Commit Graph

46 Commits

Author SHA1 Message Date
Sebastiaan van Stijn cdfafe03e3
Bump Golang 1.13.14
full diff: https://github.com/golang/go/compare/go1.13.13...go1.13.14

go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the
database/sql, net/http, and reflect packages. See the Go 1.13.14 milestone on
the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.14+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-07-17 15:44:54 +02:00
Sebastiaan van Stijn dc4f7fb375
Bump Golang 1.13.13
full diff: https://github.com/golang/go/compare/go1.13.12...go1.13.13

go1.13.13 (released 2020/07/14) includes security fixes to the crypto/x509 and
net/http packages. See the Go 1.13.13 milestone on the issue tracker for details.

https://github.com/golang/go/issues?q=milestone%3AGo1.13.13+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-07-16 15:45:25 +02:00
Sebastiaan van Stijn 1cd69c41e6
Bump Golang 1.13.12
go1.13.12 (released 2020/06/01) includes fixes to the runtime, and the go/types
and math/big packages. See the Go 1.13.12 milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.12+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.13.11...go1.13.12

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-06-03 12:25:39 +02:00
Sebastiaan van Stijn 1ecca982ed
Bump Golang 1.13.11
full diff: https://github.com/golang/go/compare/go1.13.10...go1.13.11

go1.13.11 (released 2020/05/14) includes fixes to the compiler. See the Go 1.13.11
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.11+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-18 15:58:42 +02:00
Sebastiaan van Stijn 6875390131
Bump Golang 1.13.10
go1.13.10 (released 2020/04/08) includes fixes to the go command, the runtime,
os/exec, and time packages. See the Go 1.13.10 milestone on the issue tracker
for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.10+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.13.9...go1.13.10

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-04-09 22:25:39 +02:00
Sebastiaan van Stijn d063b835b3
Bump Golang 1.13.9
go1.13.9 (released 2020/03/19) includes fixes to the go command, tools, the
runtime, the toolchain, and the crypto/cypher package. See the Go 1.13.9
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.9+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.13.8...go1.13.9

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-04-04 02:23:13 +02:00
Silvin Lubecki 2e4dcacddb
Merge pull request #2360 from thaJeztah/bump_golang_1.13
Update Golang 1.13.8
2020-02-26 15:33:27 +01:00
Silvin Lubecki e67b4b4be2
Merge pull request #2335 from thaJeztah/silence_curl_and_follow_redirects
Dockerfile.e2e: don't show progress, force TLS, and follow redirects
2020-02-26 14:32:02 +01:00
Sebastiaan van Stijn 4313c8b3c6
Update Golang 1.13.8
Also pinning the e2e image to the "buster" variant,
which is what's currently used, but making it explicit.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-26 11:16:35 +01:00
Sebastiaan van Stijn 5e5ef9e0b9
Update Golang 1.12.17
full diff: https://github.com/golang/go/compare/go1.12.16...go1.12.17

go1.12.17 (released 2020/02/12) includes a fix to the runtime. See the Go 1.12.17
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.17+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-17 12:05:53 +01:00
Sebastiaan van Stijn 1fefbdc29c
Dockerfile.e2e: don't show progress, force TLS, and follow redirects
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-13 15:17:40 +01:00
Sebastiaan van Stijn 19fd390c36
Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919)
full diff: https://github.com/golang/go/compare/go1.12.15...go1.12.16

go1.12.16 (released 2020/01/28) includes two security fixes. One mitigates the
CVE-2020-0601 certificate verification bypass on Windows. The other affects only
32-bit architectures.

https://github.com/golang/go/issues?q=milestone%3AGo1.12.16+label%3ACherryPickApproved

