Fix CVE-2023-45288 by dannawang0221 · Pull Request #1680 · kubernetes-sigs/gcp-compute-persistent-disk-csi-driver

dannawang0221 · 2024-04-23T17:31:21Z

What type of PR is this?

Uncomment only one /kind <> line, hit enter to put that in a new line, and remove leading whitespaces from that line:

/kind bug

What this PR does / why we need it:

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Fix CVE-2023-45288
update k8s.io/mount-utils to not use alpha version

dannawang0221 · 2024-04-23T17:31:48Z

/ok-to-test

dannawang0221 · 2024-04-23T17:31:54Z

/assign @sunnylovestiramisu

sunnylovestiramisu · 2024-04-23T17:40:00Z

 k8s.io/kube-openapi/pkg/validation/spec
 # k8s.io/mount-utils v0.31.0-alpha.0
-## explicit; go 1.22
+## explicit; go 1.22.0


Can do you do go mod tidy and go mod vendor to clean this up?

run go mod tidy will change go.mod back to 1.22.0

sunnylovestiramisu · 2024-04-23T17:40:28Z

@@ -885,7 +885,7 @@ k8s.io/kube-openapi/pkg/spec3
 k8s.io/kube-openapi/pkg/util/proto
 k8s.io/kube-openapi/pkg/validation/spec
 # k8s.io/mount-utils v0.31.0-alpha.0


Hmm not related to this PR but this is not right, why are we depending on the alpha version.

It comes from dependabot cde24e7 Seems like we should revert it?

dannawang0221 · 2024-04-23T18:16:26Z

/retest

dannawang0221 · 2024-04-23T18:28:43Z

/cherry-pick release-1.8

k8s-infra-cherrypick-robot · 2024-04-23T18:28:45Z

@dannawang0221: once the present PR merges, I will cherry-pick it on top of release-1.8 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dannawang0221 · 2024-04-23T18:28:52Z

/cherry-pick release-1.9

k8s-infra-cherrypick-robot · 2024-04-23T18:28:55Z

@dannawang0221: once the present PR merges, I will cherry-pick it on top of release-1.9 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dannawang0221 · 2024-04-23T18:28:59Z

/cherry-pick release-1.10

k8s-infra-cherrypick-robot · 2024-04-23T18:29:01Z

@dannawang0221: once the present PR merges, I will cherry-pick it on top of release-1.10 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dannawang0221 · 2024-04-23T18:29:03Z

/cherry-pick release-1.11

k8s-infra-cherrypick-robot · 2024-04-23T18:29:05Z

@dannawang0221: once the present PR merges, I will cherry-pick it on top of release-1.11 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dannawang0221 · 2024-04-23T18:29:07Z

/cherry-pick release-1.12

k8s-infra-cherrypick-robot · 2024-04-23T18:29:09Z

@dannawang0221: once the present PR merges, I will cherry-pick it on top of release-1.12 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.12

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

dannawang0221 · 2024-04-23T18:29:11Z

/cherry-pick release-1.13

k8s-infra-cherrypick-robot · 2024-04-23T18:29:12Z

@dannawang0221: once the present PR merges, I will cherry-pick it on top of release-1.13 in a new PR and assign it to you.

Details

In response to this:

/cherry-pick release-1.13

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

sunnylovestiramisu · 2024-04-23T18:38:35Z

/retest

dannawang0221 · 2024-04-23T18:39:34Z

/retest

dannawang0221 · 2024-04-23T19:49:04Z

/retest

sunnylovestiramisu · 2024-04-23T20:05:31Z

/lgtm
/approve

k8s-ci-robot · 2024-04-23T20:05:37Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: dannawang0221, sunnylovestiramisu

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

~~OWNERS~~ [sunnylovestiramisu]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

k8s-infra-cherrypick-robot · 2024-04-23T20:23:01Z

@dannawang0221: #1680 failed to apply on top of branch "release-1.8":

