Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[testing] move golangci-lint to github actions #3

Open
wants to merge 4 commits into
base: master
Choose a base branch
from
Open

[testing] move golangci-lint to github actions #3

wants to merge 4 commits into from

Conversation

thaJeztah
Copy link
Owner

- What I did

- How I did it

- How to verify it

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

@thaJeztah thaJeztah force-pushed the golangci_lint_action branch 3 times, most recently from a2ee4f5 to 6bd4475 Compare April 16, 2021 11:23
@thaJeztah
Copy link
Owner Author

getting closer;

[/home/runner/work/docker/docker/src/github.com/docker/docker/pkg/devicemapper/devmapper_log.go:5:8: could not import C (cgo preprocessing failed)] errors in package: [/home/runner/work/docker/docker/src/github.com/docker/docker/pkg/devicemapper/devmapper_log.go:5:8: could not import C (cgo preprocessing failed)]]"

@thaJeztah thaJeztah force-pushed the golangci_lint_action branch 12 times, most recently from 6ce98cd to 8287dd8 Compare April 16, 2021 22:57
@thaJeztah thaJeztah mentioned this pull request Apr 16, 2021
Closed
tianon
tianon reviewed Apr 19, 2021
View reviewed changes
Copy link

@tianon tianon left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nice! I like it 😄

.github/workflows/validate.yaml Outdated
Comment on lines 39 to 40
sudo apt -q update
sudo apt -q install \
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These are probably printing WARNING: apt does not have a stable CLI interface. Use with caution in scripts., so I'd suggest using apt-get here instead:

Suggested change
sudo apt -q update
sudo apt -q install \
sudo apt-get -q update
sudo apt-get -q install \

@tianon
Copy link

tianon commented Apr 19, 2021

Doh, managed to confuse my browser tabs and reviewed in the wrong place 🤦

@thaJeztah thaJeztah force-pushed the golangci_lint_action branch 4 times, most recently from 78dd19c to b0da8b5 Compare May 31, 2021 11:56
thaJeztah added 4 commits June 16, 2021 22:16
@thaJeztah
gosec: G306: Expect WriteFile permissions to be 0600 or less
daf4a13 
    pkg/pidfile/pidfile.go:43:12: G306: Expect WriteFile permissions to be 0600 or less (gosec)
        if err := ioutil.WriteFile(path, []byte(fmt.Sprintf("%d", os.Getpid())), 0644); err != nil {
                  ^
    pkg/plugins/pluginrpc-gen/main.go:82:33: G306: Expect WriteFile permissions to be 0600 or less (gosec)
        errorOut("error writing file", ioutil.WriteFile(*outputFile, src, 0644))
                                       ^
    testutil/fakecontext/context.go:99:9: G306: Expect WriteFile permissions to be 0600 or less (gosec)
        return ioutil.WriteFile(fp, content, 0644)
               ^
    daemon/graphdriver/graphtest/graphtest_unix.go:310:9: G306: Expect WriteFile permissions to be 0600 or less (gosec)
        return ioutil.WriteFile(path, data, 0700)
               ^
    layer/filestore.go:243:9: G306: Expect WriteFile permissions to be 0600 or less (gosec)
        return ioutil.WriteFile(fms.getMountFilename(mount, "mount-id"), []byte(mountID), 0644)
               ^
    layer/filestore.go:250:9: G306: Expect WriteFile permissions to be 0600 or less (gosec)
        return ioutil.WriteFile(fms.getMountFilename(mount, "init-id"), []byte(init), 0644)
               ^

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah
golang-ci: update to 1.40.1 and update to use new config options
f0be371 
Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah
golangci.yml: replace golint with revive as it is deprecated
7c1fdaf 
    WARN [runner] The linter 'golint' is deprecated (since v1.41.0) due to: The repository of the linter has been archived by the owner.  Replaced by revive.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah
move golangci-lint to github actions
c24a8ac 
Signed-off-by: Sebastiaan van Stijn <[email protected]>
@thaJeztah thaJeztah force-pushed the golangci_lint_action branch from b0da8b5 to c24a8ac Compare June 16, 2021 20:29
thaJeztah added a commit that referenced this pull request Mar 14, 2024
@thaJeztah
vendor: google.golang.org/protobuf v1.33.0, github.com/golang/protobu…
1ca89d7 
…f v1.5.4

full diffs:

- protocolbuffers/protobuf-go@v1.31.0...v1.33.0
- golang/protobuf@v1.5.3...v1.5.4

From the Go security announcement list;

> Version v1.33.0 of the google.golang.org/protobuf module fixes a bug in
> the google.golang.org/protobuf/encoding/protojson package which could cause
> the Unmarshal function to enter an infinite loop when handling some invalid
> inputs.
>
> This condition could only occur when unmarshaling into a message which contains
> a google.protobuf.Any value, or when the UnmarshalOptions.UnmarshalUnknown
> option is set. Unmarshal now correctly returns an error when handling these
> inputs.
>
> This is CVE-2024-24786.

In a follow-up post;

> A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown
> option is set (as well as when unmarshaling into any message which contains a
> google.protobuf.Any). There is no UnmarshalUnknown option.
>
> In addition, version 1.33.0 of google.golang.org/protobuf inadvertently
> introduced an incompatibility with the older github.com/golang/protobuf
> module. (golang/protobuf#1596) Users of the older
> module should update to github.com/golang/[email protected].

govulncheck results in our code:

    govulncheck ./...
    Scanning your code and 1221 packages across 204 dependent modules for known vulnerabilities...

    === Symbol Results ===

    Vulnerability #1: GO-2024-2611
        Infinite loop in JSON unmarshaling in google.golang.org/protobuf
      More info: https://pkg.go.dev/vuln/GO-2024-2611
      Module: google.golang.org/protobuf
        Found in: google.golang.org/[email protected]
        Fixed in: google.golang.org/[email protected]
        Example traces found:
          #1: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Peek
          #2: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Read
          #3: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls protojson.Unmarshal

    Your code is affected by 1 vulnerability from 1 module.
    This scan found no other vulnerabilities in packages you import or modules you
    require.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
thaJeztah added a commit that referenced this pull request Jun 3, 2024
@thaJeztah @austinvazquez
vendor: google.golang.org/protobuf v1.33.0, github.com/golang/protobu…
3d56d73 
…f v1.5.4

full diffs:

- protocolbuffers/protobuf-go@v1.31.0...v1.33.0
- golang/protobuf@v1.5.3...v1.5.4

From the Go security announcement list;

> Version v1.33.0 of the google.golang.org/protobuf module fixes a bug in
> the google.golang.org/protobuf/encoding/protojson package which could cause
> the Unmarshal function to enter an infinite loop when handling some invalid
> inputs.
>
> This condition could only occur when unmarshaling into a message which contains
> a google.protobuf.Any value, or when the UnmarshalOptions.UnmarshalUnknown
> option is set. Unmarshal now correctly returns an error when handling these
> inputs.
>
> This is CVE-2024-24786.

In a follow-up post;

> A small correction: This vulnerability applies when the UnmarshalOptions.DiscardUnknown
> option is set (as well as when unmarshaling into any message which contains a
> google.protobuf.Any). There is no UnmarshalUnknown option.
>
> In addition, version 1.33.0 of google.golang.org/protobuf inadvertently
> introduced an incompatibility with the older github.com/golang/protobuf
> module. (golang/protobuf#1596) Users of the older
> module should update to github.com/golang/[email protected].

govulncheck results in our code:

    govulncheck ./...
    Scanning your code and 1221 packages across 204 dependent modules for known vulnerabilities...

    === Symbol Results ===

    Vulnerability #1: GO-2024-2611
        Infinite loop in JSON unmarshaling in google.golang.org/protobuf
      More info: https://pkg.go.dev/vuln/GO-2024-2611
      Module: google.golang.org/protobuf
        Found in: google.golang.org/[email protected]
        Fixed in: google.golang.org/[email protected]
        Example traces found:
          #1: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Peek
          #2: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Read
          #3: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls protojson.Unmarshal

    Your code is affected by 1 vulnerability from 1 module.
    This scan found no other vulnerabilities in packages you import or modules you
    require.

Signed-off-by: Sebastiaan van Stijn <[email protected]>
(cherry picked from commit 1ca89d7)
Signed-off-by: Austin Vazquez <[email protected]>
thaJeztah pushed a commit that referenced this pull request Jun 3, 2024
@aepifanov
vendor: bump google.golang.org/grpc to v1.56.3 and google.golang.org/…
f4e7362 
…protobuf to v1.33.0

These vulnerabilities were found by govulncheck:

Vulnerability #1: GO-2024-2611
    Infinite loop in JSON unmarshaling in google.golang.org/protobuf
  More info: https://pkg.go.dev/vuln/GO-2024-2611
  Module: google.golang.org/protobuf
    Found in: google.golang.org/[email protected]
    Fixed in: google.golang.org/[email protected]
    Example traces found:
      #1: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Peek
      #2: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls json.Decoder.Read
      #3: daemon/logger/gcplogs/gcplogging.go:154:18: gcplogs.New calls logging.Client.Ping, which eventually calls protojson.Unmarshal

Vulnerability #2: GO-2023-2153
    Denial of service from HTTP/2 Rapid Reset in google.golang.org/grpc
  More info: https://pkg.go.dev/vuln/GO-2023-2153
  Module: google.golang.org/grpc
    Found in: google.golang.org/[email protected]
    Fixed in: google.golang.org/[email protected]
    Example traces found:
      #1: api/server/router/grpc/grpc.go:20:29: grpc.NewRouter calls grpc.NewServer
      #2: daemon/daemon.go:1477:23: daemon.Daemon.RawSysInfo calls sync.Once.Do, which eventually calls grpc.Server.Serve
      #3: daemon/daemon.go:1477:23: daemon.Daemon.RawSysInfo calls sync.Once.Do, which eventually calls transport.NewServerTransport

full diffs:
 - https://github.com/grpc/grpc-go/compare/v1.50.1..v1.56.3
 - https://github.com/protocolbuffers/protobuf-go/compare/v1.28.1..v1.33.0
 - https://github.com/googleapis/google-api-go-client/compare/v0.93.0..v0.114.0
 - https://github.com/golang/oauth2/compare/v0.1.0..v0.7.0
 - https://github.com/census-instrumentation/opencensus-go/compare/v0.23.0..v0.24.0
 - https://github.com/googleapis/gax-go/compare/v2.4.0..v2.7.1
 - https://github.com/googleapis/enterprise-certificate-proxy/compare/v0.1.0..v0.2.3
 - https://github.com/golang/protobuf/compare/v1.5.2..v1.5.4
 - https://github.com/cespare/xxhash/compare/v2.1.2..v2.2.0
 - https://github.com/googleapis/google-cloud-go/compare/v0.102.1..v0.110.0
 - https://github.com/googleapis/go-genproto v0.0.0-20230410155749-daa745c078e1
 - https://github.com/googleapis/google-cloud-go/compare/logging/v1.4.2..logging/v1.7.0
 - https://github.com/googleapis/google-cloud-go/compare/compute/v1.7.0..compute/v1.19.1

Signed-off-by: Andrey Epifanov <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@tianon tianon tianon left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@thaJeztah @tianon