6356e55be0
Golang 1.12.12 ------------------------------- go1.12.12 (released 2019/10/17) includes fixes to the go command, runtime, syscall and net packages. See the Go 1.12.12 milestone on our issue tracker for details. https://github.com/golang/go/issues?q=milestone%3AGo1.12.12 Golang 1.12.11 (CVE-2019-17596) ------------------------------- go1.12.11 (released 2019/10/17) includes security fixes to the crypto/dsa package. See the Go 1.12.11 milestone on our issue tracker for details. https://github.com/golang/go/issues?q=milestone%3AGo1.12.11 [security] Go 1.13.2 and Go 1.12.11 are released Hi gophers, We have just released Go 1.13.2 and Go 1.12.11 to address a recently reported security issue. We recommend that all affected users update to one of these releases (if you're not sure which, choose Go 1.13.2). Invalid DSA public keys can cause a panic in dsa.Verify. In particular, using crypto/x509.Verify on a crafted X.509 certificate chain can lead to a panic, even if the certificates don't chain to a trusted root. The chain can be delivered via a crypto/tls connection to a client, or to a server that accepts and verifies client certificates. net/http clients can be made to crash by an HTTPS server, while net/http servers that accept client certificates will recover the panic and are unaffected. Moreover, an application might crash invoking crypto/x509.(*CertificateRequest).CheckSignature on an X.509 certificate request, parsing a golang.org/x/crypto/openpgp Entity, or during a golang.org/x/crypto/otr conversation. Finally, a golang.org/x/crypto/ssh client can panic due to a malformed host key, while a server could panic if either PublicKeyCallback accepts a malformed public key, or if IsUserAuthority accepts a certificate with a malformed public key. The issue is CVE-2019-17596 and Go issue golang.org/issue/34960. Thanks to Daniel Mandragona for discovering and reporting this issue. We'd also like to thank regilero for a previous disclosure of CVE-2019-16276. The Go 1.13.2 release also includes a fix to the compiler that prevents improper access to negative slice indexes in rare cases. Affected code, in which the compiler can prove that the index is zero or negative, would have resulted in a panic in Go 1.12, but could have led to arbitrary memory read and writes in Go 1.13 and Go 1.13.1. This is Go issue golang.org/issue/34802. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
63 lines
2.5 KiB
YAML
63 lines
2.5 KiB
YAML
version: "{build}"
|
|
|
|
image: Visual Studio 2017
|
|
|
|
clone_folder: c:\gopath\src\github.com\containerd\containerd
|
|
|
|
branches:
|
|
only:
|
|
- master
|
|
|
|
environment:
|
|
GOPATH: C:\gopath
|
|
CGO_ENABLED: 1
|
|
matrix:
|
|
- GO_VERSION: 1.12.12
|
|
|
|
before_build:
|
|
- choco install -y mingw --version 5.3.0
|
|
# Install Go
|
|
- rd C:\Go /s /q
|
|
- appveyor DownloadFile https://storage.googleapis.com/golang/go%GO_VERSION%.windows-amd64.zip
|
|
- 7z x go%GO_VERSION%.windows-amd64.zip -oC:\ >nul
|
|
- go version
|
|
- choco install codecov
|
|
# Clone hcsshim at the vendored version
|
|
- bash.exe -elc "export PATH=/c/tools/mingw64/bin:$PATH;
|
|
rm -rf /c/gopath/src/github.com/Microsoft/hcsshim;
|
|
git clone -q https://github.com/Microsoft/hcsshim.git /c/gopath/src/github.com/Microsoft/hcsshim;
|
|
export HCSSHIM_VERSION=`grep Microsoft/hcsshim vendor.conf | awk '{print $2}'`;
|
|
echo Using Microsoft/hcsshim $HCSSHIM_VERSION;
|
|
pushd /c/gopath/src/github.com/Microsoft/hcsshim;
|
|
git checkout $HCSSHIM_VERSION;
|
|
popd"
|
|
# Print host version. TODO: Remove this when containerd has a way to get host version
|
|
- ps: $psversiontable
|
|
|
|
build_script:
|
|
# Build containerd-shim-runhcs-v1.exe and runhcs.exe from Microsoft/hcsshim
|
|
- bash.exe -elc "export PATH=/c/tools/mingw64/bin:$PATH;
|
|
export GOBIN=/c/gopath/src/github.com/Microsoft/hcsshim/bin;
|
|
mkdir $GOBIN;
|
|
pushd /c/gopath/src/github.com/Microsoft/hcsshim/cmd/containerd-shim-runhcs-v1;
|
|
go install;
|
|
cd ../runhcs;
|
|
go install;
|
|
ls -al $GOBIN;
|
|
popd"
|
|
- bash.exe -elc "export PATH=/c/tools/mingw64/bin:/c/gopath/bin:$PATH;
|
|
script/setup/install-dev-tools;
|
|
mingw32-make.exe check"
|
|
- bash.exe -elc "export PATH=/c/tools/mingw64/bin:$PATH ; mingw32-make.exe build binaries"
|
|
|
|
test_script:
|
|
# TODO: need an equivalent of TRAVIS_COMMIT_RANGE
|
|
# - GIT_CHECK_EXCLUDE="./vendor" TRAVIS_COMMIT_RANGE="${TRAVIS_COMMIT_RANGE/.../..}" C:\MinGW\bin\mingw32-make.exe dco
|
|
- bash.exe -lc "export PATH=/c/tools/mingw64/bin:/c/gopath/src/github.com/containerd/containerd/bin:$PATH ; mingw32-make.exe coverage root-coverage"
|
|
# - bash.exe -elc "export PATH=/c/tools/mingw64/bin:/c/gopath/src/github.com/containerd/containerd/bin:$PATH ; mingw32-make.exe integration"
|
|
# Run the integration suite a second time. See discussion in github.com/containerd/containerd/pull/1759
|
|
# - bash.exe -elc "export PATH=/c/tools/mingw64/bin:/c/gopath/src/github.com/containerd/containerd/bin:$PATH; TESTFLAGS_PARALLEL=1 mingw32-make.exe integration"
|
|
|
|
on_success:
|
|
codecov --flag windows -f coverage.txt
|