[release/1.6 backport] update to go1.21.3, go1.20.10 #9226
Closed
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Tests in pkg/cri/[sb]server/container_create_linux_test.go depends on go:noinline since Go 1.21. e.g., > ``` > === FAIL: pkg/cri/sbserver TestGenerateSeccompSecurityProfileSpecOpts/should_set_default_seccomp_when_seccomp_is_runtime/default (0.00s) > container_create_linux_test.go:1013: > Error Trace: /home/runner/work/containerd/containerd/pkg/cri/sbserver/container_create_linux_test.go:1013 > Error: Not equal: > expected: 0x263d880 > actual : 0x263cbc0 > Test: TestGenerateSeccompSecurityProfileSpecOpts/should_set_default_seccomp_when_seccomp_is_runtime/default > ``` See comments in PR 8957. Thanks to Wei Fu for analyzing this. Co-authored-by: Wei Fu <[email protected]> Signed-off-by: Akihiro Suda <[email protected]> (cherry picked from commit 0f043ae) Signed-off-by: Sebastiaan van Stijn <[email protected]>
The default version of MinGW and GCC on the GitHub-hosted Windows 2019 runners compile fine but lead to linker errors during runtime. Signed-off-by: Nashwan Azhari <[email protected]> (cherry picked from commit c883410) Signed-off-by: Sebastiaan van Stijn <[email protected]>
Signed-off-by: Akihiro Suda <[email protected]> (cherry picked from commit 5756cb0) Signed-off-by: Sebastiaan van Stijn <[email protected]>
This reverts commit a2c2948. Signed-off-by: Sebastiaan van Stijn <[email protected]>
https://go.dev/doc/go1.21 Signed-off-by: Akihiro Suda <[email protected]> (cherry picked from commit eacd74c) Signed-off-by: Sebastiaan van Stijn <[email protected]>
|
Skipping CI for Draft Pull Request. |
Signed-off-by: Wei Fu <[email protected]> (cherry picked from commit 1dced31) Signed-off-by: Sebastiaan van Stijn <[email protected]>
go1.21.1 (released 2023-09-06) includes four security fixes to the cmd/go, crypto/tls, and html/template packages, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the context, crypto/tls, encoding/gob, encoding/xml, go/types, net/http, os, and path/filepath packages. See the Go 1.21.1 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.21.1+label%3ACherryPickApproved full diff: golang/go@go1.21.0...go1.21.1 From the security mailing: [security] Go 1.21.1 and Go 1.20.8 are released Hello gophers, We have just released Go versions 1.21.1 and 1.20.8, minor point releases. These minor releases include 4 security fixes following the security policy: - cmd/go: go.mod toolchain directive allows arbitrary execution The go.mod toolchain directive, introduced in Go 1.21, could be leveraged to execute scripts and binaries relative to the root of the module when the "go" command was executed within the module. This applies to modules downloaded using the "go" command from the module proxy, as well as modules downloaded directly using VCS software. Thanks to Juho Nurminen of Mattermost for reporting this issue. This is CVE-2023-39320 and Go issue https://go.dev/issue/62198. - html/template: improper handling of HTML-like comments within script contexts The html/template package did not properly handle HMTL-like "<!--" and "-->" comment tokens, nor hashbang "#!" comment tokens, in <script> contexts. This may cause the template parser to improperly interpret the contents of <script> contexts, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2023-39318 and Go issue https://go.dev/issue/62196. - html/template: improper handling of special tags within script contexts The html/template package did not apply the proper rules for handling occurrences of "<script", "<!--", and "</script" within JS literals in <script> contexts. This may cause the template parser to improperly consider script contexts to be terminated early, causing actions to be improperly escaped. This could be leveraged to perform an XSS attack. Thanks to Takeshi Kaneko (GMO Cybersecurity by Ierae, Inc.) for reporting this issue. This is CVE-2023-39319 and Go issue https://go.dev/issue/62197. - crypto/tls: panic when processing post-handshake message on QUIC connections Processing an incomplete post-handshake message for a QUIC connection caused a panic. Thanks to Marten Seemann for reporting this issue. This is CVE-2023-39321 and CVE-2023-39322 and Go issue https://go.dev/issue/62266. Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit eaf6071) Signed-off-by: Sebastiaan van Stijn <[email protected]>
