mirror of
https://github.com/docker/compose.git
synced 2026-06-30 13:17:32 +00:00
go1.18.3 (released 2022-06-01) includes security fixes to the crypto/rand, crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the compiler, and the crypto/tls and text/template/parse packages. See the Go 1.18.3 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.18.3+label%3ACherryPickApproved Hello gophers, We have just released Go versions 1.18.3 and 1.17.11, minor point releases. These minor releases include 4 security fixes following the security policy: - crypto/rand: rand.Read hangs with extremely large buffers On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 << 32 - 1 bytes. Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset, for reporting this issue. This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561. - crypto/tls: session tickets lack random ticket_age_add Session tickets generated by crypto/tls did not contain a randomly generated ticket_age_add. This allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. Thanks to GitHub user nervuri for reporting this. This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814. - `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput` are executed when Cmd.Path is unset and, in the working directory, there are binaries named either "..com" or "..exe", they will be executed. Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting this. This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574. - `path/filepath`: Clean(`.\c:`) returns `c:` on Windows On Windows, the `filepath.Clean` function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. Thanks to Unrud for reporting this issue. This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476. [CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634 [CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629 [CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580 [CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
145 lines
4 KiB
YAML
145 lines
4 KiB
YAML
name: Continuous integration
|
|
|
|
on:
|
|
push:
|
|
branches:
|
|
- v2
|
|
pull_request:
|
|
workflow_dispatch:
|
|
inputs:
|
|
debug_enabled:
|
|
description: 'To run with tmate enter "debug_enabled"'
|
|
required: false
|
|
default: "false"
|
|
|
|
jobs:
|
|
lint:
|
|
name: Lint
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
GO111MODULE: "on"
|
|
steps:
|
|
- name: Set up Go 1.18
|
|
uses: actions/setup-go@v2
|
|
with:
|
|
go-version: 1.18.3
|
|
id: go
|
|
|
|
- name: Checkout code into the Go module directory
|
|
uses: actions/checkout@v2
|
|
|
|
- name: Validate go-mod, license headers and docs are up-to-date
|
|
run: make validate
|
|
|
|
- name: Run golangci-lint
|
|
env:
|
|
BUILD_TAGS: e2e
|
|
uses: golangci/golangci-lint-action@v2
|
|
with:
|
|
args: --timeout=180s
|
|
|
|
# only on main branch, costs too much for the gain on every PR
|
|
validate-cross-build:
|
|
name: Validate cross build
|
|
runs-on: ubuntu-latest
|
|
if: github.ref == 'refs/heads/main'
|
|
env:
|
|
GO111MODULE: "on"
|
|
steps:
|
|
- name: Set up Go 1.18
|
|
uses: actions/setup-go@v2
|
|
with:
|
|
go-version: 1.18.3
|
|
id: go
|
|
|
|
- name: Checkout code into the Go module directory
|
|
uses: actions/checkout@v2
|
|
|
|
- uses: actions/cache@v2
|
|
with:
|
|
path: ~/go/pkg/mod
|
|
key: go-${{ hashFiles('**/go.sum') }}
|
|
|
|
# Ensure we don't discover cross platform build issues at release time.
|
|
# Time used to build linux here is gained back in the build for local E2E step
|
|
- name: Build packages
|
|
run: make -f builder.Makefile cross
|
|
|
|
build-plugin:
|
|
name: Build and tests in plugin mode
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
GO111MODULE: "on"
|
|
steps:
|
|
- name: Set up Go 1.18
|
|
uses: actions/setup-go@v2
|
|
with:
|
|
go-version: 1.18.3
|
|
id: go
|
|
|
|
- name: Setup docker CLI
|
|
run: |
|
|
curl https://download.docker.com/linux/static/stable/x86_64/docker-20.10.3.tgz | tar xz
|
|
sudo cp ./docker/docker /usr/bin/ && rm -rf docker && docker version
|
|
|
|
- name: Checkout code into the Go module directory
|
|
uses: actions/checkout@v2
|
|
|
|
- uses: actions/cache@v2
|
|
with:
|
|
path: ~/go/pkg/mod
|
|
key: go-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Test
|
|
run: make -f builder.Makefile test
|
|
|
|
- name: Build for local E2E
|
|
env:
|
|
BUILD_TAGS: e2e
|
|
run: make GIT_TAG=e2e-PR-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }} -f builder.Makefile compose-plugin
|
|
|
|
- name: E2E Test in plugin mode
|
|
run: make e2e-compose
|
|
|
|
build-standalone:
|
|
name: Build and tests in standalone mode
|
|
runs-on: ubuntu-latest
|
|
env:
|
|
GO111MODULE: "on"
|
|
steps:
|
|
- name: Set up Go 1.18
|
|
uses: actions/setup-go@v2
|
|
with:
|
|
go-version: 1.18.3
|
|
id: go
|
|
|
|
- name: Setup docker CLI
|
|
run: |
|
|
curl https://download.docker.com/linux/static/stable/x86_64/docker-20.10.3.tgz | tar xz
|
|
sudo cp ./docker/docker /usr/bin/ && rm -rf docker && docker version
|
|
|
|
- name: Checkout code into the Go module directory
|
|
uses: actions/checkout@v2
|
|
|
|
- uses: actions/cache@v2
|
|
with:
|
|
path: ~/go/pkg/mod
|
|
key: go-${{ hashFiles('**/go.sum') }}
|
|
|
|
- name: Build for local E2E
|
|
env:
|
|
BUILD_TAGS: e2e
|
|
run: make GIT_TAG=e2e-PR-${{ github.event.pull_request.number }}-${{ github.event.pull_request.head.sha }} -f builder.Makefile compose-plugin
|
|
|
|
- name: Setup tmate session
|
|
uses: mxschmitt/action-tmate@v3
|
|
with:
|
|
limit-access-to-actor: true
|
|
github-token: ${{ secrets.GITHUB_TOKEN }}
|
|
if: ${{ github.event_name == 'workflow_dispatch' && github.event.inputs.debug_enabled }}
|
|
|
|
- name: E2E Test in standalone mode
|
|
run: |
|
|
rm -f /usr/local/bin/docker-compose
|
|
cp bin/docker-compose /usr/local/bin
|
|
make e2e-compose-standalone
|