Commit Graph

144 Commits

Author SHA1 Message Date
Sebastiaan van Stijn a3c4a42d4e
Dockerfile: update buildx to v0.8.1
This only affects the version used in the dev container, but
I noticed it was an older version of buildx.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-29 15:37:35 +02:00
Sebastiaan van Stijn 635c55d52f
update go to 1.18.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-28 17:23:09 +02:00
Sebastiaan van Stijn 3ffe6a3375
lint: update golangci-lint to v1.45.2
Also removed deprecated linters:

The linter 'interfacer' is deprecated (since v1.38.0) due to: The repository of the linter has been archived by the owner.
The linter 'golint' is deprecated (since v1.41.0) due to: The repository of the linter has been archived by the owner.  Replaced by revive.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-28 10:37:27 +02:00
Tonis Tiigi 6119e4ba90
update go to 1.17.8
Removes the platform based switch between different versions.

Signed-off-by: Tonis Tiigi <tonistiigi@gmail.com>
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-26 17:00:56 +01:00
Sebastiaan van Stijn 994d6b7fc2
Dockerfile: use syntax=docker/dockerfile:1
Now that HEREDOC is included in the stable Dockerfile syntax, we can
use the latest stable syntax for all Dockerfiles.

The recommendation for the stable syntax is to use `:1` (which is
equivalent to "latest" stable syntax.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-03-17 10:40:17 +01:00
CrazyMax bea6c0d242
validate authors target
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-02-25 17:03:25 +01:00
CrazyMax 6fef143dbc
Set buildx as default builder
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-02-03 10:38:05 +01:00
Sebastiaan van Stijn 0d5b24b019
Dockerfile.vendor: use GOPROXY=direct
While the module proxy can speed up vendoring, it may cause issues when
(temporarily) vendoring from a fork, because the proxy may not have the
module yet on first try, which causes vendoring to fail:

    vendor.mod:95:2: replace github.com/thaJeztah/compose-on-kubernetes:
    version "0b59cf047b3b0199048fe13fdcd21b0cb46549f2" invalid:
    Get "0b59cf047b.info": read tcp 172.17.0.2:60290->172.217.168.209:443: read: connection reset by peer

Using `GOPROXY=direct` to fetch sources directly from upstream (GitHub) instead.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2022-01-28 11:40:33 +01:00
CrazyMax 663f01b9cc
use uuid to invalidate cache
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2022-01-13 13:47:43 +01:00
CrazyMax 7e560ae76f
vendor with go mod
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2021-12-16 21:16:01 +01:00
Sebastiaan van Stijn dedd4b79ca
Update Go to 1.16.11
go1.16.11 (released 2021-12-02) includes fixes to the compiler, runtime, and the
net/http, net/http/httptest, and time packages. See the Go 1.16.11 milestone on
the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.16.11+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-12-06 10:57:30 +01:00
CrazyMax 62ea2bf1aa
GitHub Actions e2e tests
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2021-11-17 17:18:25 +01:00
Sebastiaan van Stijn e285f15009
Update Go to 1.16.10
go1.16.10 (released 2021-11-04) includes security fixes to the archive/zip and
debug/macho packages, as well as bug fixes to the compiler, linker, runtime, the
misc/wasm directory, and to the net/http package. See the Go 1.16.10 milestone
for details: https://github.com/golang/go/issues?q=milestone%3AGo1.16.10+label%3ACherryPickApproved

From the announcement e-mail:

[security] Go 1.17.3 and Go 1.16.10 are released

We have just released Go versions 1.17.3 and 1.16.10, minor point releases.
These minor releases include two security fixes following the security policy:

- archive/zip: don't panic on (*Reader).Open
  Reader.Open (the API implementing io/fs.FS introduced in Go 1.16) can be made
  to panic by an attacker providing either a crafted ZIP archive containing
  completely invalid names or an empty filename argument.
  Thank you to Colin Arnott, SiteHost and Noah Santschi-Cooney, Sourcegraph Code
  Intelligence Team for reporting this issue. This is CVE-2021-41772 and Go issue
  golang.org/issue/48085.
- debug/macho: invalid dynamic symbol table command can cause panic
  Malformed binaries parsed using Open or OpenFat can cause a panic when calling
  ImportedSymbols, due to an out-of-bounds slice operation.
  Thanks to Burak Çarıkçı - Yunus Yıldırım (CT-Zer0 Crypttech) for reporting this
  issue. This is CVE-2021-41771 and Go issue golang.org/issue/48990.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-11-05 11:12:54 +01:00
Silvin Lubecki e57b5f78de
Merge pull request #3330 from thaJeztah/bump_go_1.16.9
Update Go to 1.16.9
2021-10-15 16:46:00 +02:00
CrazyMax 75284bd1d1
Use goversioninfo to create Windows Version Info
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2021-10-11 16:54:22 +02:00
Sebastiaan van Stijn bf310f863b
Update Go to 1.16.9
go1.16.9 (released 2021-10-07) includes a security fix to the linker and misc/wasm
directory, as well as bug fixes to the runtime and to the text/template package.
See the Go 1.16.9 milestone on our issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.16.9+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-10-08 15:18:20 +02:00
Silvin Lubecki e978593bd8
Merge pull request #3234 from crazy-max/gha-build
GitHub Actions cross
2021-10-01 10:08:41 +02:00
CrazyMax d9f4352c26
GitHub Actions cross
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2021-09-26 18:01:55 +02:00
Sebastiaan van Stijn 01fa5d925a
Update Go to 1.16.8
This includes additional fixes for CVE-2021-39293.

