Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Fixing CVE issues by bumping GO and Text versions. #173

Merged
merged 4 commits into from
Aug 10, 2022
Merged

Conversation

atshaw43
Copy link
Contributor

@atshaw43 atshaw43 commented Aug 9, 2022

Issue #, if available:
Internally tracked

Description of changes:
Bumping GO to version 1.18.
Bumping golang.org/x/text to v0.3.7
Bumping golang.org/x/net to v0.0.0-20220809184613-07c6da5e1ced
Bumping golang.org/x/sys to v0.0.0-20220808155132-1c4a2a72c664

Testing
Ran 'make test'.
Ran the code in Docker. Validated that the container was running.

@atshaw43 atshaw43 requested a review from a team as a code owner August 9, 2022 18:04
go.sum Outdated
@@ -25,14 +25,11 @@ golang.org/x/net v0.0.0-20200202094626-16171245cfb2/go.mod h1:z5CRVTTTmAJ677TzLL
golang.org/x/net v0.0.0-20210716203947-853a461950ff h1:j2EK/QoxYNBsXI4R7fQkkRUk8y6wnOBI+6hgPdP/6Ds=
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This file is auto-generated.

@@ -1,15 +1,23 @@
module github.com/aws/aws-xray-daemon
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I changed the GO and golang.org/x/text version manually. The other changes were auto-generated by go mod tidy. That includes the additional require block.

@atshaw43
Copy link
Contributor Author

atshaw43 commented Aug 9, 2022

aws-xray-daemon % make test
Testing daemon
go test -cover ./...
? github.com/aws/aws-xray-daemon/cmd/tracing [no test files]
ok github.com/aws/aws-xray-daemon/pkg/bufferpool 1.313s coverage: 100.0% of statements
ok github.com/aws/aws-xray-daemon/pkg/cfg 5.526s coverage: 57.6% of statements
ok github.com/aws/aws-xray-daemon/pkg/cli 1.031s coverage: 80.0% of statements
ok github.com/aws/aws-xray-daemon/pkg/conn 5.466s coverage: 67.9% of statements
ok github.com/aws/aws-xray-daemon/pkg/logger 2.257s coverage: 33.3% of statements
ok github.com/aws/aws-xray-daemon/pkg/processor 2.698s coverage: 84.9% of statements
? github.com/aws/aws-xray-daemon/pkg/profiler [no test files]
ok github.com/aws/aws-xray-daemon/pkg/proxy 4.521s coverage: 70.4% of statements
ok github.com/aws/aws-xray-daemon/pkg/ringbuffer 5.486s coverage: 85.7% of statements
? github.com/aws/aws-xray-daemon/pkg/socketconn [no test files]
? github.com/aws/aws-xray-daemon/pkg/socketconn/udp [no test files]
ok github.com/aws/aws-xray-daemon/pkg/telemetry 5.376s coverage: 18.4% of statements
ok github.com/aws/aws-xray-daemon/pkg/tracesegment 1.392s coverage: 88.9% of statements
ok github.com/aws/aws-xray-daemon/pkg/util 1.875s coverage: 96.3% of statements
ok github.com/aws/aws-xray-daemon/pkg/util/test 3.383s coverage: 77.1% of statements
? github.com/aws/aws-xray-daemon/pkg/util/timer [no test files]

@@ -1,15 +1,23 @@
module github.com/aws/aws-xray-daemon

go 1.16
go 1.18
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

In order to affect the version of Golang used in the Docker images, we need to update the version of the Golang base image in the Dockerfiles:

  1. https://github.com/aws/aws-xray-daemon/blob/master/Dockerfile.amazonlinux#L2
  2. https://github.com/aws/aws-xray-daemon/blob/master/Dockerfile#L2

And we should bump the version of Go we use in the CI/CD too probably, e.g.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Good catch. That was off my radar.

go.mod Outdated
Comment on lines 10 to 11
golang.org/x/net v0.0.0-20210716203947-853a461950ff
golang.org/x/sys v0.0.0-20210423082822-04245dca01da
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we bump the net and sys packages to latest as well?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Done

Updating the Go version
@atshaw43
Copy link
Contributor Author

image

Docker runs after upgrading the version.

Copy link
Contributor

@willarmiros willarmiros left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm thanks!

@atshaw43 atshaw43 merged commit 968d0d3 into master Aug 10, 2022
@wangzlei wangzlei deleted the atshaw43 branch March 28, 2024 18:40
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants