Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

[chore] Upgrade go version in CI #8172

Merged
merged 1 commit into from
Aug 3, 2023
Merged

Conversation

dmitryax
Copy link
Member

@dmitryax dmitryax commented Aug 3, 2023

To resolve the govulncheck reports:

Vulnerability #1: GO-2023-1987
    Large RSA keys can cause high CPU usage in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2023-1987
  Standard library
    Found in: crypto/tls@go1.19.11
    Fixed in: crypto/tls@go1.21rc4
    Example traces found:
Error:       #1: service/internal/proctelemetry/config.go:299:27: proctelemetry.initOTLPgRPCExporter calls otlpmetricgrpc.New, which eventually calls tls.Conn.Handshake
Error:       #2: service/internal/proctelemetry/config.go:156:39: proctelemetry.InitPrometheusServer calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
Error:       #3: service/service.go:251:36: service.buildResource calls uuid.NewRandom, which eventually calls tls.Conn.Read
Error:       #4: service/config.go:35:13: service.Config.Validate calls fmt.Printf, which eventually calls tls.Conn.Write
Error:       #5: service/telemetry/telemetry.go:32:28: telemetry.Telemetry.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls tls.Dialer.DialContext

https://github.com/open-telemetry/opentelemetry-collector/actions/runs/5753675727/job/15597394973?pr=8144

To resolve the govulncheck reports:
```
Vulnerability #1: GO-2023-1987
    Large RSA keys can cause high CPU usage in crypto/tls
  More info: https://pkg.go.dev/vuln/GO-2023-1987
  Standard library
    Found in: crypto/tls@go1.19.11
    Fixed in: crypto/tls@go1.21rc4
    Example traces found:
Error:       #1: service/internal/proctelemetry/config.go:299:27: proctelemetry.initOTLPgRPCExporter calls otlpmetricgrpc.New, which eventually calls tls.Conn.Handshake
Error:       #2: service/internal/proctelemetry/config.go:156:39: proctelemetry.InitPrometheusServer calls http.Server.ListenAndServe, which eventually calls tls.Conn.HandshakeContext
Error:       #3: service/service.go:251:36: service.buildResource calls uuid.NewRandom, which eventually calls tls.Conn.Read
Error:       #4: service/config.go:35:13: service.Config.Validate calls fmt.Printf, which eventually calls tls.Conn.Write
Error:       #5: service/telemetry/telemetry.go:32:28: telemetry.Telemetry.Shutdown calls trace.TracerProvider.Shutdown, which eventually calls tls.Dialer.DialContext
```
@dmitryax dmitryax requested review from a team and bogdandrutu August 3, 2023 17:25
@codecov
Copy link

codecov bot commented Aug 3, 2023

Codecov Report

Patch and project coverage have no change.

Comparison is base (3089ea8) 90.25% compared to head (9e26089) 90.25%.
Report is 1 commits behind head on main.

Additional details and impacted files
@@           Coverage Diff           @@
##             main    #8172   +/-   ##
=======================================
  Coverage   90.25%   90.25%           
=======================================
  Files         301      301           
  Lines       15551    15551           
=======================================
  Hits        14035    14035           
  Misses       1227     1227           
  Partials      289      289           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

@dmitryax dmitryax changed the title [chore] Upgrade go version [chore] Upgrade go version in CI Aug 3, 2023
@dmitryax dmitryax merged commit 8aeb3ab into open-telemetry:main Aug 3, 2023
@dmitryax dmitryax deleted the upgrade-go branch August 6, 2023 22:33
@codeboten codeboten added this to the v0.83.0 milestone Aug 24, 2023
# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

3 participants