ewilliams28/releases
1
0
Fork 0
mirror of https://github.com/open-policy-agent/opa.git synced 2026-08-12 19:32:48 -06:00
Code Issues Packages Projects Releases Wiki Activity

bump: go 1.19.5 -> 1.20.1

Browse Source 
This PR bumps go to 1.20.1 (https://go.dev/doc/go1.20) which
addresses the following vulnerabilities:
https://pkg.go.dev/vuln/GO-2023-1571
https://pkg.go.dev/vuln/GO-2023-1570
https://pkg.go.dev/vuln/GO-2023-1568

As part of the migration, general Golang
stdlib deprecations and test failures were addressed as well.
Some of those changes are:

* Bump golangci-lint for support with go1.20
* Migrate rand.Seed() calls to the newer rand.New(rand.NewSource(seed))

Co-authored-by: Stephan Renatus <stephan@styra.com>
Co-authored-by: Philip Conrad <philipaconrad@gmail.com>

Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This commit is contained in:
Stephan Renatus
2023-02-02 10:13:56 +01:00
committed by Ashutosh Narkar
parent 15ecb99d96
commit c9ec05d3fe
16 changed files with 220 additions and 1612 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/pull-request.yaml
+1 -1
View File
@@ -274,7 +274,7 @@ jobs:
fail-fast: false
matrix:
os: [ubuntu-22.04, macos-latest]
version: ["1.18", "1.17"]
version: ["1.18", "1.19"]
steps:
- uses: actions/checkout@v3
- name: Download generated artifacts
.go-version
+1 -1
View File
@@ -1 +1 @@
1.19.5
1.20.1
Makefile
+7 -11
View File
@@ -17,9 +17,6 @@ GO_TEST_TIMEOUT := -timeout 30m
GOVERSION ?= $(shell cat ./.go-version)
GOARCH := $(shell go env GOARCH)
GOOS := $(shell go env GOOS)
#
# NOTE(sr): this is 1.19.5 without the git version bump causing build breakage because of .git ownership mismatches
GOIMAGE := golang@sha256:bb9811fad43a7d6fd2173248d8331b2dcf5ac9af20976b1937ecd214c5b8c383
ifeq ($(GOOS)/$(GOARCH),darwin/arm64)
WASM_ENABLED=0
@@ -30,7 +27,7 @@ ifeq ($(WASM_ENABLED),1)
GO_TAGS = -tags=opa_wasm
endif
GOLANGCI_LINT_VERSION := v1.50.1
GOLANGCI_LINT_VERSION := v1.51.0
DOCKER_RUNNING ?= $(shell docker ps >/dev/null 2>&1 && echo 1 || echo 0)
@@ -65,7 +62,7 @@ TELEMETRY_URL ?= #Default empty
BUILD_HOSTNAME := $(shell ./build/get-build-hostname.sh)
RELEASE_BUILD_IMAGE := $(GOIMAGE)
RELEASE_BUILD_IMAGE := golang:$(GOVERSION)
RELEASE_DIR ?= _release/$(VERSION)
@@ -252,16 +249,15 @@ CI_GOLANG_DOCKER_MAKE := $(DOCKER) run \
-e WASM_ENABLED=$(WASM_ENABLED) \
-e FUZZ_TIME=$(FUZZ_TIME) \
-e TELEMETRY_URL=$(TELEMETRY_URL) \
$(GOIMAGE) \
make
golang:$(GOVERSION)
.PHONY: ci-go-%
ci-go-%: generate
$(CI_GOLANG_DOCKER_MAKE) $*
$(CI_GOLANG_DOCKER_MAKE) /bin/bash -c "git config --system --add safe.directory /src && make $*"
.PHONY: ci-release-test
ci-release-test: generate
$(CI_GOLANG_DOCKER_MAKE) test perf wasm-sdk-e2e-test check
$(CI_GOLANG_DOCKER_MAKE) make test perf wasm-sdk-e2e-test check
.PHONY: ci-check-working-copy
ci-check-working-copy: generate
@@ -470,8 +466,8 @@ check-go-module:
-v $(PWD):/src \
-e 'GOPRIVATE=*' \
--tmpfs /src/.go \
$(GOIMAGE) \
go mod vendor -v
golang:$(GOVERSION) \
/bin/bash -c "git config --system --add safe.directory /src && go mod vendor -v"
######################################################
#
ast/term_bench_test.go
+5 -7
View File
@@ -147,8 +147,10 @@ func BenchmarkTermHashing(b *testing.B) {
}
}
var str string
var bs []byte
var (
str string
bs []byte
)
// BenchmarkObjectString generates several objects of different sizes, and
// marshals them to JSON via two ways:
@@ -169,7 +171,6 @@ func BenchmarkObjectString(b *testing.B) {
for _, n := range sizes {
b.Run(fmt.Sprint(n), func(b *testing.B) {
obj := map[string]int{}
for i := 0; i < n; i++ {
obj[fmt.Sprint(i)] = i
@@ -205,7 +206,6 @@ func BenchmarkObjectStringInterfaces(b *testing.B) {
for _, n := range sizes {
b.Run(fmt.Sprint(n), func(b *testing.B) {
obj := map[string]int{}
for i := 0; i < n; i++ {
obj[fmt.Sprint(i)] = i
@@ -243,7 +243,7 @@ func BenchmarkObjectConstruction(b *testing.B) {
for i := 0; i < n; i++ {
es = append(es, struct{ k, v int }{i, i})
}
rand.Seed(seed)
rand.New(rand.NewSource(seed)) // Seed the PRNG.
