chore(deps): Migrate to github.com/go-jose/go-jose/v3 #7750

isibeni · 2024-03-12T17:14:33Z

Changes

Stop using archived gopkg.in/square/go-jose.v2 pkg
Switch to github.com/go-jose/go-jose/v3 instead

Fixes CVE-2024-28180

Submitter Checklist

As the author of this PR, please check off the items in this checklist:

Has Docs if any changes are user facing, including updates to minimum requirements e.g. Kubernetes version bumps
Has Tests included if any functionality added or changed
pre-commit Passed
Follows the commit message standard
Meets the Tekton contributor standards (including functionality, content, code)
Has a kind label. You can add one by adding a comment on this PR that contains /kind <type>. Valid types are bug, cleanup, design, documentation, feature, flake, misc, question, tep
Release notes block below has been updated with any user facing changes (API changes, bug fixes, changes requiring upgrade notices or deprecation warnings). See some examples of good release notes.
Release notes contains the string "action required" if the change requires additional action from users switching to the new release

Release Notes

NONE

linux-foundation-easycla · 2024-03-12T17:14:39Z

❌ - login: @isibeni / The commit (9cab47e) is not authorized under a signed CLA. "Please click here to be authorized. For further assistance with EasyCLA, please submit a support request ticket.

tekton-robot · 2024-03-12T17:14:43Z

Hi @isibeni. Thanks for your PR.

I'm waiting for a tektoncd member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

khrm

/ok-to-test

khrm · 2024-03-15T18:19:48Z

I think the dependable bot would raise a pr for this. It did in other repos.

isibeni · 2024-03-25T16:44:27Z

took me a while to get my CLA approval.

Trying to rebase now but I'm struggling to run go mod tidy as this commit 59c241e introduced containerd 1.17.14 which seems to require go 1.21

When running go mod tidy it would also bump the go version in the go.mod file.

When trying to run go mod tidy for version 1.19 it fails:

$ go mod tidy -go=1.19
go: github.com/containerd/[email protected] requires [email protected], but 1.19 is requested

I guess an update to 1.21. is needed or am I missing sth?

vdemeester · 2024-03-25T22:34:08Z

@isibeni yes, most likely an update to go 1.21 is required.

isibeni · 2024-03-26T07:17:18Z

@vdemeester How are go updates usually handled in tekton?

Just a plain PR that is bumping the version in go.mod?

Or is there a bigger process involved?

Or can I just bump it within my PR?

vdemeester · 2024-03-27T00:15:56Z

@vdemeester How are go updates usually handled in tekton?

Just a plain PR that is bumping the version in go.mod?

Or is there a bigger process involved?

Or can I just bump it within my PR?

Yes, you can update it in go.mod. We may need to check if the test-runner image used in the CI is using Go 1.21, but we'll quickly see it if you bump it (and if that's the case, we'll just have to update the reference of the image in the CI configuration). No huge process to follow 😉

isibeni · 2024-04-04T15:10:04Z

/kind misc

isibeni · 2024-04-05T09:33:49Z

/retest

Stop using archived gopkg.in/square/go-jose.v2 pkg Switch to github.com/go-jose/go-jose/v3 instead Fixes CVE-2024-28180

tekton-robot · 2024-04-05T14:43:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: vdemeester

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [vdemeester]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

afrittoli · 2024-04-08T10:58:18Z

Thanks @isibeni - this will address https://pkg.go.dev/vuln/GO-2024-2631 as well.

afrittoli

Thanks for this!
We will have to backport this, but that will also mean updating the go version for LTS releases.
/lgtm

isibeni · 2024-04-08T11:47:37Z

Thanks for merging!!!

vdemeester · 2024-04-08T14:08:05Z

/cherry-pick release-v0.56.x

vdemeester · 2024-04-08T14:08:09Z

/cherry-pick release-v0.53.x

vdemeester · 2024-04-08T14:08:15Z

/cherry-pick release-v0.50.x

vdemeester · 2024-04-08T14:08:21Z

/cherry-pick release-v0.47.x

tekton-robot · 2024-04-08T14:08:55Z

@vdemeester: #7750 failed to apply on top of branch "release-v0.56.x":

Applying: chore(deps): Migrate to github.com/go-jose/go-jose/v3
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
Removing vendor/gopkg.in/square/go-jose.v2/symmetric.go
Removing vendor/gopkg.in/square/go-jose.v2/signing.go
Removing vendor/gopkg.in/square/go-jose.v2/shared.go
Removing vendor/gopkg.in/square/go-jose.v2/opaque.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/validation.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/errors.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/doc.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/claims.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/builder.go
Removing vendor/gopkg.in/square/go-jose.v2/jws.go
Removing vendor/gopkg.in/square/go-jose.v2/jwk.go
Removing vendor/gopkg.in/square/go-jose.v2/jwe.go
Removing vendor/gopkg.in/square/go-jose.v2/json/tags.go
Removing vendor/gopkg.in/square/go-jose.v2/json/stream.go
Removing vendor/gopkg.in/square/go-jose.v2/json/scanner.go
Removing vendor/gopkg.in/square/go-jose.v2/json/indent.go
Removing vendor/gopkg.in/square/go-jose.v2/json/encode.go
Removing vendor/gopkg.in/square/go-jose.v2/json/decode.go
Removing vendor/gopkg.in/square/go-jose.v2/json/README.md
Removing vendor/gopkg.in/square/go-jose.v2/json/LICENSE
Removing vendor/gopkg.in/square/go-jose.v2/encoding.go
Removing vendor/gopkg.in/square/go-jose.v2/doc.go
Removing vendor/gopkg.in/square/go-jose.v2/crypter.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac.go
Removing vendor/gopkg.in/square/go-jose.v2/asymmetric.go
Removing vendor/gopkg.in/square/go-jose.v2/README.md
Removing vendor/gopkg.in/square/go-jose.v2/LICENSE
Removing vendor/gopkg.in/square/go-jose.v2/CONTRIBUTING.md
Removing vendor/gopkg.in/square/go-jose.v2/BUG-BOUNTY.md
Removing vendor/gopkg.in/square/go-jose.v2/.travis.yml
Removing vendor/gopkg.in/square/go-jose.v2/.gitignore
Removing vendor/gopkg.in/square/go-jose.v2/.gitcookies.sh.enc
Auto-merging go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 chore(deps): Migrate to github.com/go-jose/go-jose/v3
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-v0.56.x

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2024-04-08T14:08:58Z

@vdemeester: #7750 failed to apply on top of branch "release-v0.53.x":

Applying: chore(deps): Migrate to github.com/go-jose/go-jose/v3
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
Removing vendor/gopkg.in/square/go-jose.v2/symmetric.go
Removing vendor/gopkg.in/square/go-jose.v2/signing.go
Removing vendor/gopkg.in/square/go-jose.v2/shared.go
Removing vendor/gopkg.in/square/go-jose.v2/opaque.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/validation.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/errors.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/doc.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/claims.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/builder.go
Removing vendor/gopkg.in/square/go-jose.v2/jws.go
Removing vendor/gopkg.in/square/go-jose.v2/jwk.go
Removing vendor/gopkg.in/square/go-jose.v2/jwe.go
Removing vendor/gopkg.in/square/go-jose.v2/json/tags.go
Removing vendor/gopkg.in/square/go-jose.v2/json/stream.go
Removing vendor/gopkg.in/square/go-jose.v2/json/scanner.go
Removing vendor/gopkg.in/square/go-jose.v2/json/indent.go
Removing vendor/gopkg.in/square/go-jose.v2/json/encode.go
Removing vendor/gopkg.in/square/go-jose.v2/json/decode.go
Removing vendor/gopkg.in/square/go-jose.v2/json/README.md
Removing vendor/gopkg.in/square/go-jose.v2/json/LICENSE
Removing vendor/gopkg.in/square/go-jose.v2/encoding.go
Removing vendor/gopkg.in/square/go-jose.v2/doc.go
Removing vendor/gopkg.in/square/go-jose.v2/crypter.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac.go
Removing vendor/gopkg.in/square/go-jose.v2/asymmetric.go
Removing vendor/gopkg.in/square/go-jose.v2/README.md
Removing vendor/gopkg.in/square/go-jose.v2/LICENSE
Removing vendor/gopkg.in/square/go-jose.v2/CONTRIBUTING.md
Removing vendor/gopkg.in/square/go-jose.v2/BUG-BOUNTY.md
Removing vendor/gopkg.in/square/go-jose.v2/.travis.yml
Removing vendor/gopkg.in/square/go-jose.v2/.gitignore
Removing vendor/gopkg.in/square/go-jose.v2/.gitcookies.sh.enc
Auto-merging go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 chore(deps): Migrate to github.com/go-jose/go-jose/v3
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-v0.53.x

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2024-04-08T14:08:59Z

@vdemeester: #7750 failed to apply on top of branch "release-v0.50.x":

Applying: chore(deps): Migrate to github.com/go-jose/go-jose/v3
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
Removing vendor/gopkg.in/square/go-jose.v2/symmetric.go
Removing vendor/gopkg.in/square/go-jose.v2/signing.go
Removing vendor/gopkg.in/square/go-jose.v2/shared.go
Removing vendor/gopkg.in/square/go-jose.v2/opaque.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/validation.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/jwt.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/errors.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/doc.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/claims.go
Removing vendor/gopkg.in/square/go-jose.v2/jwt/builder.go
Removing vendor/gopkg.in/square/go-jose.v2/jws.go
Removing vendor/gopkg.in/square/go-jose.v2/jwk.go
Removing vendor/gopkg.in/square/go-jose.v2/jwe.go
Removing vendor/gopkg.in/square/go-jose.v2/json/tags.go
Removing vendor/gopkg.in/square/go-jose.v2/json/stream.go
Removing vendor/gopkg.in/square/go-jose.v2/json/scanner.go
Removing vendor/gopkg.in/square/go-jose.v2/json/indent.go
Removing vendor/gopkg.in/square/go-jose.v2/json/encode.go
Removing vendor/gopkg.in/square/go-jose.v2/json/decode.go
Removing vendor/gopkg.in/square/go-jose.v2/json/README.md
Removing vendor/gopkg.in/square/go-jose.v2/json/LICENSE
Removing vendor/gopkg.in/square/go-jose.v2/encoding.go
Removing vendor/gopkg.in/square/go-jose.v2/doc.go
Removing vendor/gopkg.in/square/go-jose.v2/crypter.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/key_wrap.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/ecdh_es.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/concat_kdf.go
Removing vendor/gopkg.in/square/go-jose.v2/cipher/cbc_hmac.go
Removing vendor/gopkg.in/square/go-jose.v2/asymmetric.go
Removing vendor/gopkg.in/square/go-jose.v2/README.md
Removing vendor/gopkg.in/square/go-jose.v2/LICENSE
Removing vendor/gopkg.in/square/go-jose.v2/CONTRIBUTING.md
Removing vendor/gopkg.in/square/go-jose.v2/BUG-BOUNTY.md
Removing vendor/gopkg.in/square/go-jose.v2/.travis.yml
Removing vendor/gopkg.in/square/go-jose.v2/.gitignore
Removing vendor/gopkg.in/square/go-jose.v2/.gitcookies.sh.enc
Auto-merging go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 chore(deps): Migrate to github.com/go-jose/go-jose/v3
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-v0.50.x

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

tekton-robot · 2024-04-08T14:09:01Z

@vdemeester: #7750 failed to apply on top of branch "release-v0.47.x":

Patch is empty.
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

In response to this:

/cherry-pick release-v0.47.x

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

vdemeester · 2024-04-08T14:13:01Z

Alright, will have to do those manually 😛

vdemeester · 2024-04-08T14:33:14Z

for what is worth, here are the cherry-picks

tekton-robot added the do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. label Mar 12, 2024

tekton-robot requested review from jerop and vdemeester March 12, 2024 17:14

tekton-robot added size/S Denotes a PR that changes 10-29 lines, ignoring generated files. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 12, 2024

khrm reviewed Mar 15, 2024

View reviewed changes

tekton-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels Mar 15, 2024

tekton-robot added the needs-rebase Indicates a PR cannot be merged because it has merge conflicts with HEAD. label Mar 18, 2024

isibeni force-pushed the fix-go-jose branch from 3312d1a to d95be2a Compare April 4, 2024 14:58

tekton-robot added the kind/misc Categorizes issue or PR as a miscellaneuous one. label Apr 4, 2024

isibeni force-pushed the fix-go-jose branch from d95be2a to 341468c Compare April 5, 2024 08:27

chore(deps): Migrate to github.com/go-jose/go-jose/v3

9cab47e

Stop using archived gopkg.in/square/go-jose.v2 pkg Switch to github.com/go-jose/go-jose/v3 instead Fixes CVE-2024-28180

isibeni force-pushed the fix-go-jose branch from 341468c to 9cab47e Compare April 5, 2024 14:35

vdemeester approved these changes Apr 5, 2024

View reviewed changes

tekton-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 5, 2024

afrittoli reviewed Apr 8, 2024

View reviewed changes

tekton-robot assigned afrittoli Apr 8, 2024

tekton-robot added the lgtm Indicates that a PR is ready to be merged. label Apr 8, 2024

tekton-robot merged commit c19b6e6 into tektoncd:main Apr 8, 2024

chore(deps): Migrate to github.com/go-jose/go-jose/v3 #7750

chore(deps): Migrate to github.com/go-jose/go-jose/v3 #7750

Uh oh!

Conversation

isibeni commented Mar 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Changes

Submitter Checklist

Release Notes

Uh oh!

linux-foundation-easycla bot commented Mar 12, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

tekton-robot commented Mar 12, 2024

Uh oh!

khrm left a comment

Choose a reason for hiding this comment

Uh oh!

khrm commented Mar 15, 2024

Uh oh!

isibeni commented Mar 25, 2024

Uh oh!

vdemeester commented Mar 25, 2024

Uh oh!

isibeni commented Mar 26, 2024

Uh oh!

vdemeester commented Mar 27, 2024

Uh oh!

isibeni commented Apr 4, 2024

Uh oh!

isibeni commented Apr 5, 2024

Uh oh!

tekton-robot commented Apr 5, 2024

Uh oh!

afrittoli commented Apr 8, 2024

Uh oh!

afrittoli left a comment

Choose a reason for hiding this comment

Uh oh!

isibeni commented Apr 8, 2024

Uh oh!

vdemeester commented Apr 8, 2024

Uh oh!

vdemeester commented Apr 8, 2024

Uh oh!

vdemeester commented Apr 8, 2024

Uh oh!

vdemeester commented Apr 8, 2024

Uh oh!

tekton-robot commented Apr 8, 2024

Uh oh!

tekton-robot commented Apr 8, 2024

Uh oh!

tekton-robot commented Apr 8, 2024

Uh oh!

tekton-robot commented Apr 8, 2024

Uh oh!

vdemeester commented Apr 8, 2024

Uh oh!

vdemeester commented Apr 8, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

isibeni commented Mar 12, 2024 •

edited

Loading

linux-foundation-easycla bot commented Mar 12, 2024 •

edited

Loading