Files
containerd/.github/workflows/nightly.yml
Sebastiaan van Stijn 734219a21a update to go1.21.5, go1.20.12
go1.21.5 (released 2023-12-05) includes security fixes to the go command,
and the net/http and path/filepath packages, as well as bug fixes to the
compiler, the go command, the runtime, and the crypto/rand, net, os, and
syscall packages. See the Go 1.21.5 milestone on our issue tracker for
details:

- https://github.com/golang/go/issues?q=milestone%3AGo1.21.5+label%3ACherryPickApproved
- full diff: https://github.com/golang/go/compare/go1.21.4...go1.21.5

from the security mailing:

[security] Go 1.21.5 and Go 1.20.12 are released

Hello gophers,

We have just released Go versions 1.21.5 and 1.20.12, minor point releases.

These minor releases include 3 security fixes following the security policy:

- net/http: limit chunked data overhead

  A malicious HTTP sender can use chunk extensions to cause a receiver
  reading from a request or response body to read many more bytes from
  the network than are in the body.

  A malicious HTTP client can further exploit this to cause a server to
  automatically read a large amount of data (up to about 1GiB) when a
  handler fails to read the entire body of a request.

  Chunk extensions are a little-used HTTP feature which permit including
  additional metadata in a request or response body sent using the chunked
  encoding. The net/http chunked encoding reader discards this metadata.
  A sender can exploit this by inserting a large metadata segment with
  each byte transferred. The chunk reader now produces an error if the
  ratio of real body to encoded bytes grows too small.

  Thanks to Bartek Nowotarski for reporting this issue.

  This is CVE-2023-39326 and Go issue https://go.dev/issue/64433.

- cmd/go: go get may unexpectedly fallback to insecure git

  Using go get to fetch a module with the ".git" suffix may unexpectedly
  fallback to the insecure "git://" protocol if the module is unavailable
  via the secure "https://" and "git+ssh://" protocols, even if GOINSECURE
  is not set for said module. This only affects users who are not using
  the module proxy and are fetching modules directly (i.e. GOPROXY=off).

  Thanks to David Leadbeater for reporting this issue.

  This is CVE-2023-45285 and Go issue https://go.dev/issue/63845.

- path/filepath: retain trailing \ when cleaning paths like \\?\c:\

  Go 1.20.11 and Go 1.21.4 inadvertently changed the definition of the
  volume name in Windows paths starting with \\?\, resulting in
  filepath.Clean(\\?\c:\) returning \\?\c: rather than \\?\c:\ (among
  other effects). The previous behavior has been restored.

  This is an update to CVE-2023-45283 and Go issue https://go.dev/issue/64028.

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2023-12-05 23:34:44 +01:00

172 lines
4.0 KiB
YAML

name: Nightly
on:
schedule:
- cron: "0 0 * * *" # Every day at midnight
pull_request:
paths:
- ".github/workflows/nightly.yml"
env:
GO_VERSION: "1.21.5"
permissions: # added using https://github.com/step-security/secure-workflows
contents: read
jobs:
linux:
name: Linux
runs-on: ubuntu-latest
timeout-minutes: 30
defaults:
run:
working-directory: src/github.com/containerd/containerd
steps:
- uses: actions/setup-go@v3
with:
go-version: ${{ env.GO_VERSION }}
- uses: actions/checkout@v3
with:
path: src/github.com/containerd/containerd
- name: Set env
shell: bash
run: |
echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
#
# Build
#
- name: Install dependencies
run: |
sudo apt-get update || true
sudo apt-get install -y \
crossbuild-essential-arm64 \
crossbuild-essential-s390x \
crossbuild-essential-ppc64el \
crossbuild-essential-riscv64 \
- name: Build amd64
env:
GOOS: linux
GOARCH: amd64
run: |
make binaries
mv bin bin_amd64
- name: Build arm64
env:
GOOS: linux
GOARCH: arm64
CC: aarch64-linux-gnu-gcc
CGO_ENABLED: 1
run: |
make binaries
mv bin bin_arm64
- name: Build s390x
env:
GOOS: linux
GOARCH: s390x
CGO_ENABLED: 1
CC: s390x-linux-gnu-gcc
run: |
make binaries
mv bin bin_s390x
- name: Build ppc64le
env:
GOOS: linux
GOARCH: ppc64le
CGO_ENABLED: 1
CC: powerpc64le-linux-gnu-gcc
run: |
make binaries
mv bin bin_ppc64le
- name: Build riscv64
env:
GOOS: linux
GOARCH: riscv64
CGO_ENABLED: 1
CC: riscv64-linux-gnu-gcc
run: |
make binaries
mv bin bin_riscv64
#
# Upload
#
- name: Upload artifacts (linux_amd64)
uses: actions/upload-artifact@v1
with:
name: linux_amd64
path: src/github.com/containerd/containerd/bin_amd64
- name: Upload artifacts (linux_arm64)
uses: actions/upload-artifact@v1
with:
name: linux_arm64
path: src/github.com/containerd/containerd/bin_arm64
- name: Upload artifacts (linux_s390x)
uses: actions/upload-artifact@v1
with:
name: linux_s390x
path: src/github.com/containerd/containerd/bin_s390x
- name: Upload artifacts (linux_ppc64le)
uses: actions/upload-artifact@v1
with:
name: linux_ppc64le
path: src/github.com/containerd/containerd/bin_ppc64le
- name: Upload artifacts (linux_riscv64)
uses: actions/upload-artifact@v1
with:
name: linux_riscv64
path: src/github.com/containerd/containerd/bin_riscv64
windows:
name: Windows
runs-on: windows-latest
timeout-minutes: 30
defaults:
run:
working-directory: src/github.com/containerd/containerd
steps:
- uses: actions/setup-go@v3
with:
go-version: ${{ env.GO_VERSION }}
- uses: actions/checkout@v3
with:
path: src/github.com/containerd/containerd
- name: Set env
shell: bash
run: |
echo "GOPATH=${{ github.workspace }}" >> $GITHUB_ENV
echo "${{ github.workspace }}/bin" >> $GITHUB_PATH
- name: Build amd64
env:
GOOS: windows
GOARCH: amd64
run: |
make binaries
- name: Upload artifacts (windows_amd64)
uses: actions/upload-artifact@v1
with:
name: windows_amd64
path: src/github.com/containerd/containerd/bin/