Skip to content

chore: Bump /x/crypto to v0.14.0 and fix changes#33169

Merged
codingllama merged 2 commits intomasterfrom
codingllama/x-crypto-ssh
Oct 10, 2023
Merged

chore: Bump /x/crypto to v0.14.0 and fix changes#33169
codingllama merged 2 commits intomasterfrom
codingllama/x-crypto-ssh

Conversation

@codingllama
Copy link
Copy Markdown
Contributor

@codingllama codingllama commented Oct 9, 2023

The new /x/crypto/ssh version introduces the ssh.MultiAlgorithmSigner. As a consequence, it changed the default "ssh-rsa" hash from SHA-512 to SHA-256. (It's unclear to me whether this is a breaking change, but might as well be.)

I'm not seeing other ways to interact with the underlying ssh.Signer other than wrapping it again, so that's what I'm doing here.

I've looked for other usages of ssh.NewSignerFromSigner (or bare ssh usages), but nothing else jumped the eye.

@github-actions github-actions Bot requested a review from lxea October 9, 2023 18:36
@codingllama
Copy link
Copy Markdown
Contributor Author

codingllama commented Oct 9, 2023

Related to this week's dependabot updates (#33154, #33121, etc).

@codingllama codingllama force-pushed the codingllama/x-crypto-ssh branch from 9a8a707 to f2458a7 Compare October 9, 2023 19:12
@codingllama
Copy link
Copy Markdown
Contributor Author

codingllama commented Oct 10, 2023

Friendly ping all?

@codingllama
Copy link
Copy Markdown
Contributor Author

codingllama commented Oct 10, 2023

Many thanks! Expect the bot to create another Go group update once this lands.

@codingllama codingllama added this pull request to the merge queue Oct 10, 2023
@github-merge-queue github-merge-queue Bot removed this pull request from the merge queue due to failed status checks Oct 10, 2023
@codingllama codingllama added this pull request to the merge queue Oct 10, 2023
Merged via the queue into master with commit 29c5738 Oct 10, 2023
@codingllama codingllama deleted the codingllama/x-crypto-ssh branch October 10, 2023 18:33
@codingllama codingllama mentioned this pull request Oct 12, 2023
Merged
jentfoo pushed a commit that referenced this pull request Oct 12, 2023
@codingllama @jentfoo
chore: Bump /x/crypto to v0.14.0 and fix changes (#33169)
f5a9e39 
* Bump /x/crypto to v0.14.0

* Force ssh.MultiAlgorithmSigner to SHA-512
github-merge-queue Bot pushed a commit that referenced this pull request Oct 12, 2023
@jentfoo @dependabot @codingllama
[v14] Bump golang.org/x/net Backport (#33420)
3286239 
* Bump golang.org/x/net from 0.14.0 to 0.17.0 in /assets/backport

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.14.0 to 0.17.0 in /build.assets/tooling

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.14.0 to 0.17.0 in /api

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /integrations/kube-agent-updater

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.14.0 to 0.17.0

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/desktop-registration

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0.
- [Commits](golang/net@v0.7.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.7.0 to 0.17.0 in /examples/go-client

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0.
- [Commits](golang/net@v0.7.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/access-plugin-minimal

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.8.0 to 0.17.0 in /examples/api-sync-roles

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/service-discovery-api-client

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: Bump /x/crypto to v0.14.0 and fix changes (#33169)

* Bump /x/crypto to v0.14.0

* Force ssh.MultiAlgorithmSigner to SHA-512

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
jentfoo pushed a commit that referenced this pull request Oct 13, 2023
@codingllama @jentfoo
chore: Bump /x/crypto to v0.14.0 and fix changes (#33169)
fb2573d 
* Bump /x/crypto to v0.14.0

* Force ssh.MultiAlgorithmSigner to SHA-512
jentfoo pushed a commit that referenced this pull request Oct 13, 2023
@codingllama @jentfoo
chore: Bump /x/crypto to v0.14.0 and fix changes (#33169)
631919f 
* Bump /x/crypto to v0.14.0

