Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Upgrade crypt and etcd #961

Closed
wants to merge 1 commit into from
Closed

Upgrade crypt and etcd #961

wants to merge 1 commit into from

Conversation

sagikazarmark
Copy link
Collaborator

@sagikazarmark sagikazarmark commented Aug 19, 2020 •
edited
Loading

Fixes #865
Fixes #956
Fixes #957
Fixes #964
Fixes #1049

@sagikazarmark
Upgrade crypt and etcd
d0544e4 
Signed-off-by: Mark Sagi-Kazar <[email protected]>
@sagikazarmark
Copy link
Collaborator Author

@SVilgelm @bhamail can you test this branch in your environment? I had some issues with etcd (see bketelsen/crypt#6 (comment)) and had to manually add it as a dependency with the matching version in crypt.

It shouldn't affect builds though, as it failed on a test dependency, so it's a go module issue.

@SVilgelm
Copy link

I have same problem, cannot update

SVilgelm
SVilgelm reviewed Aug 20, 2020
View reviewed changes
go.mod
@@ -32,9 +35,11 @@ require (
github.com/tmc/grpc-websocket-proxy v0.0.0-20190109142713-0ad062ec5ee5 // indirect
github.com/xiang90/probing v0.0.0-20190116061207-43a291ad63a2 // indirect
go.etcd.io/bbolt v1.3.2 // indirect
go.etcd.io/etcd v3.3.24+incompatible // indirect
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is incorrect, you need to use GitHub url, the etcd of version 3.3.24 uses GitHub, only 3.4.x uses go.etcd.io

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's actually a hack I added there so that I can upgrade the crypt library, otherwise go complains about a missing test dependency.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm thinking about copying the entire crypt code into the repo under an internal package. This whole crypt thing is a sad, unfortunate part of Viper from which I really hope to get rid of in Viper 2, at least in this form.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Maybe I'm doing something wrong, but here is my logs. And everything works now. I don't remember why it was not working previously.

20-08-20 13:08 % go get github.com/bketelsen/crypt
go: github.com/bketelsen/crypt upgrade => v0.0.3

20-08-20 13:08 % git diff
diff --git a/go.mod b/go.mod
index 7d108dc..e17ac0f 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/spf13/viper
 go 1.12

 require (
-       github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c
+       github.com/bketelsen/crypt v0.0.3
        github.com/coreos/bbolt v1.3.2 // indirect
        github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e // indirect
        github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f // indirect
diff --git a/go.sum b/go.sum
index 463aa7d..66474f2 100644
--- a/go.sum
+++ b/go.sum
@@ -33,12 +33,15 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c h1:+0HFd5KSZ/mm3JmhmrDukiId5iR6w4+BdFtfSy4yWIc=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
+github.com/bketelsen/crypt v0.0.3 h1:6bNynYE39IsvJHCLr6ziogOcIAec7LO6cuW/lwWGEWw=
+github.com/bketelsen/crypt v0.0.3/go.mod h1:XG4b7lkBbt44/SZ4QOtOjhd5SXJzF+pTJE+nWFY+Yqs=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/bbolt v1.3.2 h1:wZwiHHUieZCquLkDL0B8UhzreNWsPHooDAG3q34zk0s=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.13+incompatible h1:8F3hqu9fGYLBifCmRCJsicFqDx/D68Rt3q1JMazcgBQ=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/etcd v3.3.24+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8=

20-08-20 13:09 % go test ./...
go: downloading github.com/coreos/etcd v3.3.24+incompatible
go: downloading github.com/mitchellh/go-homedir v1.0.0
ok  	github.com/spf13/viper	0.264s
?   	github.com/spf13/viper/remote	[no test files]

20-08-20 13:09 % git diff
diff --git a/go.mod b/go.mod
index 7d108dc..e17ac0f 100644
--- a/go.mod
+++ b/go.mod
@@ -3,7 +3,7 @@ module github.com/spf13/viper
 go 1.12

