Skip to content

Commit d9da9de

Browse files
author
Paulo Gomes
authored
Merge pull request #442 from pjbgf/update-git2go
Update dependencies
2 parents 0eec37b + cd5e074 commit d9da9de

File tree

10 files changed

+95
-337
lines changed

10 files changed

+95
-337
lines changed

‎.github/workflows/build.yaml

+3
Original file line numberDiff line numberDiff line change
@@ -51,6 +51,7 @@ jobs:
5151
# We should reenable go test -race for arm64 runners once the
5252
# current issue is resolved.
5353
GO_TEST_ARGS: ""
54+
SKIP_COSIGN_VERIFICATION: true
5455
- name: Verify
5556
run: make verify
5657

@@ -74,5 +75,7 @@ jobs:
7475
${{ runner.os }}-go-
7576
- name: Run tests
7677
run: make test
78+
env:
79+
SKIP_COSIGN_VERIFICATION: true
7780
- name: Verify
7881
run: make verify

‎.github/workflows/cifuzz.yaml

+2
Original file line numberDiff line numberDiff line change
@@ -26,3 +26,5 @@ jobs:
2626
${{ runner.os }}-go-
2727
- name: Smoke test Fuzzers
2828
run: make fuzz-smoketest
29+
env:
30+
SKIP_COSIGN_VERIFICATION: true

‎Dockerfile

+7-7
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ ARG GO_VERSION=1.19
33
ARG XX_VERSION=1.1.2
44

55
ARG LIBGIT2_IMG=ghcr.io/fluxcd/golang-with-libgit2-only
6-
ARG LIBGIT2_TAG=v0.2.0
6+
ARG LIBGIT2_TAG=v0.3.0
77

88
FROM ${LIBGIT2_IMG}:${LIBGIT2_TAG} AS libgit2-libs
99

@@ -62,12 +62,12 @@ ARG TARGETARCH
6262
ENV CGO_ENABLED=1
6363

6464
RUN export LIBRARY_PATH="/usr/local/$(xx-info triple)" && \
65-
export PKG_CONFIG_PATH="/usr/local/$(xx-info triple)/lib/pkgconfig" && \
66-
export CGO_LDFLAGS="$(pkg-config --static --libs --cflags libgit2) -static -fuse-ld=lld" && \
67-
xx-go build \
68-
-ldflags "-s -w" \
69-
-tags 'netgo,osusergo,static_build' \
70-
-o /image-automation-controller -trimpath main.go;
65+
export PKG_CONFIG_PATH="/usr/local/$(xx-info triple)/lib/pkgconfig" && \
66+
export CGO_LDFLAGS="$(pkg-config --static --libs --cflags libgit2) -static -fuse-ld=lld" && \
67+
xx-go build \
68+
-ldflags "-s -w" \
69+
-tags 'netgo,osusergo,static_build' \
70+
-o /image-automation-controller -trimpath main.go;
7171

7272
# Ensure that the binary was cross-compiled correctly to the target platform.
7373
RUN xx-verify --static /image-automation-controller

‎Makefile

+4-1
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,7 @@ CRD_OPTIONS ?= crd:crdVersions=v1
88

99
# Base image used to build the Go binary
1010
LIBGIT2_IMG ?= ghcr.io/fluxcd/golang-with-libgit2-only
11-
LIBGIT2_TAG ?= v0.2.0
11+
LIBGIT2_TAG ?= v0.3.0
1212

1313
# Allows for defining additional Docker buildx arguments,
1414
# e.g. '--push'.
@@ -19,6 +19,9 @@ BUILD_PLATFORMS ?= linux/amd64,linux/arm64,linux/arm/v7
1919
# Allows for defining additional Go test args, e.g. '-tags integration'.
2020
GO_TEST_ARGS ?= -race
2121

22+
# Defines whether cosign verification should be skipped.
23+
SKIP_COSIGN_VERIFICATION ?= false
24+
2225
# Directory with versioned, downloaded things
2326
CACHE := cache
2427

‎api/go.mod

+3-6
Original file line numberDiff line numberDiff line change
@@ -3,15 +3,12 @@ module github.com/fluxcd/image-automation-controller/api
33
go 1.18
44

55
require (
6-
github.com/fluxcd/pkg/apis/meta v0.15.0
6+
github.com/fluxcd/pkg/apis/meta v0.16.0
77
github.com/fluxcd/source-controller/api v0.29.0
8-
k8s.io/apimachinery v0.25.0
9-
sigs.k8s.io/controller-runtime v0.12.3
8+
k8s.io/apimachinery v0.25.2
9+
sigs.k8s.io/controller-runtime v0.13.0
1010
)
1111

12-
// Fix CVE-2022-28948
13-
replace gopkg.in/yaml.v3 => gopkg.in/yaml.v3 v3.0.0
14-
1512
require (
1613
github.com/fluxcd/pkg/apis/acl v0.1.0 // indirect
1714
github.com/go-logr/logr v1.2.3 // indirect

‎api/go.sum

+11-12
Original file line numberDiff line numberDiff line change
@@ -3,18 +3,18 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c
33
github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
44
github.com/fluxcd/pkg/apis/acl v0.1.0 h1:EoAl377hDQYL3WqanWCdifauXqXbMyFuK82NnX6pH4Q=
55
github.com/fluxcd/pkg/apis/acl v0.1.0/go.mod h1:zfEZzz169Oap034EsDhmCAGgnWlcWmIObZjYMusoXS8=
6-
github.com/fluxcd/pkg/apis/meta v0.15.0 h1:uDVzbDNdFjp0GSB9qMpcW6r4K7SAjBQlCxQENSkWgkQ=
7-
github.com/fluxcd/pkg/apis/meta v0.15.0/go.mod h1:7NkgFrlswnx2QxP16+8zVNDBf+VhZ7PsDhkcJY6OSgQ=
6+
github.com/fluxcd/pkg/apis/meta v0.16.0 h1:6Mj9rB0TtvCeTe3IlQDc1i2DH75Oosea9yUqS7XafVg=
7+
github.com/fluxcd/pkg/apis/meta v0.16.0/go.mod h1:GrOVzWXiu22XjLNgLLe2EBYhQPqZetes5SIADb4bmHE=
88
github.com/fluxcd/source-controller/api v0.29.0 h1:RyuHUCW7NtnHu61RbZUYhNWS+Nl0Z0rWS6a4aGGZZqE=
99
github.com/fluxcd/source-controller/api v0.29.0/go.mod h1:pqWB3brXYkacesoKGY96dTJRrafThY1VwDQy6md1W/4=
10-
github.com/fsnotify/fsnotify v1.5.1 h1:mZcQUHVQUQWoPXXtuf9yuEXKudkV2sx1E06UadKWpgI=
10+
github.com/fsnotify/fsnotify v1.5.4 h1:jRbGcIw6P2Meqdwuo0H1p6JVLbL5DHKAKlYndzMwVZI=
1111
github.com/go-logr/logr v0.1.0/go.mod h1:ixOQHD9gLJUVQQ2ZOR7zLEifBX6tGkNJF4QyIY7sIas=
1212
github.com/go-logr/logr v1.2.0/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
1313
github.com/go-logr/logr v1.2.3 h1:2DntVwHkVopvECVRSlL5PSo9eG+cAkDCuckLubN+rq0=
1414
github.com/go-logr/logr v1.2.3/go.mod h1:jdQByPbusPIv2/zmleS9BjJVeZ6kBagPoEUsqbVz/1A=
1515
github.com/gogo/protobuf v1.3.2 h1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=
1616
github.com/gogo/protobuf v1.3.2/go.mod h1:P1XiOD3dCwIKUDQYPy72D8LYyHL2YPYrpS2s69NZV8Q=
17-
github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ=
17+
github.com/google/go-cmp v0.5.8 h1:e6P7q2lk1O+qJJb4BtCQXlK8vWEO8V1ZeuEdJNOqZyg=
1818
github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
1919
github.com/google/gofuzz v1.2.0 h1:xRy4A+RhZaiKjJ1bPfwQ8sedCA+YS2YcCHW6ec7JMi0=
2020
github.com/google/gofuzz v1.2.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
@@ -31,7 +31,7 @@ github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjY
3131
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
3232
github.com/nxadm/tail v1.4.8 h1:nPr65rt6Y5JFSKQO7qToXr7pePgD6Gwiw05lkbyAQTE=
3333
github.com/onsi/ginkgo v1.16.5 h1:8xi0RTUf59SOSfEtZMvwTvXYMzG4gV23XVHOZiXNtnE=
34-
github.com/onsi/gomega v1.18.1 h1:M1GfJqGRrBrrGGsbxzV5dqM2U2ApXefZCQpkukxYRLE=
34+
github.com/onsi/gomega v1.20.1 h1:PA/3qinGoukvymdIDV8pii6tiZgC8kbmJO6Z5+b002Q=
3535
github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM=
3636
github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
