157dff2812
Includes a fix for CVE-2023-29409 go1.20.7 (released 2023-08-01) includes a security fix to the crypto/tls package, as well as bug fixes to the assembler and the compiler. See the Go 1.20.7 milestone on our issue tracker for details: - https://github.com/golang/go/issues?q=milestone%3AGo1.20.7+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.20.6...go1.20.7 go1.19.12 (released 2023-08-01) includes a security fix to the crypto/tls package, as well as bug fixes to the assembler and the compiler. See the Go 1.19.12 milestone on our issue tracker for details. - https://github.com/golang/go/issues?q=milestone%3AGo1.19.12+label%3ACherryPickApproved - full diff: https://github.com/golang/go/compare/go1.19.11...go1.19.12 From the mailing list announcement: [security] Go 1.20.7 and Go 1.19.12 are released Hello gophers, We have just released Go versions 1.20.7 and 1.19.12, minor point releases. These minor releases include 1 security fixes following the security policy: - crypto/tls: restrict RSA keys in certificates to <= 8192 bits Extremely large RSA keys in certificate chains can cause a client/server to expend significant CPU time verifying signatures. Limit this by restricting the size of RSA keys transmitted during handshakes to <= 8192 bits. Based on a survey of publicly trusted RSA keys, there are currently only three certificates in circulation with keys larger than this, and all three appear to be test certificates that are not actively deployed. It is possible there are larger keys in use in private PKIs, but we target the web PKI, so causing breakage here in the interests of increasing the default safety of users of crypto/tls seems reasonable. Thanks to Mateusz Poliwczak for reporting this issue. View the release notes for more information: https://go.dev/doc/devel/release#go1.20.7 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
354 lines
12 KiB
Ruby
354 lines
12 KiB
Ruby
# -*- mode: ruby -*-
|
|
# vi: set ft=ruby :
|
|
|
|
# Copyright The containerd Authors.
|
|
#
|
|
# Licensed under the Apache License, Version 2.0 (the "License");
|
|
# you may not use this file except in compliance with the License.
|
|
# You may obtain a copy of the License at
|
|
|
|
# http://www.apache.org/licenses/LICENSE-2.0
|
|
|
|
# Unless required by applicable law or agreed to in writing, software
|
|
# distributed under the License is distributed on an "AS IS" BASIS,
|
|
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
|
# See the License for the specific language governing permissions and
|
|
# limitations under the License.
|
|
|
|
# Vagrantfile for Fedora and EL
|
|
Vagrant.configure("2") do |config|
|
|
config.vm.box = ENV["BOX"] ? ENV["BOX"].split("@")[0] : "fedora/37-cloud-base"
|
|
# BOX_VERSION is deprecated. Use "BOX=<BOX>@<BOX_VERSION>".
|
|
config.vm.box_version = ENV["BOX_VERSION"] || (ENV["BOX"].split("@")[1] if ENV["BOX"])
|
|
|
|
memory = 4096
|
|
cpus = 2
|
|
disk_size = 60
|
|
config.vm.provider :virtualbox do |v, o|
|
|
v.memory = memory
|
|
v.cpus = cpus
|
|
# Needs env var VAGRANT_EXPERIMENTAL="disks"
|
|
o.vm.disk :disk, size: "#{disk_size}GB", primary: true
|
|
end
|
|
config.vm.provider :libvirt do |v|
|
|
v.memory = memory
|
|
v.cpus = cpus
|
|
v.machine_virtual_size = disk_size
|
|
end
|
|
|
|
config.vm.synced_folder ".", "/vagrant", type: "rsync"
|
|
|
|
config.vm.provision 'shell', path: 'script/resize-vagrant-root.sh'
|
|
|
|
# Disabled by default. To run:
|
|
# vagrant up --provision-with=upgrade-packages
|
|
# To upgrade only specific packages:
|
|
# UPGRADE_PACKAGES=selinux vagrant up --provision-with=upgrade-packages
|
|
#
|
|
config.vm.provision "upgrade-packages", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-upgrade-packages"
|
|
sh.env = {
|
|
'UPGRADE_PACKAGES': ENV['UPGRADE_PACKAGES'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
dnf -y upgrade ${UPGRADE_PACKAGES}
|
|
SHELL
|
|
end
|
|
|
|
# To re-run, installing CNI from RPM:
|
|
# INSTALL_PACKAGES="containernetworking-plugins" vagrant up --provision-with=install-packages
|
|
#
|
|
config.vm.provision "install-packages", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-packages"
|
|
sh.env = {
|
|
'INSTALL_PACKAGES': ENV['INSTALL_PACKAGES'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
dnf -y install \
|
|
container-selinux \
|
|
curl \
|
|
gcc \
|
|
git \
|
|
iptables \
|
|
libseccomp-devel \
|
|
libselinux-devel \
|
|
lsof \
|
|
make \
|
|
${INSTALL_PACKAGES}
|
|
SHELL
|
|
end
|
|
|
|
# EL does not have /usr/local/{bin,sbin} in the PATH by default
|
|
config.vm.provision "setup-etc-environment", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-setup-etc-environment"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
cat >> /etc/environment <<EOF
|
|
PATH=/usr/local/go/bin:/usr/local/bin:/usr/local/sbin:$PATH
|
|
EOF
|
|
source /etc/environment
|
|
SHELL
|
|
end
|
|
|
|
# To re-run this provisioner, installing a different version of go:
|
|
# GO_VERSION="1.14.6" vagrant up --provision-with=install-golang
|
|
#
|
|
config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-golang"
|
|
sh.env = {
|
|
'GO_VERSION': ENV['GO_VERSION'] || "1.20.7",
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
curl -fsSL "https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz" | tar Cxz /usr/local
|
|
cat >> /etc/profile.d/sh.local <<EOF
|
|
GOPATH=\\$HOME/go
|
|
PATH=\\$GOPATH/bin:\\$PATH
|
|
export GOPATH PATH
|
|
git config --global --add safe.directory /vagrant
|
|
EOF
|
|
source /etc/profile.d/sh.local
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "setup-gopath", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-setup-gopath"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
mkdir -p ${GOPATH}/src/github.com/containerd
|
|
ln -fnsv /vagrant ${GOPATH}/src/github.com/containerd/containerd
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-runc", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-runc"
|
|
sh.env = {
|
|
'RUNC_FLAVOR': ENV['RUNC_FLAVOR'] || "runc",
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-runc
|
|
type runc
|
|
runc --version
|
|
chcon -v -t container_runtime_exec_t $(type -ap runc)
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-cni", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-cni"
|
|
sh.env = {
|
|
'CNI_BINARIES': 'bridge dhcp flannel host-device host-local ipvlan loopback macvlan portmap ptp tuning vlan',
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
cd ${GOPATH}/src/github.com/containerd/containerd
|
|
script/setup/install-cni
|
|
PATH=/opt/cni/bin:$PATH type ${CNI_BINARIES} || true
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-cri-tools", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-cri-tools"
|
|
sh.env = {
|
|
'CRI_TOOLS_VERSION': ENV['CRI_TOOLS_VERSION'] || '16911795a3c33833fa0ec83dac1ade3172f6989e',
|
|
'GOBIN': '/usr/local/bin',
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-critools
|
|
type crictl critest
|
|
critest --version
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-containerd", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-containerd"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
cd ${GOPATH}/src/github.com/containerd/containerd
|
|
make BUILDTAGS="seccomp selinux no_btrfs no_devmapper no_zfs" binaries install
|
|
type containerd
|
|
containerd --version
|
|
chcon -v -t container_runtime_exec_t /usr/local/bin/{containerd,containerd-shim*}
|
|
./script/setup/config-containerd
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-gotestsum", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-gotestsum"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-gotestsum
|
|
sudo cp ${GOPATH}/bin/gotestsum /usr/local/bin/
|
|
SHELL
|
|
end
|
|
|
|
config.vm.provision "install-failpoint-binaries", type: "shell", run: "once" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-failpoint-binaries"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
${GOPATH}/src/github.com/containerd/containerd/script/setup/install-failpoint-binaries
|
|
chcon -v -t container_runtime_exec_t $(type -ap containerd-shim-runc-fp-v1)