go1.21.2 (released 2023-10-05) includes one security fixes to the cmd/go package, as well as bug fixes to the compiler, the go command, the linker, the runtime, and the runtime/metrics package. See the Go 1.21.2 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.21.2+label%3ACherryPickApproved full diff: golang/go@go1.21.1...go1.21.2 From the security mailing: [security] Go 1.21.2 and Go 1.20.9 are released Hello gophers, We have just released Go versions 1.21.2 and 1.20.9, minor point releases. These minor releases include 1 security fixes following the security policy: - cmd/go: line directives allows arbitrary execution during build "//line" directives can be used to bypass the restrictions on "//go:cgo_" directives, allowing blocked linker and compiler flags to be passed during compliation. This can result in unexpected execution of arbitrary code when running "go build". The line directive requires the absolute path of the file in which the directive lives, which makes exploting this issue significantly more complex. This is CVE-2023-39323 and Go issue https://go.dev/issue/63211. Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 6b752b5) Signed-off-by: Sebastiaan van Stijn <[email protected]>
go1.21.3 (released 2023-10-10) includes a security fix to the net/http package. See the Go 1.21.3 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.21.3+label%3ACherryPickApproved full diff: golang/go@go1.21.2...go1.21.3 From the security mailing: [security] Go 1.21.3 and Go 1.20.10 are released Hello gophers, We have just released Go versions 1.21.3 and 1.20.10, minor point releases. These minor releases include 1 security fixes following the security policy: - net/http: rapid stream resets can cause excessive work A malicious HTTP/2 client which rapidly creates requests and immediately resets them can cause excessive server resource consumption. While the total number of requests is bounded to the http2.Server.MaxConcurrentStreams setting, resetting an in-progress request allows the attacker to create a new request while the existing one is still executing. HTTP/2 servers now bound the number of simultaneously executing handler goroutines to the stream concurrency limit. New requests arriving when at the limit (which can only happen after the client has reset an existing, in-flight request) will be queued until a handler exits. If the request queue grows too large, the server will terminate the connection. This issue is also fixed in golang.org/x/net/http2 v0.17.0, for users manually configuring HTTP/2. The default stream concurrency limit is 250 streams (requests) per HTTP/2 connection. This value may be adjusted using the golang.org/x/net/http2 package; see the Server.MaxConcurrentStreams setting and the ConfigureServer function. This is CVE-2023-39325 and Go issue https://go.dev/issue/63417. This is also tracked by CVE-2023-44487. Signed-off-by: Sebastiaan van Stijn <[email protected]> (cherry picked from commit 313f514) Signed-off-by: Sebastiaan van Stijn <[email protected]>
thaJeztah
force-pushed
the
1.6_backport_update_golang_1.21.3
branch
from
00930e9 to
bf705c8
Compare
akhilerm
reviewed
Oct 13, 2023
| @@ -6,7 +6,7 @@ on: | |||
| name: Containerd Release | |||
|
|
|||
| env: | |||
| GO_VERSION: "1.20.8" | |||
| GO_VERSION: "1.21.3" | |||
There was a problem hiding this comment.
Shouldnt this be 1.20.10 ?
If we are releasing the binaries with 1.21.3, does it make sense to run the CI with 1.20.8 also in the matrix?
There was a problem hiding this comment.
I think we should use go1.20.10 here. The go1.20 is more stable than go1.21.x unless some dependencies neeed go1.21.
estesp
approved these changes
Oct 13, 2023
|
Hm.. so, I guess I completely interpret the original intent in reverse; and "build binaries with go1.21" had the intent to "verify binaries also work with go1.21", but not to build (and release) binaries with go1.21. Let me move this to draft to prevent trigger-happy merges, pending further discussion |
|
Sorry for the confusion on that. I probably should have added more context to #9180. It was a direct cherry-pick of #9167. The immediate reason for the change was to fix flaky tests with windows-2019 and go 1.19. I'm not sure if the original intention was to solve more than just that problem. There's some more context in slack (but that really should have translated into the codebase itself). https://cloud-native.slack.com/archives/CGEQHPYF4/p1695915034690419 |
|
No worries! I should read more carefully 😂 It was just the PR title that confused me, and I somehow completely interpreted it as the reverse (thought we were building with 1.21, but all the test continuing on go1.20.. which felt "off") I'll prepare another / alternative PR to update to go1.20.10 (for the security fix); I'll keep this one in draft for now, for when we're ready to update to go1.21 😄 |
|
PR needs rebase. Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
This PR is stale because it has been open 90 days with no activity. This PR will be closed in 7 days unless new comments are made or the stale label is removed. |
|
This PR was closed because it has been stalled for 7 days with no activity. |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
(partial) backports of: