Hello gophers,
Version v0.3.3 of golang.org/x/text fixes a vulnerability in the golang.org/x/text/encoding/unicode package which could lead to the UTF-16 decoder entering an infinite loop, causing the program to crash or run out of memory.
An attacker could provide a single byte to a UTF16 decoder instantiated with UseBOM or ExpectBOM to trigger an infinite loop if the String function on the Decoder is called, or the Decoder is passed to golang.org/x/text/transform.String.
transform.String has also been hardened not to enter an infinite loop if a Transformer keeps returning ErrShortSrc even if atEOF is true.
This issue was first filed as Issue 39491 by GitHub user abacabadabacaba and reported to the security team by Anton Gyllenberg. It is tracked as CVE-2020-14040.
Cheers,
Katie for the Go team
* Creates staging directory for common controller-manager code
* Adds the following initial files to this directory:
* .github/PULL_REQUEST_TEMPLATE.md
* code-of-conduct.md
* LICENSE
* OWNERS
* README.md
* SECURITY_CONTACTS
* Code committed to the controller-manager staging directory will be published to: https://github.com/kubernetes/controller-manager
Initial approval deads2k (sig-api-machinery chair)
The config we would expect any controller manager to need to connect to the API server, set up metrics endpoints, create per-controller-loop API clients, and spin up the individual loops could make sense under a k8s.io/controller-manager package.
Then cmd/kube-controller-manager could continue to contain the weirdnesses specific to kube-controller-manager.
This is similar to the way we split out recommended API server setup into k8s.io/apiserver and tried to limit kube-apiserver oddities to cmd/kube-apiserver and pkg/kubeapiserver
Removed extraneous release reference. Ran update-vendor.
Fixed Readme.
Added a doc.go to staging/controller-manager
Fix package to not have dash.
```
NONE
```
/kind cleanup
/sig api-machinery
/area kube-controller-manager
/area cloud-controller-manager
- use bash-static and avoid dragging in all of debian-base
- use distroless as the base image
- the shell script needs a `cp` utility, add a go based one for just
files (no support for directories!)
- Rework the calls to `mv` and recursive `cp` in the code
- we don't need to support windows in this container image
- the test case was slightly off as it was assuming that the old
directory was copied into the new directory, but the desired
functionality is that all files in the old directory should be in the
new directory.
Signed-off-by: Davanum Srinivas <davanum@gmail.com>
pin dependency github.com/beorn7/perks from v1.0.0 to v1.0.1
pin dependency github.com/golang/protobuf from v1.3.3 to v1.4.2
pin denpendency github.com/json-iterator/go from v1.1.8 to v1.1.9
pin dependency github.com/prometheus/common from v0.4.1 to v0.9.1
pin dependency github.com/prometheus/procfs from v0.0.5 to v0.0.11
pin dependency github.com/alecthomas/template from v0.0.0-20160405071501-a0175ee3bccc to v0.0.0-20190718012654-fb15b899a751
pin dependency github.com/alecthomas/units from v0.0.0-20151022065526-2efee857e7cf to v0.0.0-20190717042225-c3de453c63f4
pin dependency github.com/go-kit/kit from v0.8.0 to v0.9.0
pin dependency github.com/go-logfmt/logfmt from v0.3.0 to v0.4.0
Co-Authored-By: Jordan Liggitt <jordan@liggitt.net>
