSION is required"
16+
echo "Usage: $0 -v <version>"
17+
exit 1
18+
fi
19+
20+
echo "Bumping Go version to $VERSION..."
21+
22+
# Determine the OS and set the sed function accordingly
23+
if [[ "$OSTYPE" == "darwin"* ]]; then
24+
# macOS
25+
sed_inplace() {
26+
sed -i '' "$@"
27+
}
28+
else
29+
# Linux
30+
sed_inplace() {
31+
sed -i "$@"
32+
}
33+
fi
34+
35+
# Find all go.mod files
36+
echo "Finding all go.mod files..."
37+
GO_MOD_FILES=$(find . -name "go.mod" -type f)
38+
39+
# Update all go.mod files
40+
echo "Updating all go.mod files..."
41+
while IFS= read -r file; do
42+
sed_inplace -E "s/^go [0-9]+\.[0-9]+.*/go $VERSION/g" "$file"
43+
done <<< "$GO_MOD_FILES"
44+
45+
echo ""
46+
echo "✓ Successfully bumped golang version to $VERSION"
47+
echo ""

.github/workflows/update-otel.yaml

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -46,6 +46,7 @@ jobs:
4646
exec > >(tee log.out) 2>&1
4747
LAST_COMMIT="$(git -C ./opentelemetry-collector/ rev-parse HEAD)"
4848
LAST_CONTRIB_COMMIT="$(git -C ./opentelemetry-collector-contrib/ rev-parse HEAD)"
49+
GO_VERSION="$(grep '^go ' ./opentelemetry-collector/service/go.mod | awk '{print $2}')"
4950
cd nrdot-collector-components
5051
git config user.name "github-actions[bot]"
5152
git config user.email "github-actions[bot]@users.noreply.github.com"
@@ -54,6 +55,7 @@ jobs:
5455
make gennrdotcol
5556
echo "LAST_COMMIT=$LAST_COMMIT" >> "$GITHUB_ENV"
5657
echo "LAST_CONTRIB_COMMIT=$LAST_CONTRIB_COMMIT" >> "$GITHUB_ENV"
58+
echo "GO_VERSION=$GO_VERSION" >> "$GITHUB_ENV"
5759
echo "BRANCH_NAME=$branch" >> "$GITHUB_ENV"
5860
- name: Gets packages from links with retries
5961
uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
@@ -64,7 +66,7 @@ jobs:
6466
retry_on: error
6567
command: |
6668
cd nrdot-collector-components
67-
make update-otel OTEL_STABLE_VERSION=${{ env.LAST_COMMIT }} OTEL_VERSION=${{ env.LAST_COMMIT }} CONTRIB_VERSION=${{ env.LAST_CONTRIB_COMMIT }}
69+
make update-otel OTEL_STABLE_VERSION=${{ env.LAST_COMMIT }} OTEL_VERSION=${{ env.LAST_COMMIT }} CONTRIB_VERSION=${{ env.LAST_CONTRIB_COMMIT }} GO_VERSION=${{ env.GO_VERSION }}
6870
- name: Push and create PR
6971
run: |
7072
cd nrdot-collector-components

0 commit comments

Comments
 (0)