Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Upgrade github.com/docker/cli to v20.10.12 #894

Merged

Conversation

jeloba
Copy link
Contributor

@jeloba jeloba commented Jan 10, 2022

Description of the change:

Upgraded github.com/docker/cli to latest release.

Motivation for the change:

The version previously used contained CVE-2021-41092.

Reviewer Checklist

  • Implementation matches the proposed design, or proposal is updated to match implementation
  • Sufficient unit test coverage
  • Sufficient end-to-end test coverage
  • Docs updated or added to /docs
  • Commit messages sensible and descriptive

@openshift-ci
Copy link
Contributor

openshift-ci bot commented Jan 10, 2022

Hi @jeloba. Thanks for your PR.

I'm waiting for a operator-framework member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@jeloba jeloba force-pushed the cve-2021-41092 branch 2 times, most recently from d830c8b to cd70295 Compare January 10, 2022 12:53
@timflannagan
Copy link
Contributor

/ok-to-test

@openshift-ci openshift-ci bot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Jan 10, 2022
@codecov
Copy link

codecov bot commented Jan 10, 2022

Codecov Report

Merging #894 (8673b73) into master (d69d2e4) will increase coverage by 0.13%.
The diff coverage is n/a.

Impacted file tree graph

@@            Coverage Diff             @@
##           master     #894      +/-   ##
==========================================
+ Coverage   52.07%   52.21%   +0.13%     
==========================================
  Files         103      103              
  Lines        9092     9117      +25     
==========================================
+ Hits         4735     4760      +25     
- Misses       3449     3451       +2     
+ Partials      908      906       -2     
Impacted Files Coverage Δ
pkg/lib/registry/registry.go 18.39% <0.00%> (-0.36%) ⬇️
pkg/lib/indexer/indexer.go 10.61% <0.00%> (-0.18%) ⬇️
pkg/containertools/runner.go 0.00% <0.00%> (ø)
pkg/sqlite/load.go 46.28% <0.00%> (+0.29%) ⬆️
alpha/declcfg/diff.go 77.96% <0.00%> (+1.04%) ⬆️
pkg/registry/registry_to_model.go 62.33% <0.00%> (+2.61%) ⬆️
pkg/lib/bundle/exporter.go 62.85% <0.00%> (+6.19%) ⬆️
alpha/declcfg/diff_include.go 67.92% <0.00%> (+6.60%) ⬆️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d69d2e4...8673b73. Read the comment docs.

@jeloba
Copy link
Contributor Author

jeloba commented Jan 11, 2022

@timflannagan the data race looks like a questionable use of a global in the docker (CLI) config loader. Would it be acceptable to synchronize use of the config loader here?

@timflannagan
Copy link
Contributor

@jeloba I haven't been super involved with this codebase, so I'm probably not the best person to answer that. I'd guess burning down any races would be acceptable. Maybe @joelanford or @njhale have a better idea?

@jeloba
Copy link
Contributor Author

jeloba commented Jan 12, 2022

I pushed a crude locking solution for loading the docker config. 🤷

@openshift-ci openshift-ci bot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 16, 2022
Signed-off-by: Jan Boehm <6552713+jeloba@users.noreply.github.com>
This prevents data races during testing. The root cause
are unsecured globals in the docker cli lib.

Signed-off-by: Jan Boehm <6552713+jeloba@users.noreply.github.com>
@openshift-ci openshift-ci bot removed the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Jan 19, 2022
@jeloba
Copy link
Contributor Author

jeloba commented Jan 26, 2022

/retest

@jeloba
Copy link
Contributor Author

jeloba commented Feb 7, 2022

@dinhxuanvu @gallettilance what do I need to do to get this tested, reviewed, or merged?

Signed-off-by: Jan Boehm <6552713+jeloba@users.noreply.github.com>
@joelanford
Copy link
Member

/ok-to-test
/approve

@openshift-ci openshift-ci bot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Feb 10, 2022
Copy link
Contributor

@timflannagan timflannagan left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@openshift-ci openshift-ci bot added the lgtm Indicates that a PR is ready to be merged. label Feb 10, 2022
@openshift-ci
Copy link
Contributor

openshift-ci bot commented Feb 10, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: jeloba, joelanford, timflannagan

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@openshift-merge-robot openshift-merge-robot merged commit c496cf0 into operator-framework:master Feb 10, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. lgtm Indicates that a PR is ready to be merged. ok-to-test Indicates a non-member PR verified by an org member that is safe to test.
Projects
None yet
Development

Successfully merging this pull request may close these issues.

5 participants