Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Bump Go and Dockerfile versions #337

Merged
merged 1 commit into from
Sep 12, 2023
Merged

Bump Go and Dockerfile versions #337

merged 1 commit into from
Sep 12, 2023

Conversation

macedogm
Copy link
Member

@macedogm macedogm commented Aug 1, 2023

This PR updates:

  1. Move Dockerfile.dapper to use BCI Golang bci/golang:1.19.
  2. Move the main CLI image in package/Dockerfile to use BCI Base bci/bci-base:15.5.
  3. Move the main CLI image in package/Dockerfile to run as a non-root user.
  4. Bump Go to 1.19 in go.mod.
  5. Several bumps in go.mod to fix CVEs:
    1. github.com/rancher/wrangler
    2. golang.org/x/crypto
    3. golang.org/x/net
    4. golang.org/x/sys
    5. golang.org/x/term
    6. golang.org/x/text
    7. No other major dependency was bumped besides the ones listed.
  6. Bump rancher/dapper to v0.6.0 in .drone.yml.
  7. Run go fmt on config/config.go to fix a small formatting issue.

@macedogm macedogm marked this pull request as ready for review August 2, 2023 12:09
@pjbgf

This comment was marked as outdated.

@superseb

This comment was marked as outdated.

@macedogm

This comment was marked as resolved.

@macedogm
Copy link
Member Author

macedogm commented Aug 9, 2023

FYI the BCI team said that they will add go1.xx-race package as default in the image in the next Go BCI image update.

.drone.yml Show resolved Hide resolved

ENV GOLANGCI_LINT v1.53.3
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Will renovate bot be able to identify this is a version as an ENV? In Webhook it puts the version on the curl command and renovate bot is able to update this automatically:
https://github.com/rancher/webhook/pull/251/files

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not at the moment, but we probably should update the renovate config to accommodate that.

Signed-off-by: Guilherme Macedo <guilherme@gmacedo.com>
@macedogm
Copy link
Member Author

@superseb you are right, I somehow missed that bci/golang doesn't have the go1.19-race package. Thanks for noticing it. Locally it worked for me, because it's available in Tumbleweed. I updated the PR to re-add the -race flag to go test.

Will check offline with the BCI team if they can add the package.

Removed the hacky code to add go-racer package, because it's now inside the Go base image by default:

> podman run --rm -it registry.suse.com/bci/golang:1.19 rpm -aq | grep go
go1.19-doc-1.19.11-150000.1.37.1.x86_64
libgomp1-12.3.0+git1204-150000.1.10.1.x86_64
go1.19-1.19.11-150000.1.37.1.x86_64
go1.19-race-1.19.11-150000.1.37.1.x86_64

CC @superseb and @pjbgf

@cmurphy cmurphy merged commit e5b6a23 into rancher:v2.7 Sep 12, 2023
@macedogm macedogm deleted the v2.7-security-improvements branch September 12, 2023 10:37
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants