Skip to content

Commit 323dc52

Browse files
alderneroaknuds1
aldernero
and
aknuds1
authored
Bugfix release for v2.6 to fix CVE-2023-24538 (#4798)
* Bugfix release to fix CVE-2023-24538 * updated jsonnet tests * fixed Makefile merge * updated Makefile * update .golangci.yml * make doc * Update v2.6.md --------- Co-authored-by: Arve Knudsen <[email protected]>
1 parent d51e7c1 commit 323dc52

File tree

49 files changed

+445
-419
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

49 files changed

+445
-419
lines changed

‎.github/workflows/compare-helm-with-jsonnet.yml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,10 +13,10 @@ jobs:
1313
compare-manifests:
1414
runs-on: ubuntu-latest
1515
steps:
16-
- uses: actions/checkout@v2
16+
- uses: actions/checkout@v3
1717
- uses: actions/setup-go@v3
1818
with:
19-
go-version: '1.19.3'
19+
go-version: '1.20.3'
2020
- uses: helm/[email protected]
2121
- name: Download yq
2222
uses: dsaltares/fetch-gh-release-asset@d9376dacd30fd38f49238586cd2e9295a8307f4c

‎.github/workflows/helm-ci.yml‎

Lines changed: 6 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -18,10 +18,13 @@ jobs:
1818
conftest:
1919
runs-on: ubuntu-latest
2020
container:
21-
image: grafana/mimir-build-image:pr3976-e7cae18e3
21+
image: grafana/mimir-build-image:chore-upgrade-go-1203-5c4c29f01
2222
steps:
23-
- name: Checkout repository
24-
uses: actions/checkout@v2
23+
- name: Check out repository
24+
uses: actions/checkout@v3
25+
26+
- name: Run Git Config
27+
run: git config --global --add safe.directory '*'
2528

2629
- name: Lint Rego Policies
2730
run: make BUILD_IN_CONTAINER=false check-conftest-fmt

‎.github/workflows/test-build-deploy.yml‎

Lines changed: 53 additions & 38 deletions
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,12 @@ jobs:
2020
lint:
2121
runs-on: ubuntu-latest
2222
container:
23-
image: grafana/mimir-build-image:pr3976-e7cae18e3
23+
image: grafana/mimir-build-image:chore-upgrade-go-1203-5c4c29f01
2424
steps:
25-
- name: Checkout repository
26-
uses: actions/checkout@v2
25+
- name: Check out repository
26+
uses: actions/checkout@v3
27+
- name: Run Git Config
28+
run: git config --global --add safe.directory '*'
2729
# Commands in the Makefile are hardcoded with an assumed file structure of the CI container
2830
# Symlink ensures paths specified in previous commands don’t break
2931
- name: Symlink Expected Path to Workspace
@@ -48,25 +50,26 @@ jobs:
4850
doc-validator:
4951
runs-on: ubuntu-latest
5052
container:
51-
image: grafana/doc-validator:v1.5.0
53+
image: grafana/doc-validator:v1.9.0
5254
steps:
53-
- name: Checkout repository
54-
# This workflow intentionally uses v1 of checkout because
55-
# the doc-validator image does not contain the expected shared
56-
# libraries for the NodeJS packages injected by later versions.
57-
uses: actions/checkout@v1
55+
- name: Check out repository
56+
uses: actions/checkout@v3
57+
- name: Run Git Config
58+
run: git config --global --add safe.directory '*'
5859
- name: Run doc-validator tool (mimir)
59-
run: doc-validator ./docs/sources/mimir
60+
run: doc-validator ./docs/sources/mimir /docs/mimir/latest
6061
- name: Run doc-validator tool (helm-charts)
61-
run: doc-validator ./docs/sources/helm-charts
62+
run: doc-validator ./docs/sources/helm-charts /docs/mimir/latest
6263

