Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

chore: update go (major) #1346

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

freiheit-kuberpult-upgrader
Copy link
Collaborator

@freiheit-kuberpult-upgrader freiheit-kuberpult-upgrader commented Feb 16, 2024

This PR contains the following updates:

Package Type Update Change
github.com/MicahParks/keyfunc/v2 require major v2.1.0 -> v3.3.5
github.com/ProtonMail/go-crypto require major v0.0.0-20230923063757-afb1ddc0824c -> v1.1.2
github.com/golang-jwt/jwt/v4 require major v4.5.0 -> v5.2.1
github.com/grpc-ecosystem/go-grpc-middleware require major v1.4.0 -> v2.1.0
k8s.io/client-go replace major v0.26.11 -> v11.0.0+incompatible

Release Notes

ProtonMail/go-crypto

v1.1.2

Compare Source

v1.1.1

Compare Source

v1.1.0

Compare Source

golang-jwt/jwt

v5.2.1

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.2.0...v5.2.1

v5.2.0

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.1.0...v5.2.0

v5.1.0

Compare Source

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v5.0.0...v5.1.0

v5.0.0

Compare Source

🚀 New Major Version v5 🚀

It's finally here, the release you have been waiting for! We don't take breaking changes lightly, but the changes outlined below were necessary to address some of the challenges of the previous API. A big thanks for @​mfridman for all the reviews, all contributors for their commits and of course @​dgrijalva for the original code. I hope we kept some of the spirit of your original v4 branch alive in the approach we have taken here.
~@​oxisto, on behalf of @​golang-jwt/maintainers

Version v5 contains a major rework of core functionalities in the jwt-go library. This includes support for several validation options as well as a re-design of the Claims interface. Lastly, we reworked how errors work under the hood, which should provide a better overall developer experience.

Starting from v5.0.0, the import path will be:

"github.com/golang-jwt/jwt/v5"

For most users, changing the import path should suffice. However, since we intentionally changed and cleaned some of the public API, existing programs might need to be updated. The following sections describe significant changes and corresponding updates for existing programs.

Parsing and Validation Options

Under the hood, a new validator struct takes care of validating the claims. A long awaited feature has been the option to fine-tune the validation of tokens. This is now possible with several ParserOption functions that can be appended to most Parse functions, such as ParseWithClaims. The most important options and changes are:

  • Added WithLeeway to support specifying the leeway that is allowed when validating time-based claims, such as exp or nbf.
  • Changed default behavior to not check the iat claim. Usage of this claim is OPTIONAL according to the JWT RFC. The claim itself is also purely informational according to the RFC, so a strict validation failure is not recommended. If you want to check for sensible values in these claims, please use the WithIssuedAt parser option.
  • Added WithAudience, WithSubject and WithIssuer to support checking for expected aud, sub and iss.
  • Added WithStrictDecoding and WithPaddingAllowed options to allow previously global settings to enable base64 strict encoding and the parsing of base64 strings with padding. The latter is strictly speaking against the standard, but unfortunately some of the major identity providers issue some of these incorrect tokens. Both options are disabled by default.

Changes to the Claims interface

Complete Restructuring

Previously, the claims interface was satisfied with an implementation of a Valid() error function. This had several issues:

  • The different claim types (struct claims, map claims, etc.) then contained similar (but not 100 % identical) code of how this validation was done. This lead to a lot of (almost) duplicate code and was hard to maintain
  • It was not really semantically close to what a "claim" (or a set of claims) really is; which is a list of defined key/value pairs with a certain semantic meaning.

Since all the validation functionality is now extracted into the validator, all VerifyXXX and Valid functions have been removed from the Claims interface. Instead, the interface now represents a list of getters to retrieve values with a specific meaning. This allows us to completely decouple the validation logic with the underlying storage representation of the claim, which could be a struct, a map or even something stored in a database.

type Claims interface {
	GetExpirationTime() (*NumericDate, error)
	GetIssuedAt() (*NumericDate, error)
	GetNotBefore() (*NumericDate, error)
	GetIssuer() (string, error)
	GetSubject() (string, error)
	GetAudience() (ClaimStrings, error)
}
Supported Claim Types and Removal of StandardClaims

The two standard claim types supported by this library, MapClaims and RegisteredClaims both implement the necessary functions of this interface. The old StandardClaims struct, which has already been deprecated in v4 is now removed.