3737
github.com/spf13/afero v1.2.2/go.mod h1:9ZxEEn6pIJ8Rxe320qSDBk6AsU0r9pR7Q4OcevTdifk=
@@ -70,7 +70,6 @@ golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4f
7070
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
7171
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
7272
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
73-
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
7473
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
7574
gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
7675
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f h1:BLraFXnmrev5lT+xlilqcH8XK9/i0At2xKjWk4p6zsU=
@@ -80,17 +79,17 @@ gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 h1:uRGJdciOHaEIrze2W8Q3AKkep
8079
gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
8180
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
8281
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
83-
gopkg.in/yaml.v3 v3.0.0 h1:hjy8E9ON/egN1tAYqKb61G10WtihqetD4sz2H+8nIeA=
84-
k8s.io/api v0.24.2 h1:g518dPU/L7VRLxWfcadQn2OnsiGWVOadTLpdnqgY2OI=
85-
k8s.io/apimachinery v0.25.0 h1:MlP0r6+3XbkUG2itd6vp3oxbtdQLQI94fD5gCS+gnoU=
86-
k8s.io/apimachinery v0.25.0/go.mod h1:qMx9eAk0sZQGsXGu86fab8tZdffHbwUfsvzqKn4mfB0=
82+
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
83+
k8s.io/api v0.25.0 h1:H+Q4ma2U/ww0iGB78ijZx6DRByPz6/733jIuFpX70e0=
84+
k8s.io/apimachinery v0.25.2 h1:WbxfAjCx+AeN8Ilp9joWnyJ6xu9OMeS/fsfjK/5zaQs=
85+
k8s.io/apimachinery v0.25.2/go.mod h1:hqqA1X0bsgsxI6dXsJ4HnNTBOmJNxyPp8dw3u2fSHwA=
8786
k8s.io/klog/v2 v2.0.0/go.mod h1:PBfzABfn139FHAV07az/IF9Wp1bkk3vpT2XSJ76fSDE=
8887
k8s.io/klog/v2 v2.70.1 h1:7aaoSdahviPmR+XkS7FyxlkkXs6tHISSG03RxleQAVQ=
8988
k8s.io/klog/v2 v2.70.1/go.mod h1:y1WjHnz7Dj687irZUWR/WLkLc5N1YHtjLdmgWjndZn0=
9089
k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed h1:jAne/RjBTyawwAy0utX5eqigAwz/lQhTmy+Hr/Cpue4=
9190
k8s.io/utils v0.0.0-20220728103510-ee6ede2d64ed/go.mod h1:jPW/WVKK9YHAvNhRxK0md/EJ228hCsBRufyofKtW8HA=
92-
sigs.k8s.io/controller-runtime v0.12.3 h1:FCM8xeY/FI8hoAfh/V4XbbYMY20gElh9yh+A98usMio=
93-
sigs.k8s.io/controller-runtime v0.12.3/go.mod h1:qKsk4WE6zW2Hfj0G4v10EnNB2jMG1C+NTb8h+DwCoU0=
91+
sigs.k8s.io/controller-runtime v0.13.0 h1:iqa5RNciy7ADWnIc8QxCbOX5FEKVR3uxVxKHRMc2WIQ=
92+
sigs.k8s.io/controller-runtime v0.13.0/go.mod h1:Zbz+el8Yg31jubvAEyglRZGdLAjplZl+PgtYNI6WNTI=
9493
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 h1:iXTIw73aPyC+oRdyqqvVJuloN1p0AC/kzH07hu3NE+k=
9594
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2/go.mod h1:B8JuhiUyNFVKdsE8h686QcCxMaH6HrOAZj4vswFpcB0=
9695
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 h1:PRbqxJClWWYMNV1dhaG4NsibJbArud9kFxnAMREiWFE=

‎go.mod

+21-28
Original file line numberDiff line numberDiff line change
@@ -4,27 +4,25 @@ go 1.18
44

55
replace github.com/fluxcd/image-automation-controller/api => ./api
66

7-
// A temporary fork of git2go was created to enable use
8-
// of libgit2 without thread support to fix:
9-
// fluxcd/image-automation-controller/#339.
7+
// Flux has its own git2go fork to enable changes in behaviour for improved
8+
// reliability.
109
//
11-
// This can be removed once libgit2/git2go#918 is merged.
12-
//
13-
// The fork automatically releases new patches based on upstream:
14-
// https://github.com/pjbgf/git2go/commit/d72e39cdc20f7fe014ba73072b01ba7b569e9253
15-
replace github.com/libgit2/git2go/v33 => github.com/pjbgf/git2go/v33 v33.0.9-nothread-check
10+
// For more information refer to:
11+
// - fluxcd/image-automation-controller/#339.
12+
// - libgit2/git2go#918.
13+
replace github.com/libgit2/git2go/v33 => github.com/fluxcd/git2go/v33 v33.0.9-flux
1614

1715
require (
1816
github.com/AdaLogics/go-fuzz-headers v0.0.0-20220903154154-e8044f6e4c72
1917
github.com/Masterminds/sprig/v3 v3.2.2
2018
github.com/ProtonMail/go-crypto v0.0.0-20220824120805-4b6e5c587895
2119
github.com/cyphar/filepath-securejoin v0.2.3
2220
github.com/fluxcd/image-automation-controller/api v0.25.0
23-
github.com/fluxcd/image-reflector-controller/api v0.21.0
21+
github.com/fluxcd/image-reflector-controller/api v0.22.0
2422
github.com/fluxcd/pkg/apis/acl v0.1.0
25-
github.com/fluxcd/pkg/apis/meta v0.15.0
23+
github.com/fluxcd/pkg/apis/meta v0.16.0
2624
github.com/fluxcd/pkg/gittestserver v0.7.0
27-
github.com/fluxcd/pkg/runtime v0.18.0
25+
github.com/fluxcd/pkg/runtime v0.19.0
2826
github.com/fluxcd/pkg/ssh v0.6.0
2927
github.com/fluxcd/source-controller v0.29.0
3028
github.com/fluxcd/source-controller/api v0.29.0
@@ -36,24 +34,18 @@ require (
3634
github.com/onsi/gomega v1.20.2
3735
github.com/otiai10/copy v1.7.0
3836
github.com/spf13/pflag v1.0.5
39-
golang.org/x/crypto v0.0.0-20220829220503-c86fa9a7ed90
40-
k8s.io/api v0.25.0
41-
k8s.io/apimachinery v0.25.0
42-
k8s.io/client-go v0.25.0
43-
k8s.io/kube-openapi v0.0.0-20220803164354-a70c9af30aea
44-
sigs.k8s.io/controller-runtime v0.12.3
37+
golang.org/x/crypto v0.0.0-20220926161630-eccd6366d1be
38+
k8s.io/api v0.25.2
39+
k8s.io/apimachinery v0.25.2
40+
k8s.io/client-go v0.25.2
41+
k8s.io/kube-openapi v0.0.0-20220927161751-b7a9e6fe3bb6
42+
sigs.k8s.io/controller-runtime v0.13.0
4543
sigs.k8s.io/kustomize/kyaml v0.13.9
4644
)
4745

48-
// Fix CVE-2022-28948
49-
replace gopkg.in/yaml.v3 => gopkg.in/yaml.v3 v3.0.1
50-
5146
// Fix CVE-2022-1996 (for v2, Go Modules incompatible)
5247
replace github.com/emicklei/go-restful => github.com/emicklei/go-restful v2.16.0+incompatible
5348

54-
// Fix CVE-2022-1996
55-
replace github.com/emicklei/go-restful/v3 => github.com/emicklei/go-restful/v3 v3.8.0
56-
5749
require (
5850
cloud.google.com/go/compute v1.7.0 // indirect
5951
github.com/Masterminds/goutils v1.1.1 // indirect
@@ -68,10 +60,11 @@ require (
6860
github.com/emicklei/go-restful/v3 v3.8.0 // indirect
6961
github.com/emirpasic/gods v1.18.1 // indirect
7062
github.com/evanphx/json-patch v5.6.0+incompatible // indirect
63+
github.com/evanphx/json-patch/v5 v5.6.0 // indirect
7164
github.com/fluxcd/gitkit v0.6.0 // indirect
7265
github.com/fluxcd/pkg/gitutil v0.2.0 // indirect
7366
github.com/fluxcd/pkg/version v0.2.0 // indirect
74-
github.com/fsnotify/fsnotify v1.5.1 // indirect
67+
github.com/fsnotify/fsnotify v1.5.4 // indirect
7568
github.com/go-errors/errors v1.0.1 // indirect
7669
github.com/go-git/gcfg v1.5.0 // indirect
7770
github.com/go-logr/zapr v1.2.3 // indirect
@@ -83,7 +76,7 @@ require (
8376
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
8477
github.com/golang/protobuf v1.5.2 // indirect
8578
github.com/google/gnostic v0.6.9 // indirect
86-
github.com/google/go-cmp v0.5.8 // indirect
79+
github.com/google/go-cmp v0.5.9 // indirect
8780
github.com/google/gofuzz v1.2.0 // indirect
8881
github.com/google/uuid v1.3.0 // indirect
8982
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
@@ -136,9 +129,9 @@ require (
136129
gopkg.in/warnings.v0 v0.1.2 // indirect
137130
gopkg.in/yaml.v2 v2.4.0 // indirect
138131
gopkg.in/yaml.v3 v3.0.1 // indirect
139-
k8s.io/apiextensions-apiserver v0.24.2 // indirect
140-
k8s.io/component-base v0.25.0 // indirect
141-
k8s.io/klog/v2 v2.70.1 // indirect
132+
k8s.io/apiextensions-apiserver v0.25.0 // indirect
133+
k8s.io/component-base v0.25.2 // indirect
134+
k8s.io/klog/v2 v2.80.1 // indirect
142135
k8s.io/utils v0.0.0-20220823124924-e9cbc92d1a73 // indirect
143136
sigs.k8s.io/cli-utils v0.33.0 // indirect
144137
sigs.k8s.io/json v0.0.0-20220713155537-f223a00ba0e2 // indirect

0 commit comments

Comments
 (0)