Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[Merged by Bors] - Update go-libp2p dependency #4800

Closed
wants to merge 3 commits into from
Closed

[Merged by Bors] - Update go-libp2p dependency #4800

wants to merge 3 commits into from

Conversation

fasmat
Copy link
Member

@fasmat fasmat commented Aug 9, 2023

Motivation

The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533

For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5

Changes

Update go-libp2p dependency to a fixed version.

Test Plan

n/a

TODO

  • Explain motivation or link existing issue(s)
  • Test changes and document test plan
  • Update documentation as needed

DevOps Notes

  • This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources)
  • This PR does not affect public APIs
  • This PR does not rely on a new version of external services (PoET, elasticsearch, etc.)
  • This PR does not make changes to log messages (which monitoring infrastructure may rely on)

@fasmat fasmat requested a review from countvonzero as a code owner August 9, 2023 14:22
@fasmat fasmat self-assigned this Aug 9, 2023
@fasmat fasmat requested review from dshulyak and poszu as code owners August 9, 2023 14:22
@dshulyak
Copy link
Contributor

dshulyak commented Aug 9, 2023 •
edited
Loading

lets please wait before merging, i want to look at changelog. we are not affected by the CVE, so it is not urgent

@fasmat
Copy link
Member Author

fasmat commented Aug 9, 2023 •
edited
Loading

It looks like staticcheck is a bit too strict in its analysis and complains that the new go-libp2p is using depreciated functionality. I will see if I can disable that, since there is no way for us to fix our dependencies to not use deprecated functions in their code.

EDIT: my mistake, the issue was in the code of go-spacemesh.

@fasmat
Copy link
Member Author

fasmat commented Aug 9, 2023

bors try

bors bot added a commit that referenced this pull request Aug 9, 2023
@bors
Try #4800:
6fdce8a
@bors
Copy link

bors bot commented Aug 9, 2023

try

Build failed:

@fasmat fasmat force-pushed the fix-go-libp2p-dependency branch from ce9ec67 to 13ae6ac Compare August 9, 2023 20:31
@codecov
Copy link

codecov bot commented Aug 9, 2023 •
edited
Loading

Codecov Report

Merging #4800 (82360e1) into develop (6518d2b) will decrease coverage by 0.1%.
Report is 1 commits behind head on develop.
The diff coverage is 0.0%.

❗ Current head 82360e1 differs from pull request most recent head 959d010. Consider uploading reports for the commit 959d010 to get more accurate results

@@            Coverage Diff            @@
##           develop   #4800     +/-   ##
=========================================
- Coverage     77.0%   77.0%   -0.1%     
=========================================
  Files          260     260             
  Lines        29626   29626             
=========================================
- Hits         22841   22827     -14     
- Misses        5336    5348     +12     
- Partials      1449    1451      +2
Files Changed Coverage Δ
p2p/host.go 37.7% <0.0%> (ø)

... and 5 files with indirect coverage changes

@fasmat
Copy link
Member Author

fasmat commented Aug 9, 2023

bors merge

bors bot pushed a commit that referenced this pull request Aug 9, 2023
@fasmat
Update go-libp2p dependency (#4800)
16b25bd 
## Motivation
The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533

For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5

## Changes
Update go-libp2p dependency to a fixed version.

## Test Plan
n/a

## TODO
<!-- This section should be removed when all items are complete -->
- [x] Explain motivation or link existing issue(s)
- [x] Test changes and document test plan
- [x] Update documentation as needed

## DevOps Notes
<!-- Please uncheck these items as applicable to make DevOps aware of changes that may affect releases -->
- [x] This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources)
- [x] This PR does not affect public APIs
- [x] This PR does not rely on a new version of external services (PoET, elasticsearch, etc.)
- [x] This PR does not make changes to log messages (which monitoring infrastructure may rely on)
@bors
Copy link

bors bot commented Aug 9, 2023

Build failed:

@fasmat
Copy link
Member Author

fasmat commented Aug 9, 2023

bors merge

bors bot pushed a commit that referenced this pull request Aug 9, 2023
@fasmat
Update go-libp2p dependency (#4800)
484e9cd 
## Motivation
The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533

For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5

## Changes
Update go-libp2p dependency to a fixed version.

## Test Plan
n/a

## TODO
<!-- This section should be removed when all items are complete -->
- [x] Explain motivation or link existing issue(s)
- [x] Test changes and document test plan
- [x] Update documentation as needed

## DevOps Notes
<!-- Please uncheck these items as applicable to make DevOps aware of changes that may affect releases -->
- [x] This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources)
- [x] This PR does not affect public APIs
- [x] This PR does not rely on a new version of external services (PoET, elasticsearch, etc.)
- [x] This PR does not make changes to log messages (which monitoring infrastructure may rely on)
@bors
Copy link

bors bot commented Aug 9, 2023

Build failed:

@fasmat fasmat force-pushed the fix-go-libp2p-dependency branch from 13ae6ac to 48f0841 Compare August 10, 2023 10:03
@fasmat
Copy link
Member Author

fasmat commented Aug 10, 2023

bors merge

bors bot pushed a commit that referenced this pull request Aug 10, 2023
@fasmat
Update go-libp2p dependency (#4800)
565d252 
## Motivation
The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533

For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5

## Changes
Update go-libp2p dependency to a fixed version.

## Test Plan
n/a

## TODO
<!-- This section should be removed when all items are complete -->
- [x] Explain motivation or link existing issue(s)
- [x] Test changes and document test plan
- [x] Update documentation as needed

## DevOps Notes
<!-- Please uncheck these items as applicable to make DevOps aware of changes that may affect releases -->
- [x] This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources)
- [x] This PR does not affect public APIs
- [x] This PR does not rely on a new version of external services (PoET, elasticsearch, etc.)
- [x] This PR does not make changes to log messages (which monitoring infrastructure may rely on)
@bors
Copy link

bors bot commented Aug 10, 2023

Build failed:

@fasmat
Copy link
Member Author

fasmat commented Aug 10, 2023 •
edited
Loading

go-multiaddr v0.11.0 broke libp2p v0.29.2 because of a non-backwards compatible update of a transient dependency (golang.org/x/exp). The fix for it is already approved and should soon be merged: libp2p/go-libp2p#2467

This PR is blocked until then.

@fasmat fasmat force-pushed the fix-go-libp2p-dependency branch 2 times, most recently from 0a0e6d0 to 19c199d Compare August 16, 2023 07:59
@fasmat fasmat force-pushed the fix-go-libp2p-dependency branch from 19c199d to 82360e1 Compare August 17, 2023 17:24
@fasmat fasmat force-pushed the fix-go-libp2p-dependency branch from 82360e1 to 959d010 Compare August 17, 2023 17:25
@fasmat
Copy link
Member Author

fasmat commented Aug 17, 2023

libp2p won't release a new minor version to resolve the dependency conflict, so we have to downgrade go-multiaddr for now until a version is available that is compatible with it.

@fasmat
Copy link
Member Author

fasmat commented Aug 17, 2023

bors merge

bors bot pushed a commit that referenced this pull request Aug 17, 2023
@fasmat
Update go-libp2p dependency (#4800)
bfa734e 
## Motivation
The version of go-libp2p we are using has a know critical vulnerability: CVE-2023-39533

For some reason dependabot isn't able to automatically create a PR that updates to a version with the bug fixed: https://github.com/spacemeshos/go-spacemesh/security/dependabot/5

## Changes
Update go-libp2p dependency to a fixed version.

## Test Plan
n/a

## TODO
<!-- This section should be removed when all items are complete -->
- [x] Explain motivation or link existing issue(s)
- [x] Test changes and document test plan
- [x] Update documentation as needed

## DevOps Notes
<!-- Please uncheck these items as applicable to make DevOps aware of changes that may affect releases -->
- [x] This PR does not require configuration changes (e.g., environment variables, GitHub secrets, VM resources)
- [x] This PR does not affect public APIs
- [x] This PR does not rely on a new version of external services (PoET, elasticsearch, etc.)
- [x] This PR does not make changes to log messages (which monitoring infrastructure may rely on)
@bors
Copy link

bors bot commented Aug 17, 2023

Pull request successfully merged into develop.

Build succeeded!

The publicly hosted instance of bors-ng is deprecated and will go away soon.

If you want to self-host your own instance, instructions are here.
For more help, visit the forum.

If you want to switch to GitHub's built-in merge queue, visit their help page.

@bors bors bot changed the title Update go-libp2p dependency [Merged by Bors] - Update go-libp2p dependency Aug 17, 2023
@bors bors bot closed this Aug 17, 2023
@bors bors bot deleted the fix-go-libp2p-dependency branch August 17, 2023 18:26
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@dshulyak dshulyak dshulyak approved these changes

@poszu poszu poszu approved these changes

@countvonzero countvonzero Awaiting requested review from countvonzero

Assignees

@fasmat fasmat

Labels
None yet
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@fasmat @dshulyak @poszu