Users using custom claims, in most cases, will not experience any changes in the behavior as long as they embedded RegisteredClaims. If they created a new claim type from scratch, they now need to implemented the proper getter functions.

Migrating Application Specific Logic of the old Valid

Previously, users could override the Valid method in a custom claim, for example to extend the validation with application-specific claims. However, this was always very dangerous, since once could easily disable the standard validation and signature checking.

In order to avoid that, while still supporting the use-case, a new ClaimsValidator interface has been introduced. This interface consists of the Validate() error function. If the validator sees, that a Claims struct implements this interface, the errors returned to the Validate function will be appended to the regular standard validation. It is not possible to disable the standard validation anymore (even only by accident).

Usage examples can be found in example_test.go, to build claims structs like the following.

// MyCustomClaims includes all registered claims, plus Foo.
type MyCustomClaims struct {
	Foo string `json:"foo"`
	jwt.RegisteredClaims
}

// Validate can be used to execute additional application-specific claims
// validation.
func (m MyCustomClaims) Validate() error {
	if m.Foo != "bar" {
		return errors.New("must be foobar")
	}

	return nil
}

Changes to the Token and Parser struct

The previously global functions DecodeSegment and EncodeSegment were moved to the Parser and Token struct respectively. This will allow us in the future to configure the behavior of these two based on options supplied on the parser or the token (creation). This also removes two previously global variables and moves them to parser options WithStrictDecoding and WithPaddingAllowed.

In order to do that, we had to adjust the way signing methods work. Previously they were given a base64 encoded signature in Verify and were expected to return a base64 encoded version of the signature in Sign, both as a string. However, this made it necessary to have DecodeSegment and EncodeSegment global and was a less than perfect design because we were repeating encoding/decoding steps for all signing methods. Now, Sign and Verify operate on a decoded signature as a []byte, which feels more natural for a cryptographic operation anyway. Lastly, Parse and SignedString take care of the final encoding/decoding part.

In addition to that, we also changed the Signature field on Token from a string to []byte and this is also now populated with the decoded form. This is also more consistent, because the other parts of the JWT, mainly Header and Claims were already stored in decoded form in Token. Only the signature was stored in base64 encoded form, which was redundant with the information in the Raw field, which contains the complete token as base64.

type Token struct {
	Raw       string                 // Raw contains the raw token
	Method    SigningMethod          // Method is the signing method used or to be used
	Header    map[string]interface{} // Header is the first segment of the token in decoded form
	Claims    Claims                 // Claims is the second segment of the token in decoded form
	Signature []byte                 // Signature is the third segment of the token in decoded form
	Valid     bool                   // Valid specifies if the token is valid
}

Most (if not all) of these changes should not impact the normal usage of this library. Only users directly accessing the Signature field as well as developers of custom signing methods should be affected.

What's Changed

New Contributors

Full Changelog: golang-jwt/jwt@v4.5.0...v5.0.0

v4.5.1

Compare Source

Security

Unclear documentation of the error behavior in ParseWithClaims in <= 4.5.0 could lead to situation where users are potentially not checking errors in the way they should be. Especially, if a token is both expired and invalid, the errors returned by ParseWithClaims return both error codes. If users only check for the jwt.ErrTokenExpired using error.Is, they will ignore the embedded jwt.ErrTokenSignatureInvalid and thus potentially accept invalid tokens.

This issue was documented in GHSA-29wx-vh33-7x7r and fixed in this release.

Note: v5 was not affected by this issue. So upgrading to this release version is also recommended.

What's Changed

  • Back-ported error-handling logic in ParseWithClaims from v5 branch. This fixes GHSA-29wx-vh33-7x7r.

Full Changelog: golang-jwt/jwt@v4.5.0...v4.5.1

kubernetes/client-go

v1.5.0


Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

👻 Immortal: This PR will be recreated if closed unmerged. Get config help if that's undesired.


  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

@freiheit-kuberpult-upgrader
Copy link
Collaborator Author

freiheit-kuberpult-upgrader commented Feb 16, 2024

⚠ Artifact update problem

Renovate failed to update an artifact related to this branch. You probably do not want to merge this PR as-is.

