OCPBUGS-8646: bump openshift/library-go to drop mongo-driver references #462

alebedev87 · 2023-03-21T10:43:40Z

Bump new version of github.com/openshift/library-go to more recent version. This helps to get rid of some stale dependencies including mongo-driver (note go.sum removals).

gcs278 · 2023-03-21T18:11:27Z

/test images

alebedev87 · 2023-03-21T18:34:49Z

/retest-required

alebedev87 · 2023-03-21T19:56:39Z

Changed commit message to reference the bug.

openshift-ci-robot · 2023-03-21T19:57:01Z

@alebedev87: This pull request references Jira Issue OCPBUGS-8646, which is invalid:

expected the bug to target the "4.14.0" version, but it targets "4.13.0" instead

Comment /jira refresh to re-evaluate validity if changes to the Jira bug are made, or edit the title of this pull request to link to a different bug.

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2023-03-21T19:58:45Z

/jira refresh

openshift-ci-robot · 2023-03-21T19:58:55Z

@alebedev87: This pull request references Jira Issue OCPBUGS-8646, which is valid. The bug has been moved to the POST state.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state New, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

/jira refresh

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

gcs278 · 2023-03-21T20:59:29Z

/test images

gcs278 · 2023-03-21T21:21:52Z

/retest-required
Looks like RPM is mirrored again

ShudiLi · 2023-03-22T06:51:59Z

From QE side, checked it with 4.13.0-0.ci.test-2023-03-22-055438-ci-ln-ifgc7qb-latest
1.
% oc get clusterversion
NAME VERSION AVAILABLE PROGRESSING SINCE STATUS
version 4.13.0-0.ci.test-2023-03-22-055438-ci-ln-ifgc7qb-latest True False 15m Cluster version is 4.13.0-0.ci.test-2023-03-22-055438-ci-ln-ifgc7qb-latest
%

% oc rsync -n openshift-ingress $(oc get pods -n openshift-ingress --no-headers | grep "^router-default" | grep Running | head -1 | awk '{print $1}'):/usr/bin/openshift-router .
receiving file list ... done
openshift-router

% go version -m openshift-router | grep github.com/openshift/client-go
dep github.com/openshift/client-go v0.0.0-20230120202327-72f107311084
% go version -m openshift-router | grep github.com/openshift/library-go
dep github.com/openshift/library-go v0.0.0-20230120202744-256994f916c4
% go version -m openshift-router | grep github.com/google/gofuzz
dep github.com/google/gofuzz v1.2.0
% go version -m openshift-router | grep olang.org/x/oauth2
dep golang.org/x/oauth2 v0.0.0-20220411215720-9780585627b5
%
% go version -m openshift-router | grep github.com/certifi/gocertifi
% go version -m openshift-router | grep github.com/getsentry/raven-go
%

/label qe-approved
thanks

alebedev87 · 2023-03-22T08:20:44Z

/retest-required

alebedev87 · 2023-03-22T13:25:54Z

/test e2e-metal-ipi-ovn-ipv6

Mirroring problem, should be fixed by now.

alebedev87 · 2023-03-22T14:54:19Z

/test e2e-upgrade

alebedev87 · 2023-03-22T23:59:52Z

/test e2e-upgrade

alebedev87 · 2023-03-24T07:55:40Z

/test e2e-upgrade

openshift-ci-robot · 2023-03-24T15:33:20Z

@alebedev87: This pull request references Jira Issue OCPBUGS-8646, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

In response to this:

Updated github.com/openshift/library-go to the same version as github.com/openshift/api to get rid of mongo-driver dependency. Note go.sum got updated with mongo-driver dependency removed.

Why github.com/openshift/library-go?
You cannot update the indirect dependency by doing go get <dep>@<version> because it doesn't have a direct dependency on the current code, so go mod tidy will wipe it out.
You can only explicitly replace it in go.mod, which is an option but this may have some side effects as it may be incompatible new code.
So, to make it the compatible way, I had to walk up the dependency tree and update the direct dependency.
The dependency tree:
go.mongodb.org/mongo-driver@v1.1.2 ->                                                                                                 
github.com/go-openapi/validate@v0.19.5 ->
k8s.io/apiextensions-apiserver@v0.18.0-beta.2 ->
sigs.k8s.io/kube-storage-version-migrator@v0.0.3 ->
github.com/openshift/library-go@v0.0.0-20201223214116-830765adf874 ->
router

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

gcs278 · 2023-03-24T15:36:15Z

Thanks for the description update.
/lgtm

frobware · 2023-03-31T08:37:54Z

Anyway given that this PR just bumps the new version of openshift/library-go and removing this annoying mongo-driver as a side effect, I can just rename the commit and PR to remove CVE.

Yes, for me that would be appropriate.

/lgtm
/hold

Added hold in case somebody else on the team wants to leave the title as is.

openshift-ci-robot · 2023-03-31T10:57:42Z

@alebedev87: This pull request references Jira Issue OCPBUGS-8646, which is valid.

3 validation(s) were run on this bug

bug is open, matching expected state (open)
bug target version (4.14.0) matches configured target version for branch (4.14.0)
bug is in the state POST, which is one of the valid states (NEW, ASSIGNED, POST)

Requesting review from QA contact:
/cc @ShudiLi

The bug has been updated to refer to the pull request using the external bug tracker.

In response to this:

Bump new version of github.com/openshift/library-go to more recent version. This helps to get rid of some stale dependencies including mongo-driver (note go.sum removals).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

alebedev87 · 2023-03-31T11:51:24Z

The latest change is just a commit message update.

alebedev87 · 2023-03-31T13:52:58Z

/test e2e-aws-serial

alebedev87 · 2023-03-31T21:58:03Z

/retest-required

Miciah · 2023-04-01T23:44:38Z

Anyway given that this PR just bumps the new version of openshift/library-go and removing this annoying mongo-driver as a side effect, I can just rename the commit and PR to remove CVE.

Yes, for me that would be appropriate.

/lgtm /hold

Added hold in case somebody else on the team wants to leave the title as is.

I agree that the title doesn't need to mention the CVE.

The latest change is just a commit message update.

Looking through the Git history, is it obvious why the change was made? It makes sense to me to explain the reason for the bump in the commit message.

gcs278 · 2023-04-04T13:51:12Z

Looking through the Git history, is it obvious why the change was made? It makes sense to me to explain the reason for the bump in the commit message.

I think I agree with this. Would a better commit message be OCPBUGS-8646: bump openshift/library-go to clean up mongo-driver reference in go.sum or something? Is that what Miciah is getting at?

The referenced version of go.mongodb.org/mongo-driver is affected by CVE-2021-20329. Which may provoke false positives from the vulnerability scanners despite the fact that no files from go.mongodb.org/mongo-driver were actually vendored in this repository.

alebedev87 · 2023-04-04T21:19:35Z

Updated the commit to give more details on why the PR and why this way.

gcs278 · 2023-04-04T21:42:04Z

/lgtm

alebedev87 · 2023-04-05T07:52:17Z

/retest

alebedev87 · 2023-04-05T12:08:39Z

/retest

alebedev87 · 2023-04-06T08:07:45Z

Cluster installation failed.

/test e2e-aws-serial

alebedev87 · 2023-04-11T08:57:26Z

/test e2e-aws-serial

frobware · 2023-04-25T16:25:40Z

/hold cancel

frobware · 2023-04-25T16:49:24Z

/approve

openshift-ci · 2023-04-25T16:49:56Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: frobware

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [frobware]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

openshift-ci · 2023-04-25T19:26:14Z

@alebedev87: all tests passed!

Full PR test history. Your PR dashboard.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. I understand the commands that are listed here.

openshift-ci-robot · 2023-04-25T19:30:39Z

@alebedev87: Jira Issue OCPBUGS-8646: All pull requests linked via external trackers have merged:

openshift/router#462

Jira Issue OCPBUGS-8646 has been moved to the MODIFIED state.

In response to this:

Bump new version of github.com/openshift/library-go to more recent version. This helps to get rid of some stale dependencies including mongo-driver (note go.sum removals).

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

openshift-ci bot requested review from candita and knobunc March 21, 2023 10:44

alebedev87 force-pushed the cve-2021-20329 branch from 1d41efc to 0b74444 Compare March 21, 2023 16:42

alebedev87 force-pushed the cve-2021-20329 branch from 0b74444 to ba9201e Compare March 21, 2023 19:56

alebedev87 changed the title ~~CVE-2021-20329: update openshift/library-go to get rid of mongo-driver~~ OCPBUGS-8646: update openshift/library-go to fix CVE-2021-20329 Mar 21, 2023

openshift-ci-robot added jira/valid-reference Indicates that this PR references a valid Jira ticket of any type. jira/invalid-bug Indicates that a referenced Jira bug is invalid for the branch this PR is targeting. labels Mar 21, 2023

openshift-ci bot requested a review from ShudiLi March 21, 2023 19:59

alebedev87 force-pushed the cve-2021-20329 branch from ba9201e to a5558ee Compare March 21, 2023 20:12

openshift-ci bot added the qe-approved Signifies that QE has signed off on this PR label Mar 22, 2023

openshift-ci bot assigned gcs278 Mar 24, 2023

openshift-ci bot added the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Mar 31, 2023

openshift-ci bot assigned frobware Mar 31, 2023

alebedev87 force-pushed the cve-2021-20329 branch from a5558ee to 3c578cd Compare March 31, 2023 10:53

openshift-ci bot removed the lgtm Indicates that a PR is ready to be merged. label Mar 31, 2023

alebedev87 changed the title ~~OCPBUGS-8646: update openshift/library-go to fix CVE-2021-20329~~ OCPBUGS-8646: bump openshift/library-go Mar 31, 2023

alebedev87 force-pushed the cve-2021-20329 branch from 3c578cd to 5a06c61 Compare April 4, 2023 21:10

alebedev87 changed the title ~~OCPBUGS-8646: bump openshift/library-go~~ OCPBUGS-8646: bump openshift/library-go to drop mongo-driver references Apr 4, 2023

openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Apr 4, 2023

openshift-ci bot removed the do-not-merge/hold Indicates that a PR should not merge because someone has issued a /hold command. label Apr 25, 2023

openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 25, 2023

openshift-merge-robot merged commit 40b2cbd into openshift:master Apr 25, 2023

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OCPBUGS-8646: bump openshift/library-go to drop mongo-driver references #462

OCPBUGS-8646: bump openshift/library-go to drop mongo-driver references #462

alebedev87 commented Mar 21, 2023 •

edited

Loading

gcs278 commented Mar 21, 2023

alebedev87 commented Mar 21, 2023

alebedev87 commented Mar 21, 2023

openshift-ci-robot commented Mar 21, 2023

alebedev87 commented Mar 21, 2023

openshift-ci-robot commented Mar 21, 2023

gcs278 commented Mar 21, 2023

gcs278 commented Mar 21, 2023

ShudiLi commented Mar 22, 2023

alebedev87 commented Mar 22, 2023

alebedev87 commented Mar 22, 2023 •

edited

Loading

alebedev87 commented Mar 22, 2023

alebedev87 commented Mar 22, 2023

alebedev87 commented Mar 24, 2023

openshift-ci-robot commented Mar 24, 2023

gcs278 commented Mar 24, 2023

frobware commented Mar 31, 2023

openshift-ci-robot commented Mar 31, 2023

alebedev87 commented Mar 31, 2023

alebedev87 commented Mar 31, 2023

alebedev87 commented Mar 31, 2023

Miciah commented Apr 1, 2023

gcs278 commented Apr 4, 2023

alebedev87 commented Apr 4, 2023

gcs278 commented Apr 4, 2023

alebedev87 commented Apr 5, 2023

alebedev87 commented Apr 5, 2023

alebedev87 commented Apr 6, 2023

alebedev87 commented Apr 11, 2023

frobware commented Apr 25, 2023

frobware commented Apr 25, 2023

openshift-ci bot commented Apr 25, 2023

openshift-ci bot commented Apr 25, 2023

openshift-ci-robot commented Apr 25, 2023

OCPBUGS-8646: bump openshift/library-go to drop mongo-driver references #462

OCPBUGS-8646: bump openshift/library-go to drop mongo-driver references #462

Conversation

alebedev87 commented Mar 21, 2023 • edited Loading

gcs278 commented Mar 21, 2023

alebedev87 commented Mar 21, 2023

alebedev87 commented Mar 21, 2023

openshift-ci-robot commented Mar 21, 2023

alebedev87 commented Mar 21, 2023

openshift-ci-robot commented Mar 21, 2023

gcs278 commented Mar 21, 2023

gcs278 commented Mar 21, 2023

ShudiLi commented Mar 22, 2023

alebedev87 commented Mar 22, 2023

alebedev87 commented Mar 22, 2023 • edited Loading

alebedev87 commented Mar 22, 2023

alebedev87 commented Mar 22, 2023

alebedev87 commented Mar 24, 2023

openshift-ci-robot commented Mar 24, 2023

gcs278 commented Mar 24, 2023

frobware commented Mar 31, 2023

openshift-ci-robot commented Mar 31, 2023

alebedev87 commented Mar 31, 2023

alebedev87 commented Mar 31, 2023

alebedev87 commented Mar 31, 2023

Miciah commented Apr 1, 2023

gcs278 commented Apr 4, 2023

alebedev87 commented Apr 4, 2023

gcs278 commented Apr 4, 2023

alebedev87 commented Apr 5, 2023

alebedev87 commented Apr 5, 2023

alebedev87 commented Apr 6, 2023

alebedev87 commented Apr 11, 2023

frobware commented Apr 25, 2023

frobware commented Apr 25, 2023

openshift-ci bot commented Apr 25, 2023

openshift-ci bot commented Apr 25, 2023

openshift-ci-robot commented Apr 25, 2023

alebedev87 commented Mar 21, 2023 •

edited

Loading

alebedev87 commented Mar 22, 2023 •

edited

Loading