Applying: Fix CVE-2023-45288
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
A	vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_intermediate_cert.der
A	vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_leaf_cert.der
A	vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_root_cert.der
A	vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_intermediate_cert.der
A	vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_leaf_cert.der
A	vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_root_cert.der
A	vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.der
A	vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.pem
A	vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_key.pem
A	vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.der
A	vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.pem
A	vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_key.pem
A	vendor/github.com/google/s2a-go/internal/v2/testdata/client_cert.pem
A	vendor/github.com/google/s2a-go/internal/v2/testdata/client_key.pem
A	vendor/github.com/google/s2a-go/internal/v2/testdata/server_cert.pem
A	vendor/github.com/google/s2a-go/internal/v2/testdata/server_key.pem
A	vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_cert.pem
A	vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_key.pem
A	vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_cert.pem
A	vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_key.pem
A	vendor/github.com/google/s2a-go/testdata/client_cert.pem
A	vendor/github.com/google/s2a-go/testdata/client_key.pem
A	vendor/github.com/google/s2a-go/testdata/mds_client_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_client_key.pem
A	vendor/github.com/google/s2a-go/testdata/mds_root_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_key.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_cert.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_key.pem
A	vendor/github.com/google/s2a-go/testdata/server_cert.pem
A	vendor/github.com/google/s2a-go/testdata/server_key.pem
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
CONFLICT (content): Merge conflict in vendor/modules.txt
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
CONFLICT (content): Merge conflict in go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Fix CVE-2023-45288
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Details

In response to this:

/cherry-pick release-1.8

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-infra-cherrypick-robot · 2024-04-23T20:23:36Z

@dannawang0221: #1680 failed to apply on top of branch "release-1.9":

Applying: Fix CVE-2023-45288
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
A	vendor/github.com/google/s2a-go/testdata/mds_client_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_client_key.pem
A	vendor/github.com/google/s2a-go/testdata/mds_root_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_key.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_cert.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_key.pem
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
CONFLICT (content): Merge conflict in vendor/modules.txt
Removing vendor/github.com/google/s2a-go/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_intermediate_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_intermediate_cert.der
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Fix CVE-2023-45288
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Details

In response to this:

/cherry-pick release-1.9

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-infra-cherrypick-robot · 2024-04-23T20:24:11Z

@dannawang0221: #1680 failed to apply on top of branch "release-1.10":

Applying: Fix CVE-2023-45288
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
A	vendor/github.com/google/s2a-go/testdata/mds_client_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_client_key.pem
A	vendor/github.com/google/s2a-go/testdata/mds_root_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_key.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_cert.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_key.pem
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
CONFLICT (content): Merge conflict in vendor/modules.txt
Removing vendor/github.com/google/s2a-go/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_intermediate_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_intermediate_cert.der
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Fix CVE-2023-45288
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Details

In response to this:

/cherry-pick release-1.10

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-infra-cherrypick-robot · 2024-04-23T20:24:45Z

@dannawang0221: #1680 failed to apply on top of branch "release-1.11":

Applying: Fix CVE-2023-45288
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
A	vendor/github.com/google/s2a-go/testdata/mds_client_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_client_key.pem
A	vendor/github.com/google/s2a-go/testdata/mds_root_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_key.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_cert.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_key.pem
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
CONFLICT (content): Merge conflict in vendor/modules.txt
Removing vendor/github.com/google/s2a-go/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_intermediate_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_intermediate_cert.der
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Fix CVE-2023-45288
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Details

In response to this:

/cherry-pick release-1.11

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-infra-cherrypick-robot · 2024-04-23T20:25:21Z

@dannawang0221: #1680 failed to apply on top of branch "release-1.12":

Applying: Fix CVE-2023-45288
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
A	vendor/github.com/google/s2a-go/testdata/mds_client_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_client_key.pem
A	vendor/github.com/google/s2a-go/testdata/mds_root_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_cert.pem
A	vendor/github.com/google/s2a-go/testdata/mds_server_key.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_cert.pem
A	vendor/github.com/google/s2a-go/testdata/self_signed_key.pem
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
CONFLICT (content): Merge conflict in vendor/modules.txt
Removing vendor/github.com/google/s2a-go/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_intermediate_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_intermediate_cert.der
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Fix CVE-2023-45288
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Details