* Force ssh.MultiAlgorithmSigner to SHA-512
github-merge-queue Bot pushed a commit that referenced this pull request Oct 13, 2023
@jentfoo @dependabot @codingllama
[v13] Bump golang.org/x/net Backport (#33447)
30ac383 
* Bump golang.org/x/net from 0.14.0 to 0.17.0 in /api

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.7.0 to 0.17.0 in /web/.cloudbuild/scripts

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0.
- [Commits](golang/net@v0.7.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.10.0 to 0.17.0 in /build.assets/tooling

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.7.0 to 0.17.0 in /assets/backport

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0.
- [Commits](golang/net@v0.7.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/desktop-registration

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.5.0 to 0.17.0.
- [Commits](golang/net@v0.5.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.7.0 to 0.17.0 in /examples/workflows

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0.
- [Commits](golang/net@v0.7.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/service-discovery-api-client

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.14.0 to 0.17.0

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.7.0 to 0.17.0 in /examples/go-client

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0.
- [Commits](golang/net@v0.7.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /integrations/kube-agent-updater

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: Bump /x/crypto to v0.14.0 and fix changes (#33169)

* Bump /x/crypto to v0.14.0

* Force ssh.MultiAlgorithmSigner to SHA-512

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
github-merge-queue Bot pushed a commit that referenced this pull request Oct 13, 2023
@jentfoo @dependabot
@codingllama @jakule
[v12] Bump golang.org/x/net Backport (#33448)
d84852a 
* Bump golang.org/x/net from 0.7.0 to 0.17.0 in /web/.cloudbuild/scripts

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0.
- [Commits](golang/net@v0.7.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/workflows

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.0.0-20220127200216-cd36cc0744dd to 0.17.0.
- [Commits](https://github.com/golang/net/commits/v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.10.0 to 0.17.0 in /build.assets/tooling

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.10.0 to 0.17.0.
- [Commits](golang/net@v0.10.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/go-client

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.0.0-20220127200216-cd36cc0744dd to 0.17.0.
- [Commits](https://github.com/golang/net/commits/v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.7.0 to 0.17.0 in /assets/backport

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.7.0 to 0.17.0.
- [Commits](golang/net@v0.7.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.14.0 to 0.17.0 in /api

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/service-discovery-api-client

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.8.0 to 0.17.0 in /examples/api-sync-roles

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net from 0.14.0 to 0.17.0

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.14.0 to 0.17.0.
- [Commits](golang/net@v0.14.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump golang.org/x/net in /examples/access-plugin-minimal

Bumps [golang.org/x/net](https://github.com/golang/net) from 0.8.0 to 0.17.0.
- [Commits](golang/net@v0.8.0...v0.17.0)

---
updated-dependencies:
- dependency-name: golang.org/x/net
  dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

* chore: Bump /x/crypto to v0.14.0 and fix changes (#33169)

* Bump /x/crypto to v0.14.0

* Force ssh.MultiAlgorithmSigner to SHA-512

* Switch to upstream x/crypto (#28929)

* Switch to upstream x/crypto

Removed the dependency override for golang.org/x/crypto and updated the specific version used latest in go.mod. This change is needed because the specific issue with OpenSSH <= 7.6 that necessitated the override has been addressed upstream, making the override unnecessary.

* Update config test to align with newer encryption standards

Commit updates the config test to include more encryption standards, thus maintaining compatibility with a wider range of environments. "ElementsMatch" is now used to ensure the presence of cipher keys, irrespective of their order in the list. This makes the tests more resilient against future changes and amendments in encryption standards.

---------

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Alan Parra <alan.parra@goteleport.com>
Co-authored-by: Jakub Nyckowski <jakub.nyckowski@goteleport.com>
@nklaassen nklaassen mentioned this pull request Aug 27, 2024
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Joerger Joerger Joerger approved these changes

@rosstimothy rosstimothy rosstimothy approved these changes

+1 more reviewer

@jentfoo jentfoo jentfoo approved these changes

Reviewers whose approvals may not affect merge requirements

Assignees

No one assigned

Labels

size/sm

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

4 participants

@codingllama @jentfoo @Joerger @rosstimothy