go1.16.8 (released 2021-09-09) includes a security fix to the archive/zip package,
as well as bug fixes to the archive/zip, go/internal/gccgoimporter, html/template,
net/http, and runtime/pprof packages. See the Go 1.16.8 milestone on the issue
tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.16.8+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-09-15 13:26:11 +02:00
Sebastiaan van Stijn 818564af51
cli/compose: use go1.16 native embed functionality for schemas
This allows us to drop the `//go:generate` and use of the github.com/mjibson/esc
utility.

worth noting that Go's native "embed" does not compress files. We could compress
these files as part of a build / validate step (which would add some complexity
when updating these files) if this is a concern, but not sure if the additional
complexity is warranted.

Comparing before/after sizes (see below);

    macOS: 54125840 - 54005264 = 120576 (+120.58 kB)
    Linux: 52393231 - 52277701 = 115530 (+115.53 kB)

Before:

    ls -l build/
    total 208736
    lrwxr-xr-x  1 sebastiaan  staff        19 Aug 15 09:36 docker@ -> docker-linux-amd64
    -rwxr-xr-x  1 sebastiaan  staff  54005264 Aug 15 09:35 docker-darwin-amd64*
    -rwxr-xr-x  1 sebastiaan  staff  52277701 Aug 15 09:36 docker-linux-amd64*

After:

    ls -l build/
    total 208960
    lrwxr-xr-x  1 sebastiaan  staff        18 Aug 15 09:32 docker@ -> docker-linux-amd64
    -rwxr-xr-x  1 sebastiaan  staff  54125840 Aug 15 09:31 docker-darwin-amd64*
    -rwxr-xr-x  1 sebastiaan  staff  52393231 Aug 15 09:32 docker-linux-amd64*

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-15 10:04:13 +02:00
Sebastiaan van Stijn 3112b382a3
Update Go to 1.16.7
go1.16.7 (released 2021-08-05) includes a security fix to the net/http/httputil
package, as well as bug fixes to the compiler, the linker, the runtime, the go
command, and the net/http package. See the Go 1.16.7 milestone on the issue
tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.16.7+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-08-07 18:20:39 +02:00
CrazyMax 698c155478
GitHub Actions for lint
Signed-off-by: CrazyMax <crazy-max@users.noreply.github.com>
2021-08-05 08:44:21 +02:00
Sebastiaan van Stijn a477a727fc
Update to go1.16.6
Keeping the dockerfiles/Dockerfile.cross image at 1.13, as we don't
have more current versions of that image. However, I don't think it's
still used, so we should remove it.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-07-29 11:52:02 +02:00
Sebastiaan van Stijn 60fe322434
e2e: update gotestsum to v1.7.0
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-07-28 19:44:11 +02:00
Sebastiaan van Stijn 91c7569a7a
Merge pull request #3140 from thaJeztah/update_e2e_compose
e2e: update docker-compose to 1.29.2
2021-07-26 15:33:48 +02:00
Sebastiaan van Stijn 48dbf6f3cf
Update Dockerfiles to latest syntax, remove "experimental"
The experimental image is deprecated (now "labs"), and the features we use
are now included in the regular (stable) syntax.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-07-22 14:48:09 +02:00
Sebastiaan van Stijn 524e3b215d
e2e: update docker-compose to 1.29.2
Newer versions have COMPOSE_DOCKER_CLI_BUILD enabled by default,
so removing that env-var.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2021-06-16 11:37:41 +02:00
Sebastiaan van Stijn 8328ee1965
Bump vndr v0.1.2
full diff: https://github.com/LK4D4/vndr/compare/v0.1.1...v0.1.2

- cleanVCS: prevent panic
- Consider '.syso' as a Go file for vendoring

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-10-16 01:32:00 +02:00
Sebastiaan van Stijn 01cd748eb6
Dockerfile: use experimental syntax and buildkit cache-mounts
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-09-08 10:30:18 +02:00
Sebastiaan van Stijn ab72cc923c
Dockerfile: use bash as default command, remove DOCKER_CLI_SHELL
Bash is installed already, so we might as well use it as a default.

This also removes the DOCKER_CLI_SHELL variable, which  was added
in  b039db985a to allow using bash
instead of (a)sh. Now that Bash is the default, there should be
no need to override, and we can keep things simple.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-09-08 10:27:12 +02:00
Sebastiaan van Stijn 7c66213f82
Dockerfile: build gotestsum from source
Building form source is slower, but will support other architectures, such as arm64

Before:

     => [gotestsum 1/2] ADD https://github.com/gotestyourself/gotestsum/releases/download/v0.4.0/gotestsum_0.4.0_linux_amd64.tar.gz gotestsum.tar.gz  2.3s
     => [gotestsum 2/2] RUN tar -xf gotestsum.tar.gz gotestsum -C /go/bin                                                                             1.8s

After:

    => [gotestsum 1/1] RUN go get gotest.tools/gotestsum@v0.4.0                                                                                       13.0s

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-09-08 10:27:06 +02:00
Sebastiaan van Stijn 01d6d2e7a7
Dockerfile: refactor to use multi-stage build
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-09-08 10:25:22 +02:00
Sebastiaan van Stijn 0b8f46b061
Dockerfile: fix dynbinary inside dev container
Running `make dynbinary` inside the dev-container failed because
gcc was not installed. Adding the `build-base` metapackage, which
has gcc, make, g++ and other packages that are needed.

Before this change:

    $ make -f docker.Makefile shell
    $$ make dynbinary
    ./scripts/build/dynbinary
    Building dynamically linked build/docker-linux-amd64
    # github.com/docker/cli/cmd/docker
    /usr/local/go/pkg/tool/linux_amd64/link: running gcc failed: exec: "gcc": executable file not found in $PATH
    make: *** [Makefile:63: dynbinary] Error 2

With this patch applied

    $ make -f docker.Makefile shell
    $$ make dynbinary
    ./scripts/build/dynbinary
    Building dynamically linked build/docker-linux-amd64
    $$ echo $?
    0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-08-28 16:25:15 +02:00
Sebastiaan van Stijn 43bc718895
Dockerfiles: update shellcheck v0.7.1
full diff: https://github.com/koalaman/shellcheck/compare/v0.7.0...v0.7.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-08-20 15:46:07 +02:00
Sebastiaan van Stijn 2315975272
Bump Golang 1.13.15
full diff: https://github.com/golang/go/compare/go1.13.14...go1.13.15

go1.13.15 (released 2020/08/06) includes security fixes to the encoding/binary
package. See the Go 1.13.15 milestone on the issue tracker for details.

https://github.com/golang/go/issues?q=milestone%3AGo1.13.15+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-08-10 17:24:48 +02:00
Sebastiaan van Stijn cdfafe03e3
Bump Golang 1.13.14
full diff: https://github.com/golang/go/compare/go1.13.13...go1.13.14

go1.13.14 (released 2020/07/16) includes fixes to the compiler, vet, and the
database/sql, net/http, and reflect packages. See the Go 1.13.14 milestone on
the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.14+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-07-17 15:44:54 +02:00
Sebastiaan van Stijn dc4f7fb375
Bump Golang 1.13.13
full diff: https://github.com/golang/go/compare/go1.13.12...go1.13.13

go1.13.13 (released 2020/07/14) includes security fixes to the crypto/x509 and
net/http packages. See the Go 1.13.13 milestone on the issue tracker for details.

https://github.com/golang/go/issues?q=milestone%3AGo1.13.13+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-07-16 15:45:25 +02:00
Sebastiaan van Stijn 1cd69c41e6
Bump Golang 1.13.12
go1.13.12 (released 2020/06/01) includes fixes to the runtime, and the go/types
and math/big packages. See the Go 1.13.12 milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.12+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.13.11...go1.13.12

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-06-03 12:25:39 +02:00
Sebastiaan van Stijn 1ecca982ed
Bump Golang 1.13.11
full diff: https://github.com/golang/go/compare/go1.13.10...go1.13.11

go1.13.11 (released 2020/05/14) includes fixes to the compiler. See the Go 1.13.11
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.11+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-05-18 15:58:42 +02:00
Sebastiaan van Stijn 6875390131
Bump Golang 1.13.10
go1.13.10 (released 2020/04/08) includes fixes to the go command, the runtime,
os/exec, and time packages. See the Go 1.13.10 milestone on the issue tracker
for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.10+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.13.9...go1.13.10