In response to this:

/cherry-pick release-1.12

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

k8s-infra-cherrypick-robot · 2024-04-23T20:25:55Z

@dannawang0221: #1680 failed to apply on top of branch "release-1.13":

Applying: Fix CVE-2023-45288
Using index info to reconstruct a base tree...
M	go.mod
M	go.sum
M	vendor/modules.txt
Falling back to patching base and 3-way merge...
Auto-merging vendor/modules.txt
CONFLICT (content): Merge conflict in vendor/modules.txt
Removing vendor/github.com/google/s2a-go/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/self_signed_key.pem
Removing vendor/github.com/google/s2a-go/testdata/self_signed_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/mds_server_key.pem
Removing vendor/github.com/google/s2a-go/testdata/mds_server_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/mds_root_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/mds_client_key.pem
Removing vendor/github.com/google/s2a-go/testdata/mds_client_cert.pem
Removing vendor/github.com/google/s2a-go/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/tlsconfigstore/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/server_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_key.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.pem
Removing vendor/github.com/google/s2a-go/internal/v2/remotesigner/testdata/client_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/server_intermediate_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_root_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_leaf_cert.der
Removing vendor/github.com/google/s2a-go/internal/v2/certverifier/testdata/client_intermediate_cert.der
Auto-merging go.sum
CONFLICT (content): Merge conflict in go.sum
Auto-merging go.mod
error: Failed to merge in the changes.
hint: Use 'git am --show-current-patch=diff' to see the failed patch
Patch failed at 0001 Fix CVE-2023-45288
When you have resolved this problem, run "git am --continue".
If you prefer to skip this patch, run "git am --skip" instead.
To restore the original branch and stop patching, run "git am --abort".

Details

In response to this:

/cherry-pick release-1.13

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Fix CVE-2023-45288

407448c

k8s-ci-robot added release-note Denotes a PR that will be considered when it comes time to generate release notes. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. size/XL Denotes a PR that changes 500-999 lines, ignoring generated files. labels Apr 23, 2024

k8s-ci-robot requested review from amacaskill and saikat-royc April 23, 2024 17:31

k8s-ci-robot added the ok-to-test Indicates a non-member PR verified by an org member that is safe to test. label Apr 23, 2024

k8s-ci-robot assigned sunnylovestiramisu Apr 23, 2024

update go version

25246b8

sunnylovestiramisu reviewed Apr 23, 2024

View reviewed changes

update modules.txt

14869fa

update k8s.io/mount-utils to not use alpha version

71d58f7

k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label Apr 23, 2024

k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label Apr 23, 2024

k8s-ci-robot merged commit 529a643 into kubernetes-sigs:master Apr 23, 2024

dfajmon mentioned this pull request Jul 2, 2024

STOR-1602: Rebase to upstream v1.14.1 for OCP 4.17 openshift/gcp-pd-csi-driver#68

Merged

Conversation

dannawang0221 commented Apr 23, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

sunnylovestiramisu Apr 23, 2024

Choose a reason for hiding this comment

Uh oh!

dannawang0221 Apr 23, 2024

Choose a reason for hiding this comment

Uh oh!

sunnylovestiramisu Apr 23, 2024

Choose a reason for hiding this comment

Uh oh!

dannawang0221 Apr 23, 2024

Choose a reason for hiding this comment

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

sunnylovestiramisu commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

dannawang0221 commented Apr 23, 2024

Uh oh!

sunnylovestiramisu commented Apr 23, 2024

Uh oh!

k8s-ci-robot commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

k8s-infra-cherrypick-robot commented Apr 23, 2024

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

dannawang0221 commented Apr 23, 2024 •

edited

Loading