rand.Shuffle(len(es), func(i, j int) { es[i], es[j] = es[j], es[i] })
b.ResetTimer()
for i := 0; i < b.N; i++ {
@@ -283,7 +283,6 @@ func BenchmarkArrayString(b *testing.B) {
for _, n := range sizes {
b.Run(fmt.Sprint(n), func(b *testing.B) {
obj := make([]string, n)
for i := 0; i < n; i++ {
obj[i] = fmt.Sprint(i)
@@ -351,5 +350,4 @@ func BenchmarkSetMarshalJSON(b *testing.B) {
})
})
}
}
ast/term_test.go
+2 -23
View File
@@ -19,7 +19,6 @@ import (
)
func TestInterfaceToValue(t *testing.T) {
// Test util package unmarshalled inputs
input := `
{
@@ -86,11 +85,9 @@ func TestInterfaceToValue(t *testing.T) {
t.Fatalf("Expected %v but got: %v", expected, v)
}
}
}
func TestInterfaceToValueStructs(t *testing.T) {
var x struct {
Foo struct {
Baz string `json:"baz"`
@@ -161,7 +158,6 @@ func TestObjectInsertGetLen(t *testing.T) {
}
func TestObjectSetOperations(t *testing.T) {
a := MustParseTerm(`{"a": "b", "c": "d"}`).Value.(Object)
b := MustParseTerm(`{"c": "q", "d": "e"}`).Value.(Object)
@@ -267,7 +263,6 @@ func TestObjectFilter(t *testing.T) {
}
func TestTermBadJSON(t *testing.T) {
input := `{
"Value": [[
{"Value": [{"Value": "a", "Type": "var"}, {"Value": "x", "Type": "string"}], "Type": "ref"},
@@ -285,7 +280,6 @@ func TestTermBadJSON(t *testing.T) {
if !reflect.DeepEqual(expected, err) {
t.Errorf("Expected %v but got: %v", expected, err)
}
}
func TestTermEqual(t *testing.T) {
@@ -323,7 +317,6 @@ func TestTermEqual(t *testing.T) {
}
func TestFind(t *testing.T) {
term := MustParseTerm(`{"foo": [1,{"bar": {2,3,4}}], "baz": {"qux": ["hello", "world"]}}`)
tests := []struct {
@@ -360,7 +353,6 @@ func TestFind(t *testing.T) {
}
func TestHashObject(t *testing.T) {
doc := `{"a": [[true, {"b": [null]}, {"c": "d"}]], "e": {100: a[i].b}, "k": ["foo" | true], "o": {"foo": "bar" | true}, "sc": {"foo" | true}, "s": {1, 2, {3, 4}}, "big": 1e+1000}`
stmt1 := MustParseStatement(doc)
@@ -389,7 +381,6 @@ func TestHashObject(t *testing.T) {
}
func TestHashArray(t *testing.T) {
doc := `[{"a": [[true, {"b": [null]}, {"c": "d"}]]}, 100, true, [a[i].b], {100: a[i].b}, ["foo" | true], {"foo": "bar" | true}, {"foo" | true}, {1, 2, {3, 4}}, 1e+1000]`
stmt1 := MustParseStatement(doc)
@@ -421,7 +412,6 @@ func TestHashArray(t *testing.T) {
}
func TestHashSet(t *testing.T) {
doc := `{{"a": [[true, {"b": [null]}, {"c": "d"}]]}, 100, 100, 100, true, [a[i].b], {100: a[i].b}, ["foo" | true], {"foo": "bar" | true}, {"foo" | true}, {1, 2, {3, 4}}, 1e+1000}`
stmt1 := MustParseStatement(doc)
@@ -446,7 +436,6 @@ func TestHashSet(t *testing.T) {
}
func TestTermIsGround(t *testing.T) {
tests := []struct {
note string
term string
@@ -480,7 +469,6 @@ func TestTermIsGround(t *testing.T) {
t.Errorf("Expected term %v to be %s (test case %d: %v)", term, expected, i, tc.note)
}
}
}
func TestObjectRemainsGround(t *testing.T) {
@@ -524,7 +512,6 @@ func TestIsConstant(t *testing.T) {
}
func TestIsScalar(t *testing.T) {
tests := []struct {
term string
expected bool
@@ -578,7 +565,6 @@ func TestTermString(t *testing.T) {
}
func TestRefHasPrefix(t *testing.T) {
a := MustParseRef("foo.bar.baz")
b := MustParseRef("foo.bar")
c := MustParseRef("foo.bar[0][x]")
@@ -718,7 +704,6 @@ func TestRefPtr(t *testing.T) {
if _, err := ref.Ptr(); err == nil {
t.Fatal("Expected error from x[1]")
}
}
func TestSetEqual(t *testing.T) {
@@ -750,7 +735,6 @@ func TestSetEqual(t *testing.T) {
}
func TestSetMap(t *testing.T) {
set := MustParseTerm(`{"foo", "bar", "baz", "qux"}`).Value.(Set)
result, err := set.Map(func(term *Term) (*Term, error) {
@@ -760,7 +744,6 @@ func TestSetMap(t *testing.T) {
}
return term, nil
})
if err != nil {
t.Fatalf("Unexpected error: %v", err)
}
@@ -778,7 +761,6 @@ func TestSetMap(t *testing.T) {
if !reflect.DeepEqual(err, fmt.Errorf("oops")) {
t.Fatalf("Expected oops to be returned but got: %v, %v", result, err)
}
}
func TestSetAddContainsLen(t *testing.T) {
@@ -817,7 +799,6 @@ func TestSetAddContainsLen(t *testing.T) {
}
func TestSetOperations(t *testing.T) {
tests := []struct {
a string
b string
@@ -884,7 +865,7 @@ func TestSetConcurrentReads(t *testing.T) {
numbers[i] = IntNumberTerm(i)
}
// Shuffle numbers array for random insertion order.
rand.Seed(10000)
rand.New(rand.NewSource(10000)) // Seed the PRNG.
rand.Shuffle(len(numbers), func(i, j int) {
numbers[i], numbers[j] = numbers[j], numbers[i]
})
@@ -926,7 +907,7 @@ func TestObjectConcurrentReads(t *testing.T) {
numbers[i] = IntNumberTerm(i)
}
// Shuffle numbers array for random insertion order.
rand.Seed(10000)
rand.New(rand.NewSource(10000)) // Seed the PRNG.
rand.Shuffle(len(numbers), func(i, j int) {
numbers[i], numbers[j] = numbers[j], numbers[i]
})
@@ -962,7 +943,6 @@ func TestObjectConcurrentReads(t *testing.T) {
}
func TestArrayOperations(t *testing.T) {
arr := MustParseTerm(`[1,2,3,4]`).Value.(*Array)
getTests := []struct {
@@ -1087,7 +1067,6 @@ func TestArrayOperations(t *testing.T) {
}
func TestValueToInterface(t *testing.T) {
// Happy path
term := MustParseTerm(`{
"foo": [1, "two", true, null, {3,
go.mod
+1 -1
View File
@@ -1,6 +1,6 @@
module github.com/open-policy-agent/opa
go 1.17
go 1.18
require (
github.com/OneOfOne/xxhash v1.2.8
go.sum
-1469
View File
File diff suppressed because it is too large Load Diff
internal/prometheus/prometheus_go1.16.go
-17
View File
@@ -1,17 +0,0 @@
// Copyright 2022 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// NOTE(sr): Different go runtime metrics on 1.16.
// This can be removed when we drop support for go 1.16.
//go:build !go1.17
// +build !go1.17
package prometheus
import "github.com/prometheus/client_golang/prometheus"
func collector() prometheus.Collector {
return prometheus.NewGoCollector()
}
internal/prometheus/prometheus_go1.17.go
-6
View File
@@ -2,12 +2,6 @@
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// NOTE(sr): Different go runtime metrics on 1.16.
// This can be removed when we drop support for go 1.16.
//go:build go1.17
// +build go1.17
package prometheus
import (
internal/prometheus/prometheus_go1.19_test.go
+145
View File
@@ -0,0 +1,145 @@
// Copyright 2022 The OPA Authors. All rights reserved.
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// NOTE(sr): Different go runtime metrics on 1.19.
// This can be removed when we drop support for go 1.19.
//go:build go1.19 && !go1.20
// +build go1.19,!go1.20
package prometheus
import (
"encoding/json"
"testing"
"github.com/open-policy-agent/opa/logging"
"github.com/open-policy-agent/opa/metrics"
)
func TestJSONSerialization(t *testing.T) {
inner := metrics.New()
logger := func(logger logging.Logger) loggerFunc {
return func(attrs map[string]interface{}, f string, a ...interface{}) {
logger.WithFields(attrs).Error(f, a...)
}
}(logging.NewNoOpLogger())
prom := New(inner, logger)
m := prom.All()
bs, err := json.Marshal(m)
if err != nil {
t.Fatal(err)
}
act := make(map[string]map[string]interface{}, len(m))
err = json.Unmarshal(bs, &act)
if err != nil {
t.Fatal(err)
}
// NOTE(sr): "http_request_duration_seconds" only shows up after there has been a request
exp := map[string][]string{
"GAUGE": {
"go_gc_heap_goal_bytes",
"go_gc_heap_objects_objects",
"go_gc_stack_starting_size_bytes",
"go_gc_limiter_last_enabled_gc_cycle",
"go_goroutines",
"go_info",
"go_memory_classes_heap_free_bytes",
"go_memory_classes_heap_objects_bytes",
"go_memory_classes_heap_released_bytes",
"go_memory_classes_heap_stacks_bytes",
"go_memory_classes_heap_unused_bytes",
"go_memory_classes_metadata_mcache_free_bytes",
"go_memory_classes_metadata_mcache_inuse_bytes",
"go_memory_classes_metadata_mspan_free_bytes",
"go_memory_classes_metadata_mspan_inuse_bytes",
"go_memory_classes_metadata_other_bytes",
"go_memory_classes_os_stacks_bytes",
"go_memory_classes_other_bytes",
"go_memory_classes_profiling_buckets_bytes",
"go_memory_classes_total_bytes",
"go_memstats_alloc_bytes",
"go_memstats_buck_hash_sys_bytes",
// "go_memstats_gc_cpu_fraction", // removed: https://github.com/prometheus/client_golang/issues/842#issuecomment-861812034
"go_memstats_gc_sys_bytes",
"go_memstats_heap_alloc_bytes",
"go_memstats_heap_idle_bytes",
"go_memstats_heap_inuse_bytes",
"go_memstats_heap_objects",
"go_memstats_heap_released_bytes",
"go_memstats_heap_sys_bytes",
"go_memstats_last_gc_time_seconds",
"go_memstats_mcache_inuse_bytes",
"go_memstats_mcache_sys_bytes",
"go_memstats_mspan_inuse_bytes",
"go_memstats_mspan_sys_bytes",
"go_memstats_next_gc_bytes",
"go_memstats_other_sys_bytes",
"go_memstats_stack_inuse_bytes",
"go_memstats_stack_sys_bytes",
"go_memstats_sys_bytes",
"go_sched_goroutines_goroutines",
"go_sched_gomaxprocs_threads",
"go_threads",
},
"COUNTER": {
"go_gc_cycles_automatic_gc_cycles_total",
"go_gc_cycles_forced_gc_cycles_total",
"go_gc_cycles_total_gc_cycles_total",
"go_gc_heap_allocs_bytes_total",
"go_gc_heap_allocs_objects_total",
"go_gc_heap_tiny_allocs_objects_total",
"go_gc_heap_frees_bytes_total",
"go_gc_heap_frees_objects_total",
"go_cgo_go_to_c_calls_calls_total",
"go_memstats_alloc_bytes_total",
"go_memstats_lookups_total",
"go_memstats_mallocs_total",
"go_memstats_frees_total",
},
"SUMMARY": {
"go_gc_duration_seconds",
},
"HISTOGRAM": {
"go_gc_pauses_seconds", // was: "go_gc_pauses_seconds_total"
"go_gc_heap_allocs_by_size_bytes", // was: "go_gc_heap_allocs_by_size_bytes_total"
"go_gc_heap_frees_by_size_bytes", // was: "go_gc_heap_frees_by_size_bytes_total"
"go_sched_latencies_seconds",
},
}
found := 0
for typ, es := range exp {
for _, e := range es {
a, ok := act[e]
if !ok {
t.Errorf("%v: metric missing", e)
continue
}
if act, ok := a["type"].(string); !ok || act != typ {
t.Errorf("%v: unexpected type: %v (expected %v)", e, act, typ)
continue
}
found++
}
}
if len(act) != found {
t.Errorf("unexpected extra metrics, expected %d, got %d", found, len(act))
for a, ty := range act {
found := false
for _, es := range exp {
for _, e := range es {
if a == e {
found = true
}
}
}
if !found {
t.Errorf("unexpected metric: %v (type: %v)", a, ty)
}
}
}
}
internal/prometheus/prometheus_test.go
+15 -3
View File
@@ -2,10 +2,10 @@
// Use of this source code is governed by an Apache2
// license that can be found in the LICENSE file.
// NOTE(sr): Different go runtime metrics on 1.19.
// NOTE(an): Different go runtime metrics on 1.20.
// This can be removed when we drop support for go 1.19.
//go:build go1.19
// +build go1.19
//go:build go1.20
// +build go1.20
package prometheus
@@ -100,6 +100,18 @@ func TestJSONSerialization(t *testing.T) {
"go_memstats_lookups_total",
"go_memstats_mallocs_total",
"go_memstats_frees_total",
"go_cpu_classes_idle_cpu_seconds_total",
"go_cpu_classes_gc_mark_dedicated_cpu_seconds_total",
"go_cpu_classes_scavenge_background_cpu_seconds_total",
"go_cpu_classes_user_cpu_seconds_total",
"go_cpu_classes_scavenge_assist_cpu_seconds_total",
"go_cpu_classes_gc_mark_idle_cpu_seconds_total",
"go_cpu_classes_scavenge_total_cpu_seconds_total",
"go_cpu_classes_gc_mark_assist_cpu_seconds_total",
"go_cpu_classes_total_cpu_seconds_total",
"go_cpu_classes_gc_total_cpu_seconds_total",
"go_sync_mutex_wait_total_seconds_total",
"go_cpu_classes_gc_pause_cpu_seconds_total",
},
"SUMMARY": {
"go_gc_duration_seconds",
plugins/rest/aws_test.go
+15 -15
View File
@@ -550,14 +550,14 @@ func TestV4Signing(t *testing.T) {
{
sigVersion: "4a",
expectedAuthorization: []string{
// this signature is for go 1.18+, which changed crypto/ecdsa so signatures differ from go 1.17
// this signature is for go 1.20+, which changed crypto/ecdsa so signatures differ from go 1.18
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/s3/aws4_request, " +
"SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=3045022031b9dd601cd02650193586a32721d0614bf2e34bbc76cff0d9812366d1dc8878022100d0cfbd91bd2dd98f1e2d7feb9091c48f8b66a20174922770ec9e3b74db8e1826",
// this signature is for go 1.18+. Remove this and only test for a single value when OPA drops go 1.19
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/s3/aws4_request, " +
"SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=304402207d1bcb6fb68d85be3e9f6948a8dc8596a531b3f5a82ca2350acabe98941312bc02207d81ed07c7356226d93611820548a806c8e1f0cc72ff41ba672d23901e5a06bf",
// this signature is for go 1.17. Remove this and only test for a single value when OPA drops go 1.17
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/s3/aws4_request, " +
"SignedHeaders=host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=3045022100f951364b6495e3fe6be830a3550043bfd98e5312f79091e7c87bd51455cfb93c02203a4ca3e29ad63b6a9b473172e6ebb870f3d1947f2c44334bfd7eb74dbda4ec97",
},
},
}
@@ -665,14 +665,14 @@ func TestV4SigningOmitsIgnoredHeaders(t *testing.T) {
{
sigVersion: "4a",
expectedAuthorization: []string{
// this signature is for go 1.18+, which changed crypto/ecdsa so signatures differ from go 1.17
// this signature is for go 1.20+, which changed crypto/ecdsa so signatures differ from go 1.18
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
"SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=3045022100e62b33949d5d5666c1cc737db6673600d7893b977df48e4eb64a6e8747582a2f022011f56ad285472956a3e00c6971d03ebd8ecb579804d8fd91a6fb483a1f502118",
// this signature is for go 1.18+. Remove this and only test for a single value when OPA drops go 1.19
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
"SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=30450221009f3b0cda178456dfd1bec61b78bdbd115c0cf497eaa52c58bbb2850ad9c49c3002207009cb88a1219a4a6626056c31823a6b5bc2728bc88bc98a06e12e1148482c94",
// this signature is for go 1.17. Remove this and only test for a single value when OPA drops go 1.17
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
"SignedHeaders=content-length;content-type;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=304602210088b5a5ccf9e37aac765f7e6bf0507577eb1b919b80bc3c385b8856c7ab7a9912022100f4c558e36be338c9644240b722e06333ea9a5305b2e638d56ad0105995c9b1f7",
},
},
}
@@ -820,14 +820,14 @@ func TestV4SigningWithMultiValueHeaders(t *testing.T) {
{
sigVersion: "4a",
expectedAuthorization: []string{
// this signature is for go 1.18+, which changed crypto/ecdsa so signatures differ from go 1.17
// this signature is for go 1.20+, which changed crypto/ecdsa so signatures differ from go 1.18
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
"SignedHeaders=accept;content-length;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=3046022100f7fd07e2a00b1be3074be0c2e3871bd42ddc4c01549b1ffc4809ef3fafde80780221008c6bf906cdb9040ebeb94d1134598e7920fa8cb7bda91b00ce0ab9838b79631b",
// this signature is for go 1.18+. Remove this and only test for a single value when OPA drops go 1.19
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
"SignedHeaders=accept;content-length;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=304402202d5f2d4d42fe59b2e61fa455cb35a335139d109c2d37aaa8946d45fd0fb4989c022068238cbfbc80326f5cc391f2b6837910191ceabb58ec0bf986c0141f76046594",
// this signature is for go 1.17. Remove this and only test for a single value when OPA drops go 1.17
"AWS4-ECDSA-P256-SHA256 Credential=MYAWSACCESSKEYGOESHERE/20190424/execute-api/aws4_request, " +
"SignedHeaders=accept;content-length;host;x-amz-content-sha256;x-amz-date;x-amz-region-set;x-amz-security-token, " +
"Signature=304502206ac05ae8f63689e989227fac6c6c16008c25c1d66903f6535610df6496942701022100e1db05ec77d5142462537f7fd4d14db1d1e9b5c8c14643f2434206fe7284dfd6",
},
},
}
runtime/runtime.go
+1 -11
View File
@@ -76,7 +76,6 @@ func RegisterPlugin(name string, factory plugins.Factory) {
// Params stores the configuration for an OPA instance.
type Params struct {
// Globally unique identifier for this OPA instance. If an ID is not specified,
// the runtime will generate one.
ID string
@@ -250,7 +249,6 @@ type Runtime struct {
// NewRuntime returns a new Runtime object initialized with params. Clients must
// call StartServer() or StartREPL() to start the runtime in either mode.
func NewRuntime(ctx context.Context, params Params) (*Runtime, error) {
if params.ID == "" {
var err error
params.ID, err = generateInstanceID()
@@ -423,7 +421,6 @@ func (rt *Runtime) StartServer(ctx context.Context) {
// will block until either: an error occurs, the context is canceled, or
// a SIGTERM or SIGKILL signal is sent.
func (rt *Runtime) Serve(ctx context.Context) error {
if rt.Params.Addrs == nil {
return fmt.Errorf("at least one address must be configured in runtime parameters")
}
@@ -449,7 +446,6 @@ func (rt *Runtime) Serve(ctx context.Context) error {
undo, err := maxprocs.Set(maxprocs.Logger(func(f string, a ...interface{}) {
rt.logger.Debug(f, a...)
}))
if err != nil {
rt.logger.WithFields(map[string]interface{}{"err": err}).Debug("Failed to set GOMAXPROCS from CPU quota.")
}
@@ -610,7 +606,6 @@ func (rt *Runtime) DiagnosticAddrs() []string {
// StartREPL starts the runtime in REPL mode. This function will block the calling goroutine.
func (rt *Runtime) StartREPL(ctx context.Context) {
if err := rt.Manager.Start(ctx); err != nil {
fmt.Fprintln(rt.Params.Output, "error starting plugins:", err)
os.Exit(1)
@@ -633,7 +628,6 @@ func (rt *Runtime) StartREPL(ctx context.Context) {
go func() {
repl.SetOPAVersionReport(rt.checkOPAUpdate(ctx).Slice())
}()
}
repl.Loop(ctx)
}
@@ -651,7 +645,7 @@ func (rt *Runtime) checkOPAUpdate(ctx context.Context) *report.DataResponse {
func (rt *Runtime) checkOPAUpdateLoop(ctx context.Context, uploadDuration time.Duration, done chan struct{}) {
ticker := time.NewTicker(uploadDuration)
mr.Seed(time.Now().UnixNano())
mr.New(mr.NewSource(time.Now().UnixNano())) // Seed the PRNG.
for {
resp, err := rt.reporter.SendReport(ctx)
@@ -694,7 +688,6 @@ func (rt *Runtime) decisionIDFactory() string {
}
func (rt *Runtime) decisionLogger(ctx context.Context, event *server.Info) error {
plugin := logs.Lookup(rt.Manager)
if plugin == nil {
return nil
@@ -732,7 +725,6 @@ func (rt *Runtime) readWatcher(ctx context.Context, watcher *fsnotify.Watcher, p
}
func (rt *Runtime) processWatcherUpdate(ctx context.Context, paths []string, removed string) error {
loaded, err := initload.LoadPaths(paths, rt.Params.Filter, rt.Params.BundleMode, nil, true, false, nil)
if err != nil {
return err
@@ -741,7 +733,6 @@ func (rt *Runtime) processWatcherUpdate(ctx context.Context, paths []string, rem
removed = loader.CleanPath(removed)
return storage.Txn(ctx, rt.Store, storage.WriteParams, func(txn storage.Transaction) error {
if !rt.Params.BundleMode {
ids, err := rt.Store.ListPolicies(ctx, txn)
if err != nil {
@@ -844,7 +835,6 @@ func (rt *Runtime) onReloadLogger(d time.Duration, err error) {
}
func (rt *Runtime) getWatcher(rootPaths []string) (*fsnotify.Watcher, error) {
watchPaths, err := getWatchPaths(rootPaths)
if err != nil {
return nil, err
topdown/http_test.go
+21 -44
View File
@@ -44,7 +44,6 @@ type Person struct {
// TestHTTPGetRequest returns the list of persons
func TestHTTPGetRequest(t *testing.T) {
var people []Person
// test data
@@ -99,7 +98,6 @@ func TestHTTPGetRequest(t *testing.T) {
// TestHTTPGetRequest returns the list of persons
func TestHTTPGetRequestTlsInsecureSkipVerify(t *testing.T) {
var people []Person
// test data
@@ -154,7 +152,6 @@ func TestHTTPGetRequestTlsInsecureSkipVerify(t *testing.T) {
}
func TestHTTPEnableJSONOrYAMLDecode(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
switch r.URL.Path {
case "/json-no-header":
@@ -295,7 +292,6 @@ func TestHTTPEnableJSONOrYAMLDecode(t *testing.T) {
}
func echoCustomHeaders(w http.ResponseWriter, r *http.Request) {
headers := make(map[string][]string)
w.Header().Set("Content-Type", "application/json")
for k, v := range r.Header {
@@ -308,7 +304,6 @@ func echoCustomHeaders(w http.ResponseWriter, r *http.Request) {
// TestHTTPSendCustomRequestHeaders adds custom headers to request
func TestHTTPSendCustomRequestHeaders(t *testing.T) {
// test server
ts := httptest.NewServer(http.HandlerFunc(echoCustomHeaders))
defer ts.Close()
@@ -361,7 +356,6 @@ func TestHTTPSendCustomRequestHeaders(t *testing.T) {
// TestHTTPHostHeader tests Host header support
func TestHTTPHostHeader(t *testing.T) {
// test server
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.Header().Set("Content-Type", "application/json")
@@ -399,9 +393,7 @@ func TestHTTPHostHeader(t *testing.T) {
// TestHTTPPostRequest adds a new person
func TestHTTPPostRequest(t *testing.T) {
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
contentType := r.Header.Get("Content-Type")
bs, err := io.ReadAll(r.Body)
@@ -501,7 +493,6 @@ func TestHTTPPostRequest(t *testing.T) {
}
func TestHTTPDeleteRequest(t *testing.T) {
var people []Person
// test data
@@ -510,7 +501,6 @@ func TestHTTPDeleteRequest(t *testing.T) {
// test server
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
var person Person
if r.Body == nil {
http.Error(w, "Please send a request body", 400)
@@ -579,7 +569,6 @@ func TestHTTPDeleteRequest(t *testing.T) {
// TestInvalidKeyError returns an error when an invalid key is passed in the
// http.send builtin
func TestInvalidKeyError(t *testing.T) {
// run the test
tests := []struct {
note string
@@ -692,7 +681,6 @@ func TestParseTimeout(t *testing.T) {
// TestHTTPRedirectDisable tests redirects are not enabled by default
func TestHTTPRedirectDisable(t *testing.T) {
// test server
baseURL, teardown := getTestServer()
defer teardown()
@@ -719,12 +707,10 @@ func TestHTTPRedirectDisable(t *testing.T) {
// run the test
runTopDownTestCase(t, data, "http.send", rules, resultObj.String())
}
// TestHTTPRedirectEnable tests redirects are enabled
func TestHTTPRedirectEnable(t *testing.T) {
// test server
baseURL, teardown := getTestServer()
defer teardown()
@@ -752,7 +738,6 @@ func TestHTTPRedirectEnable(t *testing.T) {
}
func TestHTTPRedirectAllowNet(t *testing.T) {
// test server
baseURL, teardown := getTestServer()
defer teardown()
@@ -819,7 +804,6 @@ func TestHTTPRedirectAllowNet(t *testing.T) {
}
func TestHTTPSendRaiseError(t *testing.T) {
// test server
baseURL, teardown := getTestServer()
defer teardown()
@@ -995,7 +979,6 @@ func TestHTTPSendCaching(t *testing.T) {
for _, tc := range tests {
t.Run(tc.note, func(t *testing.T) {
var requests []*http.Request
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
