search

influxdata / influxdb-operator

The Kubernetes operator for InfluxDB and the TICK stack.
Apache License 2.0
27