- X.509 certificate validation bypass on Windows 10
  A Windows vulnerability allows attackers to spoof valid certificate chains when
  the system root store is in use. These releases include a mitigation for Go
  applications, but it’s strongly recommended that affected users install the
  Windows security update to protect their system.
  This issue is CVE-2020-0601 and Go issue golang.org/issue/36834.
- Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte
  On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
  functions of golang.org/x/crypto/cryptobyte can lead to a panic.
  The malformed certificate can be delivered via a crypto/tls connection to a
  client, or to a server that accepts client certificates. net/http clients can
  be made to crash by an HTTPS server, while net/http servers that accept client
  certificates will recover the panic and are unaffected.
  Thanks to Project Wycheproof for providing the test cases that led to the
  discovery of this issue. The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.
  This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of golang.org/x/crypto/cryptobyte.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-29 11:23:02 +01:00
Sebastiaan van Stijn 594be50a63
bump gotestsum v0.4.0
full diff: https://github.com/gotestyourself/gotestsum/compare/v0.3.5...v0.4.0

includes:

- gotestyourself/gotestsum#59 Report if a package was cached in short formats
- gotestyourself/gotestsum#63 always colorize output unless specifically requested not to
- gotestyourself/gotestsum#61 Improve short-verbose output for tests in CWD
- gotestyourself/gotestsum#70 https://github.com/gotestyourself/gotestsum/pull/70
- gotestyourself/gotestsum#73 Add short-with-failures format

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-27 17:48:01 +01:00
Sebastiaan van Stijn 3f83832be1
bump gotestsum v0.3.5
full diff: https://github.com/gotestyourself/gotestsum/compare/v0.3.4...v0.3.5

- gotestyourself/gotestsum#52 Add a --version flag that goreleaser will populate for us
- gotestyourself/gotestsum#57 Identify and, filter or display coverage output

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-27 17:41:07 +01:00
Sebastiaan van Stijn 84c6b08cf6
Update Golang 1.12.15
full diff: https://github.com/golang/go/compare/go1.12.14...go1.12.15

go1.12.15 (released 2020/01/09) includes fixes to the runtime and the net/http
package. See the Go 1.12.15 milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.15+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-17 15:00:22 +01:00
Sebastiaan van Stijn c804b1083e
Dockerfile.e2e: update compose v1.25.1, enable buildkit
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-15 18:41:44 +01:00
Sebastiaan van Stijn 4beea58531
Bump Golang 1.12.14
go1.12.14 (released 2019/12/04) includes a fix to the runtime. See the Go 1.12.14
milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.14+label%3ACherryPickApproved

Update Golang 1.12.13
------------------------

go1.12.13 (released 2019/10/31) fixes an issue on macOS 10.15 Catalina where the
non-notarized installer and binaries were being rejected by Gatekeeper. Only macOS
users who hit this issue need to update.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-03 12:37:59 +01:00
Sebastiaan van Stijn 474d522ee2
Update Golang 1.12.12 (CVE-2019-17596)
Golang 1.12.12
-------------------------------

full diff: https://github.com/golang/go/compare/go1.12.11...go1.12.12

go1.12.12 (released 2019/10/17) includes fixes to the go command, runtime,
syscall and net packages. See the Go 1.12.12 milestone on our issue tracker for
details.

https://github.com/golang/go/issues?q=milestone%3AGo1.12.12

Golang 1.12.11 (CVE-2019-17596)
-------------------------------

full diff: https://github.com/golang/go/compare/go1.12.10...go1.12.11

go1.12.11 (released 2019/10/17) includes security fixes to the crypto/dsa
package. See the Go 1.12.11 milestone on our issue tracker for details.

https://github.com/golang/go/issues?q=milestone%3AGo1.12.11

    [security] Go 1.13.2 and Go 1.12.11 are released

    Hi gophers,

    We have just released Go 1.13.2 and Go 1.12.11 to address a recently reported
    security issue. We recommend that all affected users update to one of these
    releases (if you're not sure which, choose Go 1.13.2).

    Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using
    crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic,
    even if the certificates don't chain to a trusted root. The chain can be
    delivered via a crypto/tls connection to a client, or to a server that accepts
    and verifies client certificates. net/http clients can be made to crash by an
    HTTPS server, while net/http servers that accept client certificates will
    recover the panic and are unaffected.

    Moreover, an application might crash invoking
    crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate
    request, parsing a golang.org/x/crypto/openpgp Entity, or during a
    golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client
    can panic due to a malformed host key, while a server could panic if either
    PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts
    a certificate with a malformed public key.

