[20.03] go: 1.13.12 -> 1.13.15, 1.14.4 -> 1.14.8 #97566

amaxine · 2020-09-09T16:49:43Z

Motivation for this change

Addresses CVE-2020-16845, CVE-2020-15586, CVE-2020-14039
Fixes #93982, #96789, #94006

I didn't rebuild everything for lack of spare compute right now, is that necessary for review?

Things done

endocrimes · 2020-09-09T18:24:45Z

Result of nixpkgs-review pr 97566 1

23 packages failed to build:

act
dcrd
dcrwallet
deepin.dbus-factory
deepin.dde-api
deepin.dde-control-center
deepin.dde-daemon
deepin.dde-dock
deepin.dde-file-manager
deepin.dde-kwin
deepin.dde-launcher
deepin.dde-session-ui
deepin.deepin-desktop-base
deepin.deepin-desktop-schemas
deepin.deepin-wallpapers
deepin.go-dbus-generator
deepin.startdde
gopherclient
meguca
packetbeat
python38Packages.aria2p
storebrowse
wal-g

719 packages built:

aerc
age
alertmanager-bot
amass
amazon-ecr-credential-helper
aminal
antibody
aptly
archiver
argo
asmfmt
assh
atlantis
autospotting
awless
aws-env
aws-iam-authenticator
aws-okta
aws-rotate-key
aws-vault
awsweeper
azure-storage-azcopy
azure-vhd-utils
bazel-buildtools
bazel-remote
bazelisk
berglas
bettercap
blockbook
blsd
boohu
boringssl
bosun (scollector)
boulder
brig
brillo
brook
browserpass
browsh
btops
buildah
buildkit
buildkite-agent
buildpack
c14
caddy
caddy2
cadvisor
captive-browser
cassowary
cayley
certigo
certmgr
certmgr-selfsigned
certstrap
cfssl
cheat
chezmoi
clair
clash
claws
cli53
clipman
cloud-nuke
cloud-print-connector
cloud-sql-proxy
cloudflared
cloudfoundry-cli
cni
cni-plugins
cockroachdb
codesearch
cointop
compile-daemon
confd
conftest
consul
consul-alerts
consul-template
container-linux-config-transpiler
containerd
convoy
coredns
corerad
corgi
coyim
cri-o
cri-tools
croc
crun
ctop
cue
curl_unix_socket
dapper
dashing
datadog-agent
datadog-process-agent
dbmate
deadcode
deepin.go-gir-generator
deis
deisctl
delve
demoit
dep
dep2nix
desync
devd
dex-oidc
dgraph
direnv
diskrsync
distrobuilder
dive
dnscrypt-proxy2
dnsproxy
do-agent
docker
docker-credential-gcr
docker-credential-helpers
docker-distribution
docker-gc
docker-ls
docker-machine
docker-machine-kvm
docker-machine-kvm2
docker-proxy
docker-slim
docker_18_09
doctl
docui
documize-community
dolt
drive
drone
drone-cli
duplicacy
easyjson
echoip
ecs-agent
editorconfig-checker
ejson
eksctl
elfinfo
elvish
envconsul
envdir
envsubst
errcheck
etcd (etcdctl)
evmdis
exercism
fac
filebeat
filebeat7
filegive
firectl
flannel
fluxctl
fly
frp
fscrypt-experimental
fsql
fzf
fzf-zsh
gauge
gawp
gcsfuse
gdrive
geoipupdate
gh-ost
ghq
git-lfs
git-lfs1
git-sizer
git-town
gitAndTools.gh
gitAndTools.git-annex-remote-b2
gitAndTools.git-annex-remote-rclone
gitAndTools.git-appraise
gitAndTools.git-bug
gitAndTools.git-subtrac
gitAndTools.grv
gitAndTools.hub
gitAndTools.lab
gitAndTools.lefthook
gitaly
gitea
github-commenter
gitlab-runner
gitlab-shell
gitlab-workhorse
glide
gllvm
glock
glow
gnatsd (nats-server)
go
go-2fa
go-bindata
go-bindata-assetfs
go-check
go-dependency-manager
go-ethereum
go-jira
go-jsonnet
go-junit-report
go-langserver
go-md2man
go-motion
go-mtpfs
go-outline
go-protobuf
pup (go-pup)
go-repo-root
go-sct
go-shadowsocks2
go-symbols
go-tools
go-upower-notify
go2nix
go_1_13
goa
gobuster
gocode
gocode-gomod
goconst
goconvey
gocryptfs
gocyclo
godef
gofumpt
gogetdoc
gogs
gohai
gotools (goimports)
goklp
golangci-lint
golint
gometalinter
gomodifytags
gomuks
gopass
gopkgs
goreman
gortr
gosec
gosu
gotags
gotests
gotify-cli
gotify-server
gotop
gotty
govc
govendor
govers
gox
grafana
grafana-loki
grafana_reporter
grobi
gron
grpcurl
gsctl
guardian-agent
gucci
gvisor
gvisor-containerd-shim
gx
gx-go
harmonist
hasmail
hcloud
heapster
heartbeat
heartbeat7
hecate
helmfile
heptio-ark
hetzner-kube
hivemind
holochain-go
hologram
hound
httplab
hugo
hydron
hydroxide
hyperledger-fabric
i3cat
iamy
ical2org
iferr
impl
ineffassign
influxdb
interfacer
interlock
ipfs-cluster
ipfs-migrator
ipget
jd
jid
jmespath
joker
journalbeat
journalbeat7
jp
json2hcl
jump
jx
k6
k9s
kail
kapacitor
kbfs
kcli
kexpand
keybase (keybase-go)
keycard-cli
kind
kompose
kontemplate
kops
kops_1_12
kops_1_13
kops_1_14
kt
kube-aws
kube-prompt
kube-router
kube3d
kubecfg
kubectl
kubectx
kubeless
kubeprompt
kubernetes
kubernetes-helm
kubeseal
kubeval
kubicorn
kustomize
lazydocker
lazygit
leaps
lego
lf
librarian-puppet-go
linkerd
linuxkit
livepeer
localtime
loccount
lxd
madonctl
mage
magnetico
mailhog
maligned
manul
marathonctl
massren
matterbridge
matterircd
mattermost
mautrix-whatsapp
meme
mesos-dns
metricbeat
metricbeat7
micro
miniflux
minify
minikube
minio
minio-client
minishift
mirrorbits
mkcert
mm
mmake
mmark
mod
modd
mongodb-tools
mop
morph
morty
mpd-mpris
mqtt-bench
mtail
mustache-go
mutagen
mynewt-newt
nats-streaming-server
nebula
neo-cowsay
nfpm
nginx-sso
ngrok-1
nix-build-uncached
nix-prefetch-docker
nix-store-gcs-proxy
nixops-dns
node-problem-detector
nomad
notary
noti
nsq
nvidia-docker
oauth2_proxy
obfs4
oci-image-tool
oh
open-policy-agent
openshift
out-of-tree
overmind
pachyderm
packer
packet
packetbeat7
pcstat
pdfcpu
pebble
peco
perkeep
pet
pg_flame
pgcenter
pgmetrics
phraseapp-client
pigeon
pipework
platinum-searcher
podman
podman-compose
poetry
pond
powerline-go
pprof
prom2json
prometheus
prometheus-alertmanager
prometheus-apcupsd-exporter
prometheus-aws-s3-exporter
prometheus-bind-exporter
prometheus-blackbox-exporter
prometheus-collectd-exporter
prometheus-consul-exporter
prometheus-dnsmasq-exporter
prometheus-dovecot-exporter
prometheus-fritzbox-exporter
prometheus-gitlab-ci-pipelines-exporter
prometheus-haproxy-exporter
prometheus-json-exporter
prometheus-mail-exporter
prometheus-mesos-exporter
prometheus-minio-exporter
prometheus-mysqld-exporter
prometheus-nextcloud-exporter
prometheus-nginx-exporter
prometheus-nginxlog-exporter
prometheus-node-exporter
prometheus-openvpn-exporter
prometheus-postfix-exporter
prometheus-postgres-exporter
prometheus-process-exporter
prometheus-pushgateway
prometheus-rabbitmq-exporter
prometheus-snmp-exporter
prometheus-statsd-exporter
prometheus-surfboard-exporter
prometheus-unifi-exporter
proto-contrib
protoc-gen-doc
protolock
prototool
python27Packages.syncthing-gtk (python37Packages.syncthing-gtk)
python37Packages.aria2p
python37Packages.jupyter-repo2docker
python38Packages.jupyter-repo2docker
qbec
qr-filetransfer
qsyncthingtray
quicktemplate
rclone
reflex
reftools
renderizer
restic
restic-rest-server
reviewdog
richgo
rootlesskit
run
runc
s3gof3r
saml2aws
sampler
scaleway-cli
scc
sensu-go-agent
sensu-go-backend
sensu-go-cli
serfdom
shadowfox
shfmt
shiori
sift
simplehttp2server
singularity
skaffold
skopeo
skydns
slack-term
sonobuoy
sops
sourcehut.buildsrht
sourcehut.gitsrht
sourcehut.hgsrht
ssm-agent
statik
step-ca
step-cli
stern
styx
subfinder
syncthing
syncthing-cli
syncthing-discovery
syncthing-relay
syncthing-tray
systemd-journal2gelf
systrayhelper
tailscale
tegola
teleconsole
telegraf
teleport
terminal-parrot
termshark
terracognita
terraform
terraform-docs
terraform-full
terraform-inventory
terraform-provider-ibm (terraform-providers.ibm)
terraform-provider-libvirt (terraform-providers.libvirt)
terraform-provider-nixos (terraform-providers.nixos)
terraform-providers.acme
terraform-providers.alicloud
terraform-providers.ansible
terraform-providers.archive
terraform-providers.arukas
terraform-providers.atlas
terraform-providers.aws
terraform-providers.azuread
terraform-providers.azurerm
terraform-providers.azurestack
terraform-providers.bigip
terraform-providers.bitbucket
terraform-providers.brightbox
terraform-providers.chef
terraform-providers.circonus
terraform-providers.clc
terraform-providers.cloudflare
terraform-providers.cloudscale
terraform-providers.cloudstack
terraform-providers.cobbler
terraform-providers.consul
terraform-providers.datadog
terraform-providers.digitalocean
terraform-providers.dme
terraform-providers.dns
terraform-providers.dnsimple
terraform-providers.docker
terraform-providers.dyn
terraform-providers.external
terraform-providers.fastly
terraform-providers.flexibleengine
terraform-providers.gandi
terraform-providers.github
terraform-providers.gitlab
terraform-providers.google
terraform-providers.google-beta
terraform-providers.grafana
terraform-providers.hcloud
terraform-providers.hedvig
terraform-providers.helm
terraform-providers.heroku
terraform-providers.http
terraform-providers.huaweicloud
terraform-providers.icinga2
terraform-providers.ignition
terraform-providers.influxdb
terraform-providers.kubernetes
terraform-providers.librato
terraform-providers.linode
terraform-providers.local
terraform-providers.logentries
terraform-providers.logicmonitor
terraform-providers.mailgun
terraform-providers.matchbox
terraform-providers.mysql
terraform-providers.netlify
terraform-providers.newrelic
terraform-providers.nomad
terraform-providers.ns1
terraform-providers.nsxt
terraform-providers.null
terraform-providers.nutanix
terraform-providers.oci
terraform-providers.oneandone
terraform-providers.opc
terraform-providers.openstack
terraform-providers.opentelekomcloud
terraform-providers.opsgenie
terraform-providers.oraclepaas
terraform-providers.ovh
terraform-providers.packet
terraform-providers.pagerduty
terraform-providers.panos
terraform-providers.pass
terraform-providers.postgresql
terraform-providers.powerdns
terraform-providers.profitbricks
terraform-providers.rabbitmq
terraform-providers.rancher
terraform-providers.random
terraform-providers.rightscale
terraform-providers.rundeck
terraform-providers.runscope
terraform-providers.scaleway
terraform-providers.secret
terraform-providers.segment
terraform-providers.selectel
terraform-providers.skytap
terraform-providers.softlayer
terraform-providers.spotinst
terraform-providers.statuscake
terraform-providers.telefonicaopencloud
terraform-providers.template
terraform-providers.tencentcloud
terraform-providers.terraform
terraform-providers.tfe
terraform-providers.tls
terraform-providers.triton
terraform-providers.ucloud
terraform-providers.ultradns
terraform-providers.vault
terraform-providers.vcd
terraform-providers.vsphere
terraform-providers.wavefront
terraform-providers.yandex
terraform_0_11
terraform_0_11-full
terraform_plugins_test
terragrunt
tewisay
textql
tflint
tfsec
thanos
tilt
timescaledb-parallel-copy
timescaledb-tune
tinygo
tmsu
todoist
todolist
toxiproxy
traefik
trezord
trickster
tychus
ua
uchiwa
udocker
umoci
unconvert
up
v2ray
vale
vault
vegeta
verifpal
vgo2nix
victoriametrics
vimPlugins.YouCompleteMe (vimPlugins.youcompleteme)
vimPlugins.coc-go
vimPlugins.direnv-vim
vimPlugins.vim-go
vndr
vultr
wallutils
wally-cli
webhook
websocketd
wego
wireguard-go
ws
wtf
wuzz
xmloscopy
xmonad-log
xmpp-client
xurls
yaml2json
ycmd
yeetgif
yggdrasil
yj
yq-go
zabbixctl
zfsbackup
zsh-history

endocrimes · 2020-09-09T18:32:05Z

Result of nixpkgs-review pr --no-shell --post-result 97566 --package act -p dcrd -p dcrwallet -p gopherclient -p meguca -p packetbeat -p python38Packages.aria2p -p storebrowse -p wal-g 1

9 packages failed to build:

act
dcrd
dcrwallet
gopherclient
meguca
packetbeat
python38Packages.aria2p
storebrowse
wal-g

endocrimes · 2020-09-09T18:40:48Z

Ok looks like there are a few breakages that I'm not sure of the right way to handle (or if they're broken without this change). I don't have time to triage further right now, but looks like it's mostly package dependency issues (broken vendoring, a QT incompatiblity)

output.log

endocrimes · 2020-09-09T19:33:17Z

@GrahamcOfBorg eval

zowoq

Please follow CONTRIBUTING.md#backporting-changes and use git cherry-pick -x for the version bumps rather than new commits.

zowoq · 2020-09-10T08:23:10Z

The commits shouldn't be squashed.

For go 1.14 cherry pick:
1.14.4 -> 1.14.5 af1b0c9
1.14.5 -> 1.14.6 4c99c55
1.14.6 -> 1.14.7 792f562
1.14.7 -> 1.14.8 eef5656

For go 1.13:
1.13.12 -> 1.13.13 ea3d6dd
1.13.13 -> 1.13.14 9cbf74b
1.13.14 -> 1.13.15 1a83aa1

See #90217 as an example.

(cherry picked from commit af1b0c9)

(cherry picked from commit 4c99c55)

(cherry picked from commit ea3d6dd)

(cherry picked from commit 9cbf74b)

(cherry picked from commit 1a83aa1)

(cherry picked from commit 792f562)

(cherry picked from commit eef5656)

zowoq · 2020-09-10T09:02:07Z

I removed the fixes ... #96836 from the top post as it is for traefik and not go.

ofborg bot added the 6.topic: golang label Sep 9, 2020

ofborg bot requested review from kalbasit, Frostman, Mic92, cstrahan and velovix September 9, 2020 17:54

ofborg bot added 10.rebuild-darwin: 501+ 10.rebuild-darwin: 501-1000 10.rebuild-linux: 501+ 10.rebuild-linux: 501-1000 labels Sep 9, 2020

amaxine changed the base branch from release-20.03 to staging-20.03 September 9, 2020 18:53

zowoq requested changes Sep 9, 2020

View reviewed changes

zowoq added 7 commits September 10, 2020 10:44

go: 1.14.4 -> 1.14.5

72614e1

(cherry picked from commit af1b0c9)

go: 1.14.5 -> 1.14.6

7817ddd

(cherry picked from commit 4c99c55)

go_1_13: 1.13.12 -> 1.13.13

3b601bb

(cherry picked from commit ea3d6dd)

go_1_13: 1.13.13 -> 1.13.14

b2cb465

(cherry picked from commit 9cbf74b)

go_1_13: 1.13.14 -> 1.13.15

fa7a3c1

(cherry picked from commit 1a83aa1)

go: 1.14.6 -> 1.14.7

0b8db6f

(cherry picked from commit 792f562)

go_1_14: 1.14.7 -> 1.14.8

d3f3208

(cherry picked from commit eef5656)

zowoq changed the title ~~[20.03] go: 1.13.12 -> 1.13.15, 1.4.4 -> 1.4.8~~ [20.03] go: 1.13.12 -> 1.13.15, 1.14.4 -> 1.14.8 Sep 10, 2020

zowoq merged commit 95ab853 into NixOS:staging-20.03 Sep 10, 2020

This was referenced Sep 10, 2020

Vulnerability roundup 90: go-1.14.4: 2 advisories [5.9] #93982

Closed

Vulnerability roundup 92: go-1.14.4: 1 advisory [7.5] #96789

Closed

Vulnerability roundup 90: go-1.13.12: 2 advisories [5.9] #94006

Closed

amaxine deleted the 20.03_go_cves branch September 10, 2020 09:17

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[20.03] go: 1.13.12 -> 1.13.15, 1.14.4 -> 1.14.8 #97566

[20.03] go: 1.13.12 -> 1.13.15, 1.14.4 -> 1.14.8 #97566

amaxine commented Sep 9, 2020 •

edited by zowoq

endocrimes commented Sep 9, 2020

endocrimes commented Sep 9, 2020 •

edited

endocrimes commented Sep 9, 2020

endocrimes commented Sep 9, 2020

zowoq left a comment

zowoq commented Sep 10, 2020 •

edited

zowoq commented Sep 10, 2020

[20.03] go: 1.13.12 -> 1.13.15, 1.14.4 -> 1.14.8 #97566

[20.03] go: 1.13.12 -> 1.13.15, 1.14.4 -> 1.14.8 #97566

Conversation

amaxine commented Sep 9, 2020 • edited by zowoq

Motivation for this change

Things done

endocrimes commented Sep 9, 2020

endocrimes commented Sep 9, 2020 • edited

endocrimes commented Sep 9, 2020

endocrimes commented Sep 9, 2020

zowoq left a comment

Choose a reason for hiding this comment

zowoq commented Sep 10, 2020 • edited

zowoq commented Sep 10, 2020

amaxine commented Sep 9, 2020 •

edited by zowoq

endocrimes commented Sep 9, 2020 •

edited

zowoq commented Sep 10, 2020 •

edited