Skip to content

Commit

Permalink
build: update to go1.22.4
Browse files Browse the repository at this point in the history
Update Go toolchain to 1.22.4, which addresses two vulnerabilities in the Go
stdlib.

* CVE-2024-24789: impacts handling of certain types of invalid zip files, which
  could be exploited to create a zip file with unexpected contents. This could
  potentially impact Nomad users of `artifact` blocks who download untrusted
  artifacts.
* CVE-2024-24790: impacts parsing of IPv4-mapped IPv6 addresses.
  • Loading branch information
tgross committed Jun 4, 2024
1 parent d9416af commit deaf97e
Show file tree
Hide file tree
Showing 6 changed files with 8 additions and 5 deletions.
3 changes: 3 additions & 0 deletions .changelog/23172.txt
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:security
build: Updated Go to 1.22.4 to address Go stdlib vulnerabilities CVE-2024-24789 and CVE-2024-24790
```
2 changes: 1 addition & 1 deletion .go-version
Original file line number Diff line number Diff line change
@@ -1 +1 @@
1.22.1
1.22.4
2 changes: 1 addition & 1 deletion contributing/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -30,7 +30,7 @@ A development environment is supplied via Vagrant to make getting started easier

Developing without Vagrant
---
1. Install [Go 1.22.1+](https://golang.org/) *(Note: `gcc-go` is not supported)*
1. Install [Go 1.22.4+](https://golang.org/) *(Note: `gcc-go` is not supported)*
1. Clone this repo
```sh
$ git clone https://github.com/hashicorp/nomad.git
Expand Down
2 changes: 1 addition & 1 deletion go.mod
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/hashicorp/nomad

go 1.21
go 1.22

// Pinned dependencies are noted in github.com/hashicorp/nomad/issues/11826.
replace (
Expand Down
2 changes: 1 addition & 1 deletion scripts/linux-priv-go.sh
Original file line number Diff line number Diff line change
Expand Up @@ -21,7 +21,7 @@ case $(arch) in
esac

function install_go() {
local go_version="1.22.1"
local go_version="1.22.4"
local download="https://storage.googleapis.com/golang/go${go_version}.linux-${ARCH}.tar.gz"

if go version 2>&1 | grep -q "${go_version}"; then
Expand Down
2 changes: 1 addition & 1 deletion scripts/release/mac-remote-build
Original file line number Diff line number Diff line change
Expand Up @@ -56,7 +56,7 @@ REPO_PATH="${TMP_WORKSPACE}/gopath/src/github.com/hashicorp/nomad"
mkdir -p "${TMP_WORKSPACE}/tmp"
install_go() {
local go_version="1.22.1"
local go_version="1.22.4"
local download=
download="https://storage.googleapis.com/golang/go${go_version}.darwin-amd64.tar.gz"
Expand Down

0 comments on commit deaf97e

Please sign in to comment.