    The issue is CVE-2019-17596 and Go issue golang.org/issue/34960.

    Thanks to Daniel Mandragona for discovering and reporting this issue. We'd also
    like to thank regilero for a previous disclosure of CVE-2019-16276.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-10-20 23:26:31 +02:00
Sebastiaan van Stijn 8743e36a45
bump golang 1.12.10 (CVE-2019-16276)
full diff: https://github.com/golang/go/compare/go1.12.9...go1.12.10

```
Hi gophers,

We have just released Go 1.13.1 and Go 1.12.10 to address a recently reported security issue. We recommend that all affected users update to one of these releases (if you're not sure which, choose Go 1.13.1).

net/http (through net/textproto) used to accept and normalize invalid HTTP/1.1 headers with a space before the colon, in violation of RFC 7230. If a Go server is used behind an uncommon reverse proxy that accepts and forwards but doesn't normalize such invalid headers, the reverse proxy and the server can interpret the headers differently. This can lead to filter bypasses or request smuggling, the latter if requests from separate clients are multiplexed onto the same upstream connection by the proxy. Such invalid headers are now rejected by Go servers, and passed without normalization to Go client applications.

The issue is CVE-2019-16276 and Go issue golang.org/issue/34540.

Thanks to Andrew Stucki, Adam Scarr (99designs.com), and Jan Masarik (masarik.sh) for discovering and reporting this issue.

Downloads are available at https://golang.org/dl for all supported platforms.

Alla prossima,
Filippo on behalf of the Go team
```

From the patch: 6e6f4aaf70

```
net/textproto: don't normalize headers with spaces before the colon

RFC 7230 is clear about headers with a space before the colon, like

X-Answer : 42

being invalid, but we've been accepting and normalizing them for compatibility
purposes since CL 5690059 in 2012.

On the client side, this is harmless and indeed most browsers behave the same
to this day. On the server side, this becomes a security issue when the
behavior doesn't match that of a reverse proxy sitting in front of the server.

For example, if a WAF accepts them without normalizing them, it might be
possible to bypass its filters, because the Go server would interpret the
header differently. Worse, if the reverse proxy coalesces requests onto a
single HTTP/1.1 connection to a Go server, the understanding of the request
boundaries can get out of sync between them, allowing an attacker to tack an
arbitrary method and path onto a request by other clients, including
authentication headers unknown to the attacker.

This was recently presented at multiple security conferences:
https://portswigger.net/blog/http-desync-attacks-request-smuggling-reborn

net/http servers already reject header keys with invalid characters.
Simply stop normalizing extra spaces in net/textproto, let it return them
unchanged like it does for other invalid headers, and let net/http enforce
RFC 7230, which is HTTP specific. This loses us normalization on the client
side, but there's no right answer on the client side anyway, and hiding the
issue sounds worse than letting the application decide.
```

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-09-27 23:30:54 +02:00
Jintao Zhang d9856049e5 Bump golang 1.12.9
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
2019-08-16 10:10:19 +08:00
Sebastiaan van Stijn aa097cf1aa
Merge pull request #1993 from thaJeztah/e2e_remove_dead_code
e2e: remove docker engine testing remnants
2019-08-15 03:01:45 +02:00
Sebastiaan van Stijn bbd179f25b
Bump golang 1.12.8 (CVE-2019-9512, CVE-2019-9514)
go1.12.8 (released 2019/08/13) includes security fixes to the net/http and net/url packages.
See the Go 1.12.8 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.8

