[release-v0.62.x] Upgrade golang.org/x/crypto to 0.31.0

[vdemeester]

Changes

Fixing a critical CVE.
See GHSA-v778-237x-gjrc

Signed-off-by: Vincent Demeester [email protected]

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

• Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
• Has Tests included if any functionality added or changed
• pre-commit Passed
• Follows the commit message standard
• Meets the Tekton contributor standards (including functionality, content, code)
• Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
• Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
• Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

Upgrade golang.org/x/crypto to 0.31.0 to fix CVE-2024-45337

[vdemeester]

/kind security

[vdemeester]

/assign @afrittoli

[afrittoli]

/retest

[afrittoli]

/lgtm

[tekton-robot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: afrittoli

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• OWNERS [afrittoli]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[divyansh42]

/test pull-tekton-pipeline-build-tests

[divyansh42]

/test pull-tekton-pipeline-go-coverage-df

[tekton-robot]

@divyansh42: The specified target(s) for /test were not found.
The following commands are available to trigger required jobs:

• /test pull-tekton-pipeline-build-tests
• /test pull-tekton-pipeline-unit-tests

The following commands are available to trigger optional jobs:

• /test pull-tekton-pipeline-go-coverage

Use /test all to run all jobs.

In response to this:

/test pull-tekton-pipeline-go-coverage-df

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[vdemeester]

 level=error msg="[linters_context/goanalysis] buildir: panic during analysis: Cannot range over: func(yield func(K, V) bool), goroutine 22560 [running]:\nruntime/debug.Stack()\n\t/usr/local/go/src/runtime/debug/stack.go:26 +0x5e\ngithub.com/golangci/golangci-lint/pkg/goanalysis.(*action).analyzeSafe.func1()\n\t/home/prow/go/pkg/mod/github.com/golangci/[email protected]/pkg/goanalysis/runner_action.go:105 +0x5a\npanic({0x17b7720?, 0xc019e51570?})\n\t/usr/local/go/src/runtime/panic.go:785 +0x132\nhonnef.co/go/tools/go/ir.(*builder).rangeStmt(0xc00005b910, 0xc019e19a40, 0xc019b76c00, 0x0, {0x1cc21b0, 0xc019b76c00})\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/go/ir/builder.go:2225 +0x894\nhonnef.co/go/tools/go/ir.(*builder).stmt(0xc00005b910, 0xc019e19a40, {0x1cc6b38?, 0xc019b76c00?})\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/go/ir/builder.go:2438 +0x20a\nhonnef.co/go/tools/go/ir.(*builder).stmtList(...)\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/go/ir/builder.go:859\nhonnef.co/go/tools/go/ir.(*builder).stmt(0xc00005b910, 0xc019e19a40, {0x1cc6a48?, 0xc019b7c7e0?})\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/go/ir/builder.go:2396 +0x1415\nhonnef.co/go/tools/go/ir.(*builder).buildFunction(0xc00005b910, 0xc019e19a40)\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/go/ir/builder.go:2508 +0x417\nhonnef.co/go/tools/go/ir.(*builder).buildFuncDecl(0xc00005b910, 0xc019b65290, 0xc019b7c810)\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/go/ir/builder.go:2545 +0x189\nhonnef.co/go/tools/go/ir.(*Package).build(0xc019b65290)\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/go/ir/builder.go:2649 +0xb46\nsync.(*Once).doSlow(0xc019b4d340?, 0xc019b77200?)\n\t/usr/local/go/src/sync/once.go:76 +0xb4\nsync.(*Once).Do(...)\n\t/usr/local/go/src/sync/once.go:67\nhonnef.co/go/tools/go/ir.(*Package).Build(...)\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/go/ir/builder.go:2567\nhonnef.co/go/tools/internal/passes/buildir.run(0xc019b4d260)\n\t/home/prow/go/pkg/mod/honnef.co/go/[email protected]/internal/passes/buildir/buildir.go:86 +0x18b\ngithub.com/golangci/golangci-lint/pkg/goanalysis.(*action).analyze(0xc0069dc4c0)\n\t/home/prow/go/pkg/mod/github.com/golangci/[email protected]/pkg/goanalysis/runner_action.go:191 +0x9cd\ngithub.com/golangci/golangci-lint/pkg/goanalysis.(*action).analyzeSafe.func2()\n\t/home/prow/go/pkg/mod/github.com/golangci/[email protected]/pkg/goanalysis/runner_action.go:113 +0x17\ngithub.com/golangci/golangci-lint/pkg/timeutils.(*Stopwatch).TrackStage(0xc002c00d70, {0x19e59d3, 0x7}, 0xc0037c4f48)\n\t/home/prow/go/pkg/mod/github.com/golangci/[email protected]/pkg/timeutils/stopwatch.go:111 +0x44\ngithub.com/golangci/golangci-lint/pkg/goanalysis.(*action).analyzeSafe(0xc002178780?)\n\t/home/prow/go/pkg/mod/github.com/golangci/[email protected]/pkg/goanalysis/runner_action.go:112 +0x6e\ngithub.com/golangci/golangci-lint/pkg/goanalysis.(*loadingPackage).analyze.func2(0xc0069dc4c0)\n\t/home/prow/go/pkg/mod/github.com/golangci/[email protected]/pkg/goanalysis/runner_loadingpackage.go:80 +0xa5\ncreated by github.com/golangci/golangci-lint/pkg/goanalysis.(*loadingPackage).analyze in goroutine 1988\n\t/home/prow/go/pkg/mod/github.com/golangci/[email protected]/pkg/goanalysis/runner_loadingpackage.go:75 +0x1e9\n" 

🤔

[vdemeester]

/retest

[vdemeester]

So… golangci-lint panics with 0.31.0 and if we update, we need to fix the linting.. 😓

[afrittoli]

So… golangci-lint panics with 0.31.0 and if we update, we need to fix the linting.. 😓

I enabled the action, if you re-push this we should be able to see it running

[vdemeester]

I enabled the action, if you re-push this we should be able to see it running

@afrittoli it's on the release branch, the GitHub action doesn't have a "reach" yet 😅

[tekton-robot]

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage-df to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1/taskrun_types.go	82.8%	81.4%	-1.5
pkg/apis/pipeline/v1beta1/taskrun_types.go	83.6%	82.3%	-1.3
pkg/pod/pod.go	93.0%	92.9%	-0.1
pkg/pod/script.go	99.1%	99.0%	-0.1
pkg/pod/status.go	92.3%	92.2%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	91.7%	91.7%	-0.0
pkg/reconciler/pipelinerun/resources/pipelinerunresolution.go	96.2%	96.2%	-0.0
pkg/reconciler/taskrun/taskrun.go	86.1%	85.8%	-0.3

[tekton-robot]

The following is the coverage report on the affected files.
Say /test pull-tekton-pipeline-go-coverage to re-run this coverage report

File	Old Coverage	New Coverage	Delta
pkg/apis/pipeline/v1/taskrun_types.go	82.8%	81.4%	-1.5
pkg/apis/pipeline/v1beta1/taskrun_types.go	83.6%	82.3%	-1.3
pkg/pod/pod.go	93.0%	92.9%	-0.1
pkg/pod/script.go	99.1%	99.0%	-0.1
pkg/pod/status.go	92.3%	92.2%	-0.2
pkg/reconciler/pipelinerun/pipelinerun.go	91.7%	91.7%	-0.0
pkg/reconciler/pipelinerun/resources/pipelinerunresolution.go	96.2%	96.2%	-0.0
pkg/reconciler/taskrun/taskrun.go	86.1%	85.8%	-0.3

[afrittoli]

/lgtm