|
|
containerd-shim-runc-fp-v1 -v
|
|
SHELL
|
|
end
|
|
|
|
# SELinux is Enforcing by default.
|
|
# To set SELinux as Disabled on a VM that has already been provisioned:
|
|
# SELINUX=Disabled vagrant up --provision-with=selinux
|
|
# To set SELinux as Permissive on a VM that has already been provsioned
|
|
# SELINUX=Permissive vagrant up --provision-with=selinux
|
|
config.vm.provision "selinux", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-selinux"
|
|
sh.env = {
|
|
'SELINUX': ENV['SELINUX'] || "Enforcing"
|
|
}
|
|
sh.inline = <<~SHELL
|
|
/vagrant/script/setup/config-selinux
|
|
/vagrant/script/setup/config-containerd
|
|
SHELL
|
|
end
|
|
|
|
# SELinux is Enforcing by default (via provisioning) in this VM. To re-run with SELinux disabled:
|
|
# SELINUX=Disabled vagrant up --provision-with=selinux,test-integration
|
|
#
|
|
config.vm.provision "test-integration", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/test-integration"
|
|
sh.env = {
|
|
'RUNC_FLAVOR': ENV['RUNC_FLAVOR'] || "runc",
|
|
'GOTEST': ENV['GOTEST'] || "go test",
|
|
'GOTESTSUM_JUNITFILE': ENV['GOTESTSUM_JUNITFILE'],
|
|
'GOTESTSUM_JSONFILE': ENV['GOTESTSUM_JSONFILE'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
rm -rf /var/lib/containerd-test /run/containerd-test
|
|
cd ${GOPATH}/src/github.com/containerd/containerd
|
|
go test -v -count=1 -race ./metrics/cgroups
|
|
make integration EXTRA_TESTFLAGS="-timeout 15m -no-criu -test.v" TEST_RUNTIME=io.containerd.runc.v2 RUNC_FLAVOR=$RUNC_FLAVOR
|
|
SHELL
|
|
end
|
|
|
|
# SELinux is Enforcing by default (via provisioning) in this VM. To re-run with SELinux disabled:
|
|
# SELINUX=Disabled vagrant up --provision-with=selinux,test-cri-integration
|
|
#
|
|
config.vm.provision "test-cri-integration", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/test-cri-integration"
|
|
sh.env = {
|
|
'GOTEST': ENV['GOTEST'] || "go test",
|
|
'GOTESTSUM_JUNITFILE': ENV['GOTESTSUM_JUNITFILE'],
|
|
'GOTESTSUM_JSONFILE': ENV['GOTESTSUM_JSONFILE'],
|
|
'GITHUB_WORKSPACE': '',
|
|
'ENABLE_CRI_SANDBOXES': ENV['ENABLE_CRI_SANDBOXES'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
cleanup() {
|
|
rm -rf /var/lib/containerd* /run/containerd* /tmp/containerd* /tmp/test* /tmp/failpoint* /tmp/nri*
|
|
}
|
|
cleanup
|
|
cd ${GOPATH}/src/github.com/containerd/containerd
|
|
# cri-integration.sh executes containerd from ./bin, not from $PATH .
|
|
make BUILDTAGS="seccomp selinux no_btrfs no_devmapper no_zfs" binaries bin/cri-integration.test
|
|
chcon -v -t container_runtime_exec_t ./bin/{containerd,containerd-shim*}
|
|
CONTAINERD_RUNTIME=io.containerd.runc.v2 ./script/test/cri-integration.sh
|
|
cleanup
|
|
SHELL
|
|
end
|
|
|
|
# SELinux is Enforcing by default (via provisioning) in this VM. To re-run with SELinux disabled:
|
|
# SELINUX=Disabled vagrant up --provision-with=selinux,test-cri
|
|
#
|
|
config.vm.provision "test-cri", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/test-cri"
|
|
sh.env = {
|
|
'GOTEST': ENV['GOTEST'] || "go test",
|
|
'REPORT_DIR': ENV['REPORT_DIR'],
|
|
}
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
source /etc/environment
|
|
source /etc/profile.d/sh.local
|
|
set -eux -o pipefail
|
|
systemctl disable --now containerd || true
|
|
rm -rf /var/lib/containerd /run/containerd
|
|
function cleanup()
|
|
{
|
|
journalctl -u containerd > /tmp/containerd.log
|
|
cat /tmp/containerd.log
|
|
systemctl stop containerd
|
|
}
|
|
selinux=$(getenforce)
|
|
if [[ $selinux == Enforcing ]]; then
|
|
setenforce 0
|
|
fi
|
|
systemctl enable --now ${GOPATH}/src/github.com/containerd/containerd/containerd.service
|
|
if [[ $selinux == Enforcing ]]; then
|
|
setenforce 1
|
|
fi
|
|
trap cleanup EXIT
|
|
ctr version
|
|
critest --parallel=$[$(nproc)+2] --ginkgo.skip='HostIpc is true' --report-dir="${REPORT_DIR}"
|
|
SHELL
|
|
end
|
|
|
|
# Rootless Podman is used for testing CRI-in-UserNS
|
|
# (We could use rootless nerdctl, but we are using Podman here because it is available in dnf)
|
|
config.vm.provision "install-rootless-podman", type: "shell", run: "never" do |sh|
|
|
sh.upload_path = "/tmp/vagrant-install-rootless-podman"
|
|
sh.inline = <<~SHELL
|
|
#!/usr/bin/env bash
|
|
set -eux -o pipefail
|
|
# Delegate cgroup v2 controllers to rootless
|
|
mkdir -p /etc/systemd/system/user@.service.d
|
|
cat > /etc/systemd/system/user@.service.d/delegate.conf << EOF
|
|
[Service]
|
|
Delegate=yes
|
|
EOF
|
|
systemctl daemon-reload
|
|
# Install Podman
|
|
dnf install -y podman
|
|
# Configure Podman to resolve `golang` to `docker.io/library/golang`
|
|
mkdir -p /etc/containers
|
|
cat > /etc/containers/registries.conf <<EOF
|
|
[registries.search]
|
|
registries = ['docker.io']
|
|
EOF
|
|
SHELL
|
|
end
|
|
|
|
end
|