requests = append(requests, r)
@@ -1188,7 +1171,6 @@ func TestHTTPSendIntraQueryCaching(t *testing.T) {
for _, tc := range tests {
t.Run(tc.note, func(t *testing.T) {
var requests []*http.Request
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
requests = append(requests, r)
@@ -1574,7 +1556,6 @@ func TestInsertIntoHTTPSendIntraQueryCacheError(t *testing.T) {
for _, tc := range tests {
t.Run(tc.note, func(t *testing.T) {
var requests []*http.Request
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
requests = append(requests, r)
@@ -1646,7 +1627,6 @@ func TestGetCachingMode(t *testing.T) {
for _, tc := range tests {
t.Run(tc.note, func(t *testing.T) {
actual, err := getCachingMode(tc.input)
if tc.wantError {
if err == nil {
@@ -1728,7 +1708,6 @@ func TestParseMaxAgeCacheDirective(t *testing.T) {
for _, tc := range tests {
t.Run(tc.note, func(t *testing.T) {
actual, err := parseMaxAgeCacheDirective(tc.input)
if tc.wantError {
if err == nil {
@@ -1747,13 +1726,11 @@ func TestParseMaxAgeCacheDirective(t *testing.T) {
if actual != tc.expected {
t.Fatalf("Expected value for max-age %v but got %v", tc.expected, actual)
}
})
}
}
func TestNewForceCacheParams(t *testing.T) {
tests := []struct {
note string
input ast.Object
@@ -1793,7 +1770,6 @@ func TestNewForceCacheParams(t *testing.T) {
for _, tc := range tests {
t.Run(tc.note, func(t *testing.T) {
actual, err := newForceCacheParams(tc.input)
if tc.wantError {
if err == nil {
@@ -1859,7 +1835,6 @@ func TestGetBoolValFromReqObj(t *testing.T) {
for _, tc := range tests {
t.Run(tc.note, func(t *testing.T) {
actual, err := getBoolValFromReqObj(tc.input, tc.key)
if tc.wantError {
if err == nil {
@@ -1878,7 +1853,6 @@ func TestGetBoolValFromReqObj(t *testing.T) {
if actual != tc.expected {
t.Fatalf("Expected value for key %v is %v but got %v", tc.key, tc.expected, actual)
}
})
}
}
@@ -1908,7 +1882,7 @@ func TestNewInterQueryCacheValue(t *testing.T) {
headers.Set("Date", date)
// test data
var b = []byte(`[{"ID": "1", "Firstname": "John"}]`)
b := []byte(`[{"ID": "1", "Firstname": "John"}]`)
response := &http.Response{
Status: "200 OK",
@@ -1993,7 +1967,6 @@ func getTLSTestServer() (ts *httptest.Server) {
}
func TestHTTPSClient(t *testing.T) {
const (
localClientCertFile = "testdata/client-cert.pem"
localClientCert2File = "testdata/client-cert-2.pem"
@@ -2222,7 +2195,6 @@ func TestHTTPSClient(t *testing.T) {
})
t.Run("Negative Test: No Root Ca", func(t *testing.T) {
expectedResult := &Error{Code: BuiltinErr, Message: fixupDarwinGo118("x509: certificate signed by unknown authority", `“my-server” certificate is not standards compliant`), Location: nil}
data := loadSmallTestData()
rule := []string{fmt.Sprintf(
@@ -2233,7 +2205,6 @@ func TestHTTPSClient(t *testing.T) {
})
t.Run("Negative Test: Wrong Cert/Key Pair", func(t *testing.T) {
expectedResult := &Error{Code: BuiltinErr, Message: "tls: private key does not match public key", Location: nil}
data := loadSmallTestData()
rule := []string{fmt.Sprintf(
@@ -2244,7 +2215,6 @@ func TestHTTPSClient(t *testing.T) {
})
t.Run("Negative Test: System Certs do not include local rootCA", func(t *testing.T) {
expectedResult := &Error{Code: BuiltinErr, Message: fixupDarwinGo118("x509: certificate signed by unknown authority", `“my-server” certificate is not standards compliant`), Location: nil}
data := loadSmallTestData()
rule := []string{fmt.Sprintf(
@@ -2290,7 +2260,6 @@ func TestHTTPSClient(t *testing.T) {
}
func TestHTTPSNoClientCerts(t *testing.T) {
const (
localCaFile = "testdata/ca.pem"
localServerCertFile = "testdata/server-cert.pem"
@@ -2485,7 +2454,6 @@ func TestHTTPSNoClientCerts(t *testing.T) {
})
t.Run("Negative Test: System Certs do not include local rootCA", func(t *testing.T) {
expectedResult := &Error{Code: BuiltinErr, Message: fixupDarwinGo118("x509: certificate signed by unknown authority", `“my-server” certificate is not standards compliant`), Location: nil}
data := loadSmallTestData()
rule := []string{fmt.Sprintf(
@@ -2496,6 +2464,17 @@ func TestHTTPSNoClientCerts(t *testing.T) {
})
}
// Note(philipc): In Go 1.18, the crypto/x509 package deprecated the
// (*CertPool).Subjects() function. The precise reasoning for why this was
// done traces back to:
//
// https://github.com/golang/go/issues/46287
//
// For now, most projects seem to be working around this deprecation by
// changing how they verify certificates, and when CertPools are needed in
// tests, some larger projects have just slapped linter ignores on the
// offending callsites. Since we only use (*CertPool).Subjects() here for
// tests, we've gone with using linter ignores for now.
func TestCertSelectionLogic(t *testing.T) {
const (
localCaFile = "testdata/ca.pem"
@@ -2553,7 +2532,7 @@ func TestCertSelectionLogic(t *testing.T) {
{
note: "tls_use_system_certs set to true",
input: map[*ast.Term]*ast.Term{ast.StringTerm("tls_use_system_certs"): ast.BooleanTerm(true)},
expected: systemCertsPool.Subjects(),
expected: systemCertsPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
msg: "Expected TLS config to use system certs",
},
{
@@ -2565,25 +2544,25 @@ func TestCertSelectionLogic(t *testing.T) {
{
note: "no CAs specified",
input: nil,
expected: systemCertsPool.Subjects(),
expected: systemCertsPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
msg: "Expected TLS config to use system certs",
},
{
note: "CA cert provided directly",
input: map[*ast.Term]*ast.Term{ast.StringTerm("tls_ca_cert"): ast.StringTerm(string(ca))},
expected: caPool.Subjects(),
expected: caPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
msg: "Expected TLS config to use provided CA certs",
},
{
note: "CA cert file path provided",
input: map[*ast.Term]*ast.Term{ast.StringTerm("tls_ca_cert_file"): ast.StringTerm(localCaFile)},
expected: caPool.Subjects(),
expected: caPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
msg: "Expected TLS config to use provided CA certs in file",
},
{
note: "CA cert provided in env variable",
input: map[*ast.Term]*ast.Term{ast.StringTerm("tls_ca_cert_env_variable"): ast.StringTerm("CLIENT_CA_ENV")},
expected: caPool.Subjects(),
expected: caPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
msg: "Expected TLS config to use provided CA certs in env variable",
},
{
@@ -2592,7 +2571,7 @@ func TestCertSelectionLogic(t *testing.T) {
ast.StringTerm("tls_ca_cert"): ast.StringTerm(string(ca)),
ast.StringTerm("tls_use_system_certs"): ast.BooleanTerm(false),
},
expected: caPool.Subjects(),
expected: caPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
msg: "Expected TLS config to use provided CA certs only",
},
{
@@ -2601,7 +2580,7 @@ func TestCertSelectionLogic(t *testing.T) {
ast.StringTerm("tls_ca_cert"): ast.StringTerm(string(ca)),
ast.StringTerm("tls_use_system_certs"): ast.BooleanTerm(true),
},
expected: systemCertsAndCaPool.Subjects(),
expected: systemCertsAndCaPool.Subjects(), // nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
msg: "Expected TLS config to use provided CA certs and system certs",
},
}
@@ -2618,6 +2597,7 @@ func TestCertSelectionLogic(t *testing.T) {
t.Fatalf(tc.msg)
}
} else {
// nolint:staticcheck // ignoring the deprecated (*CertPool).Subjects() call here because it's in a test.
if !reflect.DeepEqual(tlsConfig.RootCAs.Subjects(), tc.expected) {
t.Fatal(tc.msg)
}
@@ -2729,7 +2709,6 @@ func TestHTTPSendCacheDefaultStatusCodesInterQueryCache(t *testing.T) {
}
func TestHTTPSendMetrics(t *testing.T) {
// run test server
ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
w.WriteHeader(http.StatusOK)
@@ -2882,12 +2861,12 @@ func (m *tracemock) NewTransport(rt http.RoundTripper, _ tracing.Options) http.R
m.called++
return rt
}
func (*tracemock) NewHandler(http.Handler, string, tracing.Options) http.Handler {
panic("unreachable")
}
func TestDistributedTracingEnabled(t *testing.T) {
mock := tracemock{}
tracing.RegisterHTTPTracing(&mock)
@@ -2910,7 +2889,6 @@ func TestDistributedTracingEnabled(t *testing.T) {
}
func TestDistributedTracingDisabled(t *testing.T) {
mock := tracemock{}
tracing.RegisterHTTPTracing(&mock)
@@ -2932,7 +2910,6 @@ func TestDistributedTracingDisabled(t *testing.T) {
}
func TestHTTPGetRequestAllowNet(t *testing.T) {
// test data
body := map[string]bool{"ok": true}
topdown/tokens_test.go
+3 -2
View File
@@ -472,8 +472,8 @@ func TestTopdownJWTEncodeSignECWithSeedReturnsSameSignature(t *testing.T) {
"d":"jpsQnnGQmL-YBIffH1136cspYG6-0iY7X1fCE9-E9LI"
}, x)`
encodedSigned := "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.05wmHY3NomU1jr7yvusBvKwhthRklPuJhUPOkoeIn5e5n_GXvE25EfRs9AJK2wOy6NoY2ljhj07M9BMtV0dfyA"
if strings.HasPrefix(runtime.Version(), "go1.17") {
encodedSigned = "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.-LoHxtbT8t_TnqlLyONI4BtjvfkySO8TcoCFENqTTH2AKxvn29nAjxOdlbY-0EKVM2nJ4ukCx4IGtZtuwXr0VQ"
if strings.HasPrefix(runtime.Version(), "go1.20") {
encodedSigned = "eyJhbGciOiAiRVMyNTYifQ.eyJwYXkiOiAibG9hZCJ9.GRp6wIqDZuYnvQH50hnIy559LdrjUux76v1ynxX6lH0XtlgwreyR16x2JMnuElo79X3zUbqlWrZITICv86arew"
}
for i := 0; i < 10; i++ {
@@ -492,6 +492,7 @@ func TestTopdownJWTEncodeSignECWithSeedReturnsSameSignature(t *testing.T) {
if exp, act := 1, len(qrs); exp != act {
t.Fatalf("expected %d results, got %d", exp, act)
}
if exp, act := ast.String(encodedSigned), qrs[0][ast.Var("x")].Value; !exp.Equal(act) {
t.Fatalf("unexpected result: want %v, got %v", exp, act)
}
util/backoff.go
+3 -1
View File
@@ -15,7 +15,9 @@ func init() {
// a call to rand.Seed() we'd get the same stream of numbers for each program
// run. (Or not, if some other packages happens to seed the global randomness
// source.)
rand.Seed(time.Now().UnixNano())
// Note(philipc): rand.Seed() was deprecated in Go 1.20, so we've switched to
// using the recommended rand.New(rand.NewSource(seed)) style.
rand.New(rand.NewSource(time.Now().UnixNano()))
}
// DefaultBackoff returns a delay with an exponential backoff based on the