https://groups.google.com/g/golang-announce/c/OrmQE_Yp5Sc
govulncheck flagged us for:
* crypto/tls: Encrypted Client Hello privacy leak
The Encrypted Client Hello implementation would leak the pre-shared key
identities during the handshake, allowing a passive network observer who can
collect handshakes to de-anonymize the hostname of the server, even when ECH was
being used.
Thanks to Coia Prant (github.com/rbqvq) for reporting this issue.
This is CVE-2026-42505 and Go issue https://go.dev/issue/79282.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
- build with 1.25.1 (.go-version)
- go-compat test run with 1.24.*
- adjust prometheus metrics test
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
* build: bump go (1.24.6 -> 1.24.7)
https://groups.google.com/g/golang-announce/c/PtW9VW21NPs
* ci: run go stuff if .go-version changed
* Makefile: change debian base image
There is no 1.24.7-bullseye, because that distribution is EOL
* build: remove GOOS from Makefile call
Some change either in the debian trixie golang image, or in golang's
toolchain made this necessary: Prior to this commit, `GOOS` was set to
windows, causing a cross-build. We don't want a crossbuild for this
utility, we want to invoke the Linux binary (on the Linux host) to do
its job on a Windows binary (cross-built from the Linux host).
---------
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Brace yourselves! For there are many touched files here. No changes
in semantics however.
Spent a long time trying out the various optional rules gocritic
provides, and settled for a few of them. There are more I really
like, but that would take many hours to address across the codebase.
Perhaps others find gocritic too pedantic? If so, we can merge the
fixes without enabling the rule.
Signed-off-by: Anders Eknert <anders@styra.com>
With .go-version containing 1.22, netlify fails to pick up the golang binary:
9:32:09 AM: Installing Go version 1.22 (requested 1.22)
9:32:09 AM: Failed to install Go version "1.22"
9:32:12 AM: Continue with existing version "1.19.13"
and the build breaks with 1.19.x.
Setting .go-version to 1.22.0 (with .0 at the end) matches the versioning
scheme on https://go.dev/dl/, and it seems to succeed picking up the right
go version for the website build:
9:33:35 AM: Installing Go version 1.22.0 (requested 1.22.0)
9:33:37 AM: go version go1.22.0 linux/amd64
Signed-off-by: Stephan Renatus <stephan@styra.com>
This version includes security fixes which addresses
vulnerability GO-2023-2186 and GO-2023-2185.
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
This version includes security fixes which address the following CVEs:
* CVE-2023-39318
* CVE-2023-39319
* CVE-2023-39320
* CVE-2023-39321
* CVE-2023-39322
Also changes to internal/prometheus/TestJSONSerialization: add new metric
Signed-off-by: Ashutosh Narkar <anarkar4387@gmail.com>
https://tip.golang.org/doc/go1.21
This required some test updates:
* topdown/tokens_test: adjust for go1.21
What was correct for 1.20 is correct for 1.21, so I've flipped the exception logic.
* plugins/rest/TestClientCert: adapt cert-related error string
* internal/prometheus/TestJSONSerialization: add new metrics
There are new metrics!
Signed-off-by: Stephan Renatus <stephan@styra.com>
This addresses https://pkg.go.dev/vuln/GO-2022-1095.
The only relevant call sites are in the wasm optimizations, where you can
opt into shelling out to wasm-opt (binaryen). None of this is done by default.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
With this, we'll build our container images and binaries using golang 1.19.
Also, the go.mod version stanza is increased, letting us use go1.17+ features.
I had to run
go mod tidy -go=1.16 && go mod tidy -go=1.17
to get rid of `go mod tidy` related messages, and ran `go mod vendor`
afterwards.
* prometheus: adjust tests for new go1.19 metrics
Note that the new metrics only appear when using the Go runtime of 1.19. So,
we do the same we've done before when 1.17 brought in new metrics: add them
to the tests, and use build flags to not run the tests in the previous versions.
When the bump of github.com/prometheus/go_client to 1.13.0 was merged, it was
properly tested with all of 1.17 and 1.18. So, the previously expected metrics
should be there when using OPA from 1.17 or 1.18.
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
No change to go.mod's `go` stanza, so no changes in code compatibility.
However, it's used for building our docker images and release
binaries, and for fuzz testing in our nightly workflow.
Some test-related changes with the dns lookup built-in function's
error handling; and the hardcoded signature. Running
go test ./topdown -run TestTopdownJWTEncodeSignECWithSeedReturnsSameSignature -count 10000
makes me believe that for whatever reason the signature changed,
it's at least stable.
topdown/http_test: Test-only change to accomodate this change in Go (https://go.dev/doc/go1.18):
Certificate.Verify now uses platform APIs to verify certificate
validity on macOS and iOS when it is called with a nil
VerifyOpts.Roots or when using the root pool returned from
SystemCertPool.
We're keeping the old message for go <= 1.17; in a silly-simple way.
Also:
* ci: build and test two old golang version on macos|linux
We'll drop golang 1.15, keep one unsupported version (1.16).
Signed-off-by: Stephan Renatus <stephan.renatus@gmail.com>
Stephan Renatus