6364
lint-jsonnet:
6465
runs-on: ubuntu-latest
6566
container:
66-
image: grafana/mimir-build-image:pr3976-e7cae18e3
67+
image: grafana/mimir-build-image:chore-upgrade-go-1203-5c4c29f01
6768
steps:
68-
- name: Checkout repository
69-
uses: actions/checkout@v2
69+
- name: Check out repository
70+
uses: actions/checkout@v3
71+
- name: Run Git Config
72+
run: git config --global --add safe.directory '*'
7073
# Commands in the Makefile are hardcoded with an assumed file structure of the CI container
7174
# Symlink ensures paths specified in previous commands don’t break
7275
- name: Symlink Expected Path to Workspace
@@ -87,18 +90,20 @@ jobs:
8790
lint-helm:
8891
runs-on: ubuntu-latest
8992
container:
90-
image: grafana/mimir-build-image:pr3976-e7cae18e3
93+
image: grafana/mimir-build-image:chore-upgrade-go-1203-5c4c29f01
9194
steps:
92-
- name: Checkout repository
93-
uses: actions/checkout@v2
95+
- name: Check out repository
96+
uses: actions/checkout@v3
97+
- name: Run Git Config
98+
run: git config --global --add safe.directory '*'
9499
# Commands in the Makefile are hardcoded with an assumed file structure of the CI container
95100
# Symlink ensures paths specified in previous commands don’t break
96101
- name: Symlink Expected Path to Workspace
97102
run: |
98103
mkdir -p /go/src/github.com/grafana/mimir
99104
ln -s $GITHUB_WORKSPACE/* /go/src/github.com/grafana/mimir
100105
- name: Set up Helm
101-
uses: azure/setup-helm@v1
106+
uses: azure/setup-helm@v3
102107
with:
103108
version: v3.8.2
104109
- name: Check Helm Tests
@@ -114,10 +119,12 @@ jobs:
114119
test_group_id: [0, 1, 2, 3]
115120
test_group_total: [4]
116121
container:
117-
image: grafana/mimir-build-image:pr3976-e7cae18e3
122+
image: grafana/mimir-build-image:chore-upgrade-go-1203-5c4c29f01
118123
steps:
119-
- name: Checkout repository
120-
uses: actions/checkout@v2
124+
- name: Check out repository
125+
uses: actions/checkout@v3
126+
- name: Run Git Config
127+
run: git config --global --add safe.directory '*'
121128
- name: Symlink Expected Path to Workspace
122129
run: |
123130
mkdir -p /go/src/github.com/grafana/mimir
@@ -130,8 +137,10 @@ jobs:
130137
test-docs:
131138
runs-on: ubuntu-latest
132139
steps:
133-
- name: "Check out code"
134-
uses: "actions/checkout@v3"
140+
- name: Check out repository
141+
uses: actions/checkout@v3
142+
- name: Run Git Config
143+
run: git config --global --add safe.directory '*'
135144
- name: "Build website"
136145
run: |
137146
docker run \
@@ -145,17 +154,19 @@ jobs:
145154
build:
146155
runs-on: ubuntu-latest
147156
container:
148-
image: grafana/mimir-build-image:pr3976-e7cae18e3
157+
image: grafana/mimir-build-image:chore-upgrade-go-1203-5c4c29f01
149158
steps:
150-
- name: Checkout repository
151-
uses: actions/checkout@v2
159+
- name: Check out repository
160+
uses: actions/checkout@v3
161+
- name: Run Git Config
162+
run: git config --global --add safe.directory '*'
152163
- name: Install Docker Client
153164
run: ./.github/workflows/scripts/install-docker.sh
154165
- name: Set up QEMU
155-
uses: docker/setup-qemu-action@v1
166+
uses: docker/setup-qemu-action@v2
156167
- name: Set up Docker Buildx
157168
id: buildx
158-
uses: docker/setup-buildx-action@v1
169+
uses: docker/setup-buildx-action@v2
159170
- name: Symlink Expected Path to Workspace
160171
run: |
161172
mkdir -p /go/src/github.com/grafana/mimir
@@ -168,7 +179,7 @@ jobs:
168179
run: |
169180
tar cvf images.tar /tmp/images
170181
- name: Upload Archive with Docker Images
171-
uses: actions/upload-artifact@v2
182+
uses: actions/upload-artifact@v3
172183
with:
173184
name: Docker Images
174185
path: ./images.tar
@@ -185,19 +196,21 @@ jobs:
185196
test_group_total: [4]
186197
steps:
187198
- name: Upgrade golang
188-
uses: actions/setup-go@v2
199+
uses: actions/setup-go@v3
189200
with:
190-
go-version: 1.19.3
191-
- name: Checkout repository
192-
uses: actions/checkout@v2
201+
go-version: 1.20.3
202+
- name: Check out repository
203+
uses: actions/checkout@v3
204+
- name: Run Git Config
205+
run: git config --global --add safe.directory '*'
193206
- name: Install Docker Client
194207
run: sudo ./.github/workflows/scripts/install-docker.sh
195208
- name: Symlink Expected Path to Workspace
196209
run: |
197210
sudo mkdir -p /go/src/github.com/grafana/mimir
198211
sudo ln -s $GITHUB_WORKSPACE/* /go/src/github.com/grafana/mimir
199212
- name: Download Archive with Docker Images
200-
uses: actions/download-artifact@v2
213+
uses: actions/download-artifact@v3
201214
with:
202215
name: Docker Images
203216
- name: Extract Docker Images from Archive
@@ -231,18 +244,20 @@ jobs:
231244
if: (startsWith(github.ref, 'refs/tags/') || startsWith(github.ref, 'refs/heads/r') ) && github.event_name == 'push' && github.repository == 'grafana/mimir'
232245
runs-on: ubuntu-latest
233246
container:
234-
image: grafana/mimir-build-image:pr3976-e7cae18e3
247+
image: grafana/mimir-build-image:chore-upgrade-go-1203-5c4c29f01
235248
steps:
236-
- name: Checkout repository
237-
uses: actions/checkout@v2
249+
- name: Check out repository
250+
uses: actions/checkout@v3
251+
- name: Run Git Config
252+
run: git config --global --add safe.directory '*'
238253
- name: Install Docker Client
239254
run: ./.github/workflows/scripts/install-docker.sh
240255
- name: Symlink Expected Path to Workspace
241256
run: |
242257
mkdir -p /go/src/github.com/grafana/mimir
243258
ln -s $GITHUB_WORKSPACE/* /go/src/github.com/grafana/mimir
244259
- name: Download Archive with Docker Images
245-
uses: actions/download-artifact@v2
260+
uses: actions/download-artifact@v3
246261
with:
247262
name: Docker Images
248263
- name: Extract Docker Images from Archive

‎.golangci.yml‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,7 @@ output:
22
format: line-number
33

44
linters:
5+
disable-all: true
56
enable:
67
- goimports
78
- revive
@@ -30,6 +31,7 @@ linters-settings:
3031

3132
run:
3233
timeout: 5m
34+
go: '1.20'
3335

3436
# List of build tags, all linters use it.
3537
build-tags:

‎CHANGELOG.md‎

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,11 @@
11
# Changelog
22

3+
## 2.6.1
4+
5+
### Grafana Mimir
6+
7+
* [BUGFIX] Security: updates Go to version 1.20.3 to fix CVE-2023-24538 #4798
8+
39
## 2.6.0
410

511
### Grafana Mimir

‎Makefile‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -198,7 +198,7 @@ mimir-build-image/$(UPTODATE): mimir-build-image/*
198198
# All the boiler plate for building golang follows:
199199
SUDO := $(shell docker info >/dev/null 2>&1 || echo "sudo -E")
200200
BUILD_IN_CONTAINER ?= true
201-
LATEST_BUILD_IMAGE_TAG ?= pr3976-e7cae18e3
201+
LATEST_BUILD_IMAGE_TAG ?= chore-upgrade-go-1203-5c4c29f01
202202

203203
# TTY is parameterized to allow Google Cloud Builder to run builds,
204204
# as it currently disallows TTY devices. This value needs to be overridden
@@ -674,4 +674,4 @@ test-packages: packages packaging/rpm/centos-systemd/$(UPTODATE) packaging/deb/d
674674
./tools/packaging/test-packages $(IMAGE_PREFIX) $(VERSION)
675675

676676
include docs/docs.mk
677-
docs: doc
677+
docs: doc

‎VERSION‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1 +1 @@
1-
2.6.0
1+
2.6.1

‎development/mimir-microservices-mode/dev.dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
FROM golang:1.19.3
1+
FROM golang:1.20.3
22
ENV CGO_ENABLED=0
3-
RUN go install github.com/go-delve/delve/cmd/dlv@v1.9.1
3+
RUN go install github.com/go-delve/delve/cmd/dlv@v1.20.2
44

5-
FROM alpine:3.17.1
5+
FROM alpine:3.17.3
66

77
RUN mkdir /mimir
88
WORKDIR /mimir

‎development/mimir-read-write-mode/dev.dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
1-
FROM golang:1.18.4
1+
FROM golang:1.20.3
22
ENV CGO_ENABLED=0
3-
RUN go install github.com/go-delve/delve/cmd/dlv@v1.7.3
3+
RUN go install github.com/go-delve/delve/cmd/dlv@v1.20.2
44

5-
FROM alpine:3.17.1
5+
FROM alpine:3.17.3
66

77
RUN mkdir /mimir
88
WORKDIR /mimir

‎mimir-build-image/Dockerfile‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,8 +4,8 @@
44
# Provenance-includes-copyright: The Cortex Authors.
55

66
FROM k8s.gcr.io/kustomize/kustomize:v4.5.5 as kustomize
7-
FROM alpine/helm:3.8.2 as helm
8-
FROM golang:1.19.3-bullseye
7+
FROM alpine/helm:3.11.1 as helm
8+
FROM golang:1.20.3-bullseye
99
ARG goproxyValue
1010
ENV GOPROXY=${goproxyValue}
1111
ENV SKOPEO_DEPS="libgpgme-dev libassuan-dev libbtrfs-dev libdevmapper-dev pkg-config"
@@ -35,7 +35,7 @@ RUN GOARCH=$(go env GOARCH) && \
3535
curl -fSL -o "/usr/bin/tk" "https://github.com/grafana/tanka/releases/download/v${TANKA_VERSION}/tk-linux-${GOARCH}" && \
3636
chmod a+x /usr/bin/tk
3737

38-
RUN curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b /usr/bin v1.49.0
38+
RUN curl -sfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh| sh -s -- -b /usr/bin v1.51.2
3939

4040
ENV SKOPEO_VERSION=v1.10.0
4141
RUN git clone --depth 1 --branch ${SKOPEO_VERSION} https://github.com/containers/skopeo /go/src/github.com/containers/skopeo && \

0 commit comments

Comments
 (0)