Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[chore] Upgrade go version in CI #8172

Merged
merged 1 commit into from
Aug 3, 2023
Merged

Conversation

dmitryax
Copy link
Member

@dmitryax dmitryax commented Aug 3, 2023

To resolve the govulncheck reports:

Vulnerability #1: GO-2023-1987
    Large RSA keys can cause high CPU usage in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2023-1987
  Standard library
    Found in: crypto/tls@go1.19.11
    Fixed in: crypto/tls@go1.21rc4
    Example traces found:
Error:       #1: service/internal/proctelemetry/config.go:299:27: proctelemetry.initOTLPgRPCExporter calls otlpmetricgrpc.New, which eventually calls tls.Conn.Handshake
Error:       #2: service/internal/proctelemetry/config.go:156:39: proctelemetry.InitPrometheusServer calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
Error:       #3: service/service.go:251:36: service.buildResource calls uuid.NewRandom, which eventually calls tls.Conn.Read
Error:       #4: service/config.go:35:13: service.Config.Validate calls fmt.Printf, which eventually calls tls.Conn.Write
Error:       #5: service/telemetry/telemetry.go:32:28: telemetry.Telemetry.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls tls.Dialer.DialContext

https://github.com/open-telemetry/opentelemetry-collector/actions/runs/5753675727/job/15597394973?pr=8144

To resolve the govulncheck reports:
```
Vulnerability #1: GO-2023-1987
    Large RSA keys can cause high CPU usage in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2023-1987
  Standard library
    Found in: crypto/tls@go1.19.11
    Fixed in: crypto/tls@go1.21rc4
    Example traces found:
Error:       #1: service/internal/proctelemetry/config.go:299:27: proctelemetry.initOTLPgRPCExporter calls otlpmetricgrpc.New, which eventually calls tls.Conn.Handshake
Error:       #2: service/internal/proctelemetry/config.go:156:39: proctelemetry.InitPrometheusServer calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
Error:       #3: service/service.go:251:36: service.buildResource calls uuid.NewRandom, which eventually calls tls.Conn.Read
Error:       #4: service/config.go:35:13: service.Config.Validate calls fmt.Printf, which eventually calls tls.Conn.Write
Error:       #5: service/telemetry/telemetry.go:32:28: telemetry.Telemetry.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls tls.Dialer.DialContext
```
@dmitryax dmitryax requested review from a team and bogdandrutu August 3, 2023 17:25
@codecov
Copy link

codecov bot commented Aug 3, 2023

Codecov Report

Patch and project coverage have no change.

Comparison is base (3089ea8) 90.25% compared to head (9e26089) 90.25%.
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #8172   +/-   ##
=======================================
  Coverage   90.25%   90.25%           
=======================================
  Files         301      301           
  Lines       15551    15551           
=======================================
  Hits        14035    14035           
  Misses       1227     1227           
  Partials      289      289           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@dmitryax dmitryax changed the title [chore] Upgrade go version [chore] Upgrade go version in CI Aug 3, 2023
@dmitryax dmitryax merged commit 8aeb3ab into open-telemetry:main Aug 3, 2023
29 checks passed
@dmitryax dmitryax deleted the upgrade-go branch August 6, 2023 22:33
@codeboten codeboten added this to the v0.83.0 milestone Aug 24, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants