go_1_10: 1.10 -> 1.10.1, g_1_9: 1.9.4 -> 1.9.5 #38233
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This updates go to the latest version of the golang 1.10 branch. A few minor (but important) things are fixed in this version: * CVE-2018-7187 - arbitrary code execution in `go get` (when used with --insecure) [1] * Extended Key Usage verification in client certificate scenarios [3] * a bunch of stability changes The full list of changes can se been on GitHub [2] & [4]. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7187 [2] https://github.com/golang/go/issues?q=milestone%3AGo1.10.1 [3] golang/go#23884 [4] golang/go#24563
|
Success on x86_64-linux (full log) Attempted: go_1_10 Partial log (click to expand)
|
|
Success on x86_64-darwin (full log) Attempted: go_1_10 Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: go_1_10 Partial log (click to expand)
|
|
Trying some other packages (to see what the other arches are like) @GrahamcOfBorg build gopass docker prometheus |
|
Success on aarch64-linux (full log) Attempted: gopass, docker, prometheus Partial log (click to expand)
|
|
Success on x86_64-linux (full log) Attempted: gopass, docker, prometheus Partial log (click to expand)
|
|
Success on x86_64-darwin (full log) Attempted: gopass, docker, prometheus Partial log (click to expand)
|
Mic92
approved these changes
Mar 31, 2018
Mic92
added
1.severity: security
|
@Mic92 yes, according to https://go-review.googlesource.com/c/go/+/102776 there is also a patch for 1.9.5. I'll try to test that later tonight. |
This is a maintenance bump of the golang 1.9 version. Within the updates are a few bug fixes including an (extended?) fix for CVE-2018-7187 [1]. The complete changelog is available at the golang GitHub project [2]. [1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7187 [2] https://github.com/golang/go/issues?q=milestone%3AGo1.9.5
andir
changed the title
|
I added the changes for golang 1.9.5 to this PR. Running a rebuild of all affected packages right now. |
|
Success on x86_64-linux (full log) Attempted: go_1_10, go_1_9 Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: go_1_10, go_1_9 Partial log (click to expand)
|
|
Failure on x86_64-darwin (full log) Attempted: go_1_10, go_1_9 Partial log (click to expand)
|
|
@GrahamcOfBorg build kubernetes |
|
Success on x86_64-linux (full log) Attempted: kubernetes Partial log (click to expand)
|
|
Success on aarch64-linux (full log) Attempted: kubernetes Partial log (click to expand)
|
|
Failure on x86_64-darwin (full log) Attempted: kubernetes Partial log (click to expand)
|
|
18.03: [detached HEAD ba49d72] go_1_10: 1.10 -> 1.10.1 17.09 could also need a backport ... |
|
17.09: [detached HEAD aa63817] go: 1.9.2 -> 1.9.3 |
samueldr
removed
the
9.needs: port to stable
# for free
to join this conversation on GitHub.
Already have an account?
# to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Motivation for this change
This updates go to the latest version of the golang 1.9 & 1.10 branches.
A few minor (but important) things are fixed in this version(s).
Below are the details for the 1.10 changes. Read the commit message for details about the 1.9 changes.
go get(when used with--insecure) [1]
The full list of changes can se been on GitHub [2] & [4].
[1] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-7187
[2] https://github.com/golang/go/issues?q=milestone%3AGo1.10.1
[3] golang/go#23884
[4] golang/go#24563
Currently running a (re)build of all affected expressions on x86_64-linux.
Things done
build-use-sandboxinnix.confon non-NixOS)nix-shell -p nox --run "nox-review wip"./result/bin/)