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-04-09 22:25:39 +02:00
Sebastiaan van Stijn d063b835b3
Bump Golang 1.13.9
go1.13.9 (released 2020/03/19) includes fixes to the go command, tools, the
runtime, the toolchain, and the crypto/cypher package. See the Go 1.13.9
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.13.9+label%3ACherryPickApproved

full diff: https://github.com/golang/go/compare/go1.13.8...go1.13.9

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-04-04 02:23:13 +02:00
Sebastiaan van Stijn f64c1ff3cf
update shellcheck v0.7.0
full diff: https://github.com/koalaman/shellcheck/compare/v0.6.0...v0.7.0

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-11 20:59:46 +01:00
Silvin Lubecki 2e4dcacddb
Merge pull request #2360 from thaJeztah/bump_golang_1.13
Update Golang 1.13.8
2020-02-26 15:33:27 +01:00
Silvin Lubecki e67b4b4be2
Merge pull request #2335 from thaJeztah/silence_curl_and_follow_redirects
Dockerfile.e2e: don't show progress, force TLS, and follow redirects
2020-02-26 14:32:02 +01:00
Sebastiaan van Stijn 4313c8b3c6
Update Golang 1.13.8
Also pinning the e2e image to the "buster" variant,
which is what's currently used, but making it explicit.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-26 11:16:35 +01:00
Sebastiaan van Stijn 5e5ef9e0b9
Update Golang 1.12.17
full diff: https://github.com/golang/go/compare/go1.12.16...go1.12.17

go1.12.17 (released 2020/02/12) includes a fix to the runtime. See the Go 1.12.17
milestone on the issue tracker for details:

https://github.com/golang/go/issues?q=milestone%3AGo1.12.17+label%3ACherryPickApproved

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-17 12:05:53 +01:00
Sebastiaan van Stijn 1fefbdc29c
Dockerfile.e2e: don't show progress, force TLS, and follow redirects
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-13 15:17:40 +01:00
Sebastiaan van Stijn 7c54406951
update vndr v0.1.1
full diff: https://github.com/LK4D4/vndr/compare/v0.1.0...v0.1.1

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-02-12 12:48:24 +01:00
Sebastiaan van Stijn 19fd390c36
Update Golang 1.12.16 (CVE-2020-0601, CVE-2020-7919)
full diff: https://github.com/golang/go/compare/go1.12.15...go1.12.16

go1.12.16 (released 2020/01/28) includes two security fixes. One mitigates the
CVE-2020-0601 certificate verification bypass on Windows. The other affects only
32-bit architectures.

https://github.com/golang/go/issues?q=milestone%3AGo1.12.16+label%3ACherryPickApproved

- X.509 certificate validation bypass on Windows 10
  A Windows vulnerability allows attackers to spoof valid certificate chains when
  the system root store is in use. These releases include a mitigation for Go
  applications, but it’s strongly recommended that affected users install the
  Windows security update to protect their system.
  This issue is CVE-2020-0601 and Go issue golang.org/issue/36834.
- Panic in crypto/x509 certificate parsing and golang.org/x/crypto/cryptobyte
  On 32-bit architectures, a malformed input to crypto/x509 or the ASN.1 parsing
  functions of golang.org/x/crypto/cryptobyte can lead to a panic.
  The malformed certificate can be delivered via a crypto/tls connection to a
  client, or to a server that accepts client certificates. net/http clients can
  be made to crash by an HTTPS server, while net/http servers that accept client
  certificates will recover the panic and are unaffected.
  Thanks to Project Wycheproof for providing the test cases that led to the
  discovery of this issue. The issue is CVE-2020-7919 and Go issue golang.org/issue/36837.
  This is also fixed in version v0.0.0-20200124225646-8b5121be2f68 of golang.org/x/crypto/cryptobyte.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-29 11:23:02 +01:00
Sebastiaan van Stijn 594be50a63
bump gotestsum v0.4.0
full diff: https://github.com/gotestyourself/gotestsum/compare/v0.3.5...v0.4.0

includes:

- gotestyourself/gotestsum#59 Report if a package was cached in short formats
- gotestyourself/gotestsum#63 always colorize output unless specifically requested not to
- gotestyourself/gotestsum#61 Improve short-verbose output for tests in CWD
- gotestyourself/gotestsum#70 https://github.com/gotestyourself/gotestsum/pull/70
- gotestyourself/gotestsum#73 Add short-with-failures format

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-01-27 17:48:01 +01:00