- net/http: Denial of Service vulnerabilities in the HTTP/2 implementation
  net/http and golang.org/x/net/http2 servers that accept direct connections from untrusted
  clients could be remotely made to allocate an unlimited amount of memory, until the program
  crashes. Servers will now close connections if the send queue accumulates too many control
  messages.
  The issues are CVE-2019-9512 and CVE-2019-9514, and Go issue golang.org/issue/33606.
  Thanks to Jonathan Looney from Netflix for discovering and reporting these issues.
  This is also fixed in version v0.0.0-20190813141303-74dc4d7220e7 of golang.org/x/net/http2.
  net/url: parsing validation issue
- url.Parse would accept URLs with malformed hosts, such that the Host field could have arbitrary
  suffixes that would appear in neither Hostname() nor Port(), allowing authorization bypasses
  in certain applications. Note that URLs with invalid, not numeric ports will now return an error
  from url.Parse.
  The issue is CVE-2019-14809 and Go issue golang.org/issue/29098.
  Thanks to Julian Hector and Nikolai Krein from Cure53, and Adi Cohen (adico.me) for discovering
  and reporting this issue.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-08-14 02:55:45 +02:00
Sebastiaan van Stijn de01e72455
e2e: remove docker engine testing remnants
These changes were made as part of the `docker engine` feature
in commit fd2f1b3b66, but later
reverted in f250152bf4 and
b7ec4a42d9

These lines were forgotten to be removed, and should no longer
be needed.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-07-12 16:21:17 +02:00
Sebastiaan van Stijn b06f9e9595
Bump golang 1.12.7
go1.12.7 (released 2019/07/08) includes fixes to cgo, the compiler, and the
linker. See the Go 1.12.7 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.12.7

full diff: https://github.com/golang/go/compare/go1.12.6...go1.12.7

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-07-10 23:50:29 +02:00
Jintao Zhang 459099e175 Bump golang 1.12.6
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
2019-06-12 15:36:52 +08:00
Jintao Zhang c32d1de57c Bump golang 1.12.5
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
2019-05-08 08:43:22 +08:00
Sebastiaan van Stijn 5ad82fafb3
Merge pull request #1829 from thaJeztah/bump_gotestsum_v0.3.4
bump gotestsum v0.3.4
2019-04-18 17:55:12 +02:00
Sebastiaan van Stijn 337a9611e2
bump gotestsum v0.3.4
https://github.com/gotestyourself/gotestsum/releases/tag/v0.3.4

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-04-14 16:51:12 +02:00
Sebastiaan van Stijn cf47bb2cc2
Bump Golang 1.12.4
go1.12.4 (released 2019/04/11) fixes an issue where using the prebuilt
binary releases on older versions of GNU/Linux led to failures when linking
programs that used cgo. Only Linux users who hit this issue need to update.

See golang/go#31293 for details

Full diff: https://github.com/golang/go/compare/go1.12.3...go1.12.4

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-04-14 02:19:16 +02:00
Jintao Zhang c55c801faf Bump Golang 1.12.3
Signed-off-by: Jintao Zhang <zhangjintao9020@gmail.com>
2019-04-11 10:44:16 +08:00
Sebastiaan van Stijn ed8733a940
Bump Golang 1.12.2
go1.12.2 (released 2019/04/05) includes fixes to the compiler, the go
command, the runtime, and the doc, net, net/http/httputil, and os packages.
See the Go 1.12.2 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.2

Full diff: https://github.com/golang/go/compare/go1.12.1...go1.12.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-04-08 18:53:12 +02:00
Sebastiaan van Stijn 81b319aa5f
Bump Golang 1.12.1
go1.12.1 (released 2019/03/14) includes fixes to cgo, the compiler, the go
command, and the fmt, net/smtp, os, path/filepath, sync, and text/template
packages. See the Go 1.12.1 milestone on our issue tracker for details.

For the relase notes of Go 1.12.0, see: https://golang.org/doc/go1.12

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-03-18 14:47:24 +01:00
Sebastiaan van Stijn 1500105975
Bump Golang 1.11.6
go1.11.6 (released 2019/03/14) includes fixes to cgo, the compiler, linker,
runtime, go command, and the crypto/x509, encoding/json, net, and net/url
packages. See the Go 1.11.6 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.11.6

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-03-17 16:01:58 +01:00
Silvin Lubecki 3bd3996f72 Use gotest.tools/gotestsum binary to run unit and e2e tests and simplify the output.
Signed-off-by: Silvin Lubecki <silvin.lubecki@docker.com>
2019-02-01 11:16:20 +01:00
Ian Campbell 5db336798c Add some simple e2e tests for executing CLI plugins
To help with this add a bad plugin which produces invalid metadata and arrange
for it to be built in the e2e container.

Signed-off-by: Ian Campbell <ijc@docker.com>
2019-01-30 13:44:05 +00:00
Ian Campbell e96240427f Add basic framework for writing a CLI plugin
That is, the helper to be used from the plugin's `main`.

Also add a `helloworld` plugin example and build integration.

Signed-off-by: Ian Campbell <ijc@docker.com>
2019-01-29 11:26:40 +00:00
Sebastiaan van Stijn 0e9d1d3b07
Bump Golang 1.11.5 (CVE-2019-6486)
See the milestone for details;
https://github.com/golang/go/issues?q=milestone%3AGo1.11.5+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2019-01-24 02:50:10 +01:00
Sebastiaan van Stijn deaf6e13ab
Bump Golang 1.11.4 (includes fix for CVE-2018-16875)
go1.11.4 (released 2018/12/14) includes fixes to cgo, the compiler, linker,
runtime, documentation, go command, and the net/http and go/types packages. It
includes a fix to a bug introduced in Go 1.11.3 that broke go get for import
path patterns containing "...".

See the Go 1.11.4 milestone for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.11.4+label%3ACherryPickApproved

go1.11.3 (released 2018/12/14)

- crypto/x509: CPU denial of service in chain validation golang/go#29233
- cmd/go: directory traversal in "go get" via curly braces in import paths golang/go#29231
- cmd/go: remote command execution during "go get -u" golang/go#29230

See the Go 1.11.3 milestone on the issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.11.3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2018-12-19 12:55:59 +01:00
Sebastiaan van Stijn 58f0bfcf51
Bump Go to 1.11.2
go1.11.2 (released 2018/11/02) includes fixes to the compiler, linker,
documentation, go command, and the database/sql and go/types packages.

See the milestone on the issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.11.2

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2018-12-11 12:19:16 +01:00
Kir Kolyshkin 9412739186 Bump Go to 1.11.1
Release notes: https://golang.org/doc/devel/release.html#go1.11

Signed-off-by: Kir Kolyshkin <kolyshkin@gmail.com>
2018-10-11 01:54:19 -07:00
Akihiro Suda 9b148db87a connhelper: add e2e
Signed-off-by: Akihiro Suda <suda.akihiro@lab.ntt.co.jp>
2018-09-30 10:24:34 +09:00
Daniel Hiltgen b7ec4a42d9 Review comments
Address code review comemnts and purge additional dead code.

Signed-off-by: Daniel Hiltgen <daniel.hiltgen@docker.com>
(cherry picked from commit f250152bf4)
Signed-off-by: Daniel Hiltgen <daniel.hiltgen@docker.com>
2018-09-21 15:43:00 -07:00
Sebastiaan van Stijn 44ca0901d1
Bump Go to 1.10.4
Includes fixes to the go command, linker, and the net/http, mime/multipart,
ld/macho, bytes, and strings packages. See the Go 1.10.4 milestone on the
issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.10.4

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2018-08-28 12:08:52 +02:00
Daniel Hiltgen fd2f1b3b66 Add engine commands built on containerd
This new collection of commands supports initializing a local
engine using containerd, updating that engine, and activating
the EE product

Signed-off-by: Daniel Hiltgen <daniel.hiltgen@docker.com>
2018-08-20 09:42:05 -07:00
Sebastiaan van Stijn 1c71c957cb
Bump Golang to 1.10.3
go1.10.3 (released 2018/06/05) includes fixes to the go command, and the
crypto/tls, crypto/x509, and strings packages. In particular, it adds minimal
support to the go command for the vgo transition. See the Go 1.10.3 milestone
on our issue tracker for details;
https://github.com/golang/go/issues?q=milestone%3AGo1.10.3

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2018-06-11 11:13:13 -07:00
Christopher Crone 6b38918ce4 Make e2e test image
- Build image that contains everything needed to run e2e tests
- Add ability to run e2e tests against an endpoint

Signed-off-by: Christopher Crone <christopher.crone@docker.com>
2018-05-29 13:39:31 +02:00