 require (
-       github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c
+       github.com/bketelsen/crypt v0.0.3
        github.com/coreos/bbolt v1.3.2 // indirect
        github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e // indirect
        github.com/coreos/pkg v0.0.0-20180928190104-399ea9e2e55f // indirect
diff --git a/go.sum b/go.sum
index 463aa7d..51b4e76 100644
--- a/go.sum
+++ b/go.sum
@@ -33,12 +33,16 @@ github.com/beorn7/perks v1.0.0/go.mod h1:KWe93zE9D1o94FZ5RNwFwVgaQK1VOXiVxmqh+Ce
 github.com/bgentry/speakeasy v0.1.0/go.mod h1:+zsyZBPWlz7T6j88CTgSN5bM796AkVf0kBD4zp0CCIs=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c h1:+0HFd5KSZ/mm3JmhmrDukiId5iR6w4+BdFtfSy4yWIc=
 github.com/bketelsen/crypt v0.0.3-0.20200106085610-5cbc8cc4026c/go.mod h1:MKsuJmJgSg28kpZDP6UIiPt0e0Oz0kqKNGyRaWEPv84=
+github.com/bketelsen/crypt v0.0.3 h1:6bNynYE39IsvJHCLr6ziogOcIAec7LO6cuW/lwWGEWw=
+github.com/bketelsen/crypt v0.0.3/go.mod h1:XG4b7lkBbt44/SZ4QOtOjhd5SXJzF+pTJE+nWFY+Yqs=
 github.com/cespare/xxhash v1.1.0/go.mod h1:XrSqR1VqqWfGrhpAt58auRo0WTKS1nRRg3ghfAqPWnc=
 github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDkc90ppPyw=
 github.com/coreos/bbolt v1.3.2 h1:wZwiHHUieZCquLkDL0B8UhzreNWsPHooDAG3q34zk0s=
 github.com/coreos/bbolt v1.3.2/go.mod h1:iRUV2dpdMOn7Bo10OQBFzIJO9kkE559Wcmn+qkEiiKk=
 github.com/coreos/etcd v3.3.13+incompatible h1:8F3hqu9fGYLBifCmRCJsicFqDx/D68Rt3q1JMazcgBQ=
 github.com/coreos/etcd v3.3.13+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
+github.com/coreos/etcd v3.3.24+incompatible h1:VTP6JXFEpcUyewV0VWQKC1dqeZ4mfq9SbRIyYvTq0nc=
+github.com/coreos/etcd v3.3.24+incompatible/go.mod h1:uF7uidLiAD3TWHmW31ZFd/JWoc32PjwdhPthX9715RE=
 github.com/coreos/go-semver v0.3.0 h1:wkHLiw0WNATZnSG7epLsujiMCgPAc9xhjJ4tgnAxmfM=
 github.com/coreos/go-semver v0.3.0/go.mod h1:nnelYz7RCh+5ahJtPPxZlU+153eP4D4r3EedlOD2RNk=
 github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8=

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

maybe because of the go15, I don't have another explanation

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm still on 1.14, so that could be a reason. For me, it was complaining about a test dependency it couldn't find.

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

But it fails on your example bketelsen/crypt#6 (comment)

@sagikazarmark
Copy link
Collaborator Author

Looks like we will have to wait for etcd-io/etcd#12204 adding proper module support.

@SVilgelm
Copy link

SVilgelm commented Aug 20, 2020 •
edited
Loading

I'm able to build the golangci-lint using the commit from this PR and everything works. Here is the pull request withgo v1.13, v1.14 and v1.15 checks: golangci/golangci-lint#1323

@sagikazarmark sagikazarmark mentioned this pull request Aug 26, 2020
Closed
@AbsoLouie AbsoLouie mentioned this pull request Aug 26, 2020
Closed
@tomtau tomtau mentioned this pull request Sep 7, 2020
Closed
@alexkimin
Copy link

is there any update on this?

@sagikazarmark
Copy link
Collaborator Author

Chances are we'll wait for etcd-io/etcd#12498. Hopefully it'll be out before the end of the year.

@alexkimin
Copy link

@sagikazarmark thanks for the update! :)

timdrysdale added a commit to timdrysdale/xbar that referenced this pull request Dec 13, 2020
@timdrysdale
Exclude CVE from outdated etcd in CI
179e1ae 
Viper has a dependency on an old version of etcd that will be resolved
in due course, says spf13/viper#961
@sagikazarmark sagikazarmark mentioned this pull request Dec 17, 2020
Closed
@bhamail
Copy link
Contributor

bhamail commented Mar 29, 2021

Sorry to be so slow to check this. It works great in my environment:

$ go version
go version go1.16.2 darwin/amd64
$ go test ./...
go: downloading github.com/bketelsen/crypt v0.0.3
ok  	github.com/spf13/viper	0.181s
?   	github.com/spf13/viper/remote	[no test files]

I took so long to try it, another vuln has popped up. I'll address that in a new PR (with a PR to add a nancy scan to the CI build too).

@bhamail bhamail mentioned this pull request Mar 29, 2021
Open
@deefdragon deefdragon mentioned this pull request May 12, 2021
Open
@sagikazarmark sagikazarmark mentioned this pull request Jun 15, 2021
Merged
@sagikazarmark sagikazarmark deleted the upgrade-crypt-etcd branch November 21, 2021 14:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@SVilgelm SVilgelm SVilgelm left review comments

Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
4 participants
@sagikazarmark @SVilgelm @alexkimin @bhamail