♻ Renovate will retry this branch, including artifacts, only when one of the following happens:

  • any of the package files in this branch needs updating, or
  • the branch becomes conflicted, or
  • you click the rebase/retry checkbox if found above, or
  • you rename this PR's title to start with "rebase!" to trigger it manually

The artifact failure details are included below:

File name: go.sum
Command failed: go get -d -t ./...
go: -d flag is deprecated. -d=true is a no-op
warning: ignoring symlink /tmp/renovate/repos/github/freiheit-com/kuberpult/services/frontend-service/api
go: downloading gopkg.in/DataDog/dd-trace-go.v1 v1.63.1
go: downloading k8s.io/apimachinery v0.26.11
go: downloading k8s.io/api v0.26.11
go: downloading github.com/coreos/go-oidc/v3 v3.10.0
go: downloading github.com/golang-migrate/migrate/v4 v4.17.1
go: downloading github.com/go-git/go-billy/v5 v5.5.0
go: downloading github.com/golang-jwt/jwt/v4 v4.5.0
go: downloading google.golang.org/grpc v1.62.1
go: downloading golang.org/x/oauth2 v0.19.0
go: downloading github.com/golang-jwt/jwt v3.2.2+incompatible
go: downloading google.golang.org/protobuf v1.33.0
go: downloading github.com/prometheus/client_golang v1.19.0
go: downloading go.opentelemetry.io/otel/exporters/prometheus v0.48.0
go: downloading github.com/lestrrat-go/jwx/v2 v2.0.21
go: downloading go.opentelemetry.io/otel v1.26.0
go: downloading go.opentelemetry.io/otel/metric v1.26.0
go: downloading go.opentelemetry.io/otel/sdk/metric v1.26.0
go: downloading go.opentelemetry.io/otel/sdk v1.26.0
go: downloading github.com/argoproj/argo-cd/v2 v2.9.20
go: downloading github.com/argoproj/gitops-engine v0.7.1-0.20240715141028-c68bce0f979c
go: downloading golang.org/x/crypto v0.22.0
go: downloading google.golang.org/api v0.170.0
go: downloading golang.org/x/sync v0.7.0
go: downloading github.com/ProtonMail/go-crypto v1.1.2
go: downloading github.com/DataDog/datadog-agent/pkg/remoteconfig/state v0.48.1
go: downloading github.com/DataDog/sketches-go v1.4.2
go: downloading github.com/tinylib/msgp v1.1.8
go: downloading golang.org/x/sys v0.19.0
go: downloading golang.org/x/time v0.5.0
go: downloading golang.org/x/xerrors v0.0.0-20220907171357-04be3eba64a2
go: downloading k8s.io/utils v0.0.0-20231121161247-cf03d44ff3cf
go: downloading golang.org/x/net v0.23.0
go: downloading github.com/go-jose/go-jose/v4 v4.0.1
go: downloading go.uber.org/multierr v1.10.0
go: downloading github.com/mattn/go-sqlite3 v1.14.16
go: downloading google.golang.org/genproto/googleapis/rpc v0.0.0-20240314234333-6e1732d8331c
go: downloading google.golang.org/genproto v0.0.0-20240213162025-012b6fc9bca9
go: downloading github.com/cespare/xxhash/v2 v2.2.0
go: downloading github.com/prometheus/common v0.48.0
go: downloading github.com/prometheus/procfs v0.12.0
go: downloading github.com/decred/dcrd/dcrec/secp256k1/v4 v4.2.0
go: downloading github.com/lestrrat-go/httprc v1.0.5
go: downloading github.com/Microsoft/go-winio v0.6.1
go: downloading github.com/go-logr/logr v1.4.1
go: downloading github.com/spf13/cobra v1.7.0
go: downloading k8s.io/cli-runtime v0.26.11
go: downloading k8s.io/client-go v11.0.0+incompatible
go: downloading k8s.io/kube-openapi v0.0.0-20230501164219-8b0f38b5fd1f
go: downloading k8s.io/kubectl v0.26.11
go: downloading github.com/cyphar/filepath-securejoin v0.2.4
go: downloading k8s.io/apiextensions-apiserver v0.26.11
go: downloading github.com/DataDog/appsec-internal-go v1.5.0
go: downloading github.com/go-git/go-git/v5 v5.11.0
go: downloading github.com/redis/go-redis/v9 v9.1.0
go: downloading github.com/Masterminds/semver/v3 v3.2.1
go: downloading github.com/evanphx/json-patch v5.6.0+incompatible
go: downloading github.com/google/pprof v0.0.0-20230817174616-7a8ec2ada47b
go: downloading github.com/bmatcuk/doublestar/v4 v4.6.0
go: downloading github.com/bradleyfalzon/ghinstallation/v2 v2.6.0
go: downloading github.com/rs/cors v1.8.0
go: downloading google.golang.org/genproto/googleapis/api v0.0.0-20240314234333-6e1732d8331c
go: downloading k8s.io/kube-aggregator v0.26.11
go: downloading k8s.io/klog/v2 v2.90.1
go: downloading github.com/hashicorp/go-retryablehttp v0.7.4
go: downloading sigs.k8s.io/structured-merge-diff/v4 v4.3.0
go: downloading github.com/DataDog/go-tuf v1.0.2-0.5.2
go: downloading github.com/philhofer/fwd v1.1.2
go: downloading github.com/DataDog/go-libddwaf/v2 v2.4.2
go: downloading go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0
go: downloading github.com/goccy/go-json v0.10.2
go: downloading go.opentelemetry.io/otel/trace v1.26.0
go: downloading golang.org/x/tools v0.13.0
go: downloading k8s.io/kubernetes v1.26.11
go: downloading github.com/google/gnostic v0.6.9
go: downloading golang.org/x/text v0.14.0
go: downloading sigs.k8s.io/kustomize/api v0.12.1
go: downloading sigs.k8s.io/kustomize/kyaml v0.13.9
go: downloading github.com/googleapis/gnostic v0.5.5
go: downloading k8s.io/klog v1.0.0
go: downloading k8s.io/component-helpers v0.27.3
go: downloading k8s.io/component-base v0.26.11
go: downloading oras.land/oras-go/v2 v2.3.0
go: downloading github.com/go-openapi/jsonreference v0.20.1
go: downloading github.com/go-openapi/swag v0.22.3
go: downloading dario.cat/mergo v1.0.0
go: downloading github.com/sergi/go-diff v1.1.0
go: downloading github.com/google/go-github/v53 v53.2.0
go: downloading cloud.google.com/go/compute/metadata v0.2.3
go: downloading cloud.google.com/go/compute v1.24.0
go: downloading github.com/klauspost/compress v1.17.1
go: downloading github.com/vmihailenco/msgpack/v5 v5.3.5
go: downloading golang.org/x/term v0.19.0
go: downloading github.com/mitchellh/go-wordwrap v1.0.0
go: downloading github.com/opencontainers/image-spec v1.1.0-rc4
go: downloading github.com/go-openapi/jsonpointer v0.19.6
go: downloading github.com/richardartoul/molecule v1.0.1-0.20221107223329-32cfee06a052
go: downloading github.com/google/s2a-go v0.1.7
go: downloading github.com/googleapis/gax-go/v2 v2.12.3
go: downloading go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0
go: downloading k8s.io/apiserver v0.26.11
go: downloading github.com/google/btree v1.1.2
go: downloading github.com/fvbommel/sortorder v1.0.1
go: downloading github.com/moby/spdystream v0.2.0
go: downloading github.com/googleapis/enterprise-certificate-proxy v0.3.2
go: downloading golang.org/x/mod v0.12.0
go: downloading github.com/docker/distribution v2.8.2+incompatible
go: downloading github.com/xlab/treeprint v1.1.0
go: downloading go.starlark.net v0.0.0-20220328144851-d1966c6b9fcd
go: downloading github.com/MicahParks/keyfunc v1.9.0
go: downloading github.com/googleapis/gnostic v0.7.0
go: github.com/freiheit-com/kuberpult/pkg/db imports
	github.com/freiheit-com/kuberpult/pkg/api/v1: cannot find module providing package github.com/freiheit-com/kuberpult/pkg/api/v1
go: github.com/freiheit-com/kuberpult/services/cd-service/pkg/argocd/reposerver imports
	github.com/argoproj/gitops-engine/pkg/utils/kube imports
	k8s.io/client-go/discovery imports
