-
Notifications
You must be signed in to change notification settings - Fork 51
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
docker: upgrade to 26.1.0 #2152
Conversation
@@ -3,7 +3,6 @@ | |||
EAPI=7 | |||
|
|||
COREOS_GO_PACKAGE="${GITHUB_URI}" | |||
COREOS_GO_VERSION="go1.19" |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
If we start building amazon-ssm-agent with Go 1.21, we should probably either bump the version of amazon-ssm-agent to a fairly recent one coupled with Go 1.21, or at least run CI for AWS without updating amazon-ssm-agent.
Actually we should run a full CI for all cloud providers, not only qemu, because bumping Go version is one of the most invasive changes in Flatcar.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Yeah, I checked to upgrade the SSM agent but even the main branch is still on Go 1.19 (https://github.com/aws/amazon-ssm-agent/blob/18ab50687adf4f9f3a7f8946f68c1f3e0a97629f/go.mod#L3) - I tried to build the version 3.2.985.0 locally and it worked.
Good to know for the CI, I will trigger a CI for all providers.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Looks good on AWS: http://jenkins.infra.kinvolk.io:8080/job/container/job/packages_all_arches/4362/cldsv/ but it does not test the Amazon SSM agent IIRC.
36ef1a0
to
4c130f2
Compare
Signed-off-by: Mathieu Tortuyaux <[email protected]>
Signed-off-by: Mathieu Tortuyaux <[email protected]>
Signed-off-by: Mathieu Tortuyaux <[email protected]>
Signed-off-by: Mathieu Tortuyaux <[email protected]>
Commit-Ref: gentoo/gentoo@7421400 Signed-off-by: Mathieu Tortuyaux <[email protected]>
Commit-Ref: gentoo/gentoo@7421400 Signed-off-by: Mathieu Tortuyaux <[email protected]>
4c130f2
to
1ee19ae
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Thanks.
changelog/security/2024-07-24-go.md
Outdated
@@ -0,0 +1 @@ | |||
- go ([CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288), [CVE-2023-45289](https://nvd.nist.gov/vuln/detail/CVE-2023-45289), [CVE-2023-45290](https://nvd.nist.gov/vuln/detail/CVE-2023-45290), [CVE-2024-24783](https://nvd.nist.gov/vuln/detail/CVE-2024-24783), [CVE-2024-24784](https://nvd.nist.gov/vuln/detail/CVE-2024-24784), [CVE-2024-24785](https://nvd.nist.gov/vuln/detail/CVE-2024-24785), [CVE-2024-24788](https://nvd.nist.gov/vuln/detail/CVE-2024-24788), [CVE-2024-24789](https://nvd.nist.gov/vuln/detail/CVE-2024-24789), [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790),[CVE-2024-24791](https://nvd.nist.gov/vuln/detail/CVE-2024-24791)) |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Missing space between 24790 and 24791. It should be:
- go ([CVE-2023-45288](https://nvd.nist.gov/vuln/detail/CVE-2023-45288), [CVE-2023-45289](https://nvd.nist.gov/vuln/detail/CVE-2023-45289), [CVE-2023-45290](https://nvd.nist.gov/vuln/detail/CVE-2023-45290), [CVE-2024-24783](https://nvd.nist.gov/vuln/detail/CVE-2024-24783), [CVE-2024-24784](https://nvd.nist.gov/vuln/detail/CVE-2024-24784), [CVE-2024-24785](https://nvd.nist.gov/vuln/detail/CVE-2024-24785), [CVE-2024-24788](https://nvd.nist.gov/vuln/detail/CVE-2024-24788), [CVE-2024-24789](https://nvd.nist.gov/vuln/detail/CVE-2024-24789), [CVE-2024-24790](https://nvd.nist.gov/vuln/detail/CVE-2024-24790), [CVE-2024-24791](https://nvd.nist.gov/vuln/detail/CVE-2024-24791))
Signed-off-by: Mathieu Tortuyaux <[email protected]>
This is not supported anymore Signed-off-by: Mathieu Tortuyaux <[email protected]>
1ee19ae
to
3f8b4a0
Compare
In this PR we upgrade Docker from 24.0.9 to 26.1.0 and consequently we bump the Go version to 1.21.12
Notes for reviewers:
Testing done
CI (with SDK): http://jenkins.infra.kinvolk.io:8080/job/container/job/sdk/1597/cldsv/ - 🟢 except for
docker.devicemapper-storage
(see: flatcar/mantle#542)From the SDK:
changelog/
directory (user-facing change, bug fix, security fix, update)/boot
and/usr
size, packages, list files for any missing binaries, kernel modules, config files, kernel modules, etc.Closes: flatcar/Flatcar#1387, flatcar/Flatcar#1382, flatcar/Flatcar#1405 and flatcar/Flatcar#1360