	github.com/googleapis/gnostic/OpenAPIv2: cannot find module providing package github.com/googleapis/gnostic/OpenAPIv2
go: github.com/freiheit-com/kuberpult/services/cd-service/pkg/argocd/reposerver imports
	github.com/argoproj/gitops-engine/pkg/utils/kube imports
	k8s.io/kubectl/pkg/cmd/apply imports
	k8s.io/client-go/util/csaupgrade: cannot find module providing package k8s.io/client-go/util/csaupgrade
go: github.com/freiheit-com/kuberpult/services/cd-service/pkg/argocd/reposerver imports
	github.com/argoproj/gitops-engine/pkg/utils/kube imports
	k8s.io/kubectl/pkg/cmd/auth imports
	k8s.io/client-go/kubernetes/typed/authentication/v1alpha1: cannot find module providing package k8s.io/client-go/kubernetes/typed/authentication/v1alpha1
go: github.com/freiheit-com/kuberpult/services/cd-service/pkg/argocd/reposerver imports
	github.com/argoproj/gitops-engine/pkg/utils/kube imports
	k8s.io/kubectl/pkg/cmd/create imports
	k8s.io/client-go/kubernetes/typed/policy/v1: cannot find module providing package k8s.io/client-go/kubernetes/typed/policy/v1
go: github.com/freiheit-com/kuberpult/services/cd-service/pkg/argocd/reposerver imports
	github.com/argoproj/argo-cd/v2/pkg/apis/application/v1alpha1 imports
	k8s.io/client-go/rest imports
	k8s.io/client-go/util/flowcontrol imports
	k8s.io/apimachinery/pkg/util/clock: cannot find module providing package k8s.io/apimachinery/pkg/util/clock
go: github.com/freiheit-com/kuberpult/services/cd-service/pkg/argocd/reposerver imports
	github.com/argoproj/argo-cd/v2/util/argo imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/auditregistration/v1alpha1 imports
	k8s.io/api/auditregistration/v1alpha1: cannot find module providing package k8s.io/api/auditregistration/v1alpha1
go: github.com/freiheit-com/kuberpult/services/cd-service/pkg/argocd/reposerver imports
	github.com/argoproj/argo-cd/v2/util/argo imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/batch/v2alpha1 imports
	k8s.io/api/batch/v2alpha1: cannot find module providing package k8s.io/api/batch/v2alpha1
go: github.com/freiheit-com/kuberpult/services/cd-service/pkg/argocd/reposerver imports
	github.com/argoproj/argo-cd/v2/util/argo imports
	k8s.io/client-go/kubernetes imports
	k8s.io/client-go/kubernetes/typed/settings/v1alpha1 imports
	k8s.io/api/settings/v1alpha1: cannot find module providing package k8s.io/api/settings/v1alpha1

@freiheit-kuberpult-upgrader freiheit-kuberpult-upgrader force-pushed the renovate/major-go branch 3 times, most recently from 7cc6b4a to cd0bcab Compare March 12, 2024 01:04
@freiheit-kuberpult-upgrader freiheit-kuberpult-upgrader force-pushed the renovate/major-go branch 2 times, most recently from 7cb1d28 to 84254a9 Compare March 19, 2024 12:50
@freiheit-kuberpult-upgrader freiheit-kuberpult-upgrader force-pushed the renovate/major-go branch 2 times, most recently from 09f6e35 to 3197e84 Compare March 26, 2024 01:05
@freiheit-kuberpult-upgrader freiheit-kuberpult-upgrader force-pushed the renovate/major-go branch 2 times, most recently from 665444c to 7a353f2 Compare April 17, 2024 12:51
@freiheit-kuberpult-upgrader freiheit-kuberpult-upgrader force-pushed the renovate/major-go branch 4 times, most recently from b6828aa to 382104e Compare April 26, 2024 12:50
@freiheit-kuberpult-upgrader freiheit-kuberpult-upgrader force-pushed the renovate/major-go branch 3 times, most recently from 69c7788 to 1cefafd Compare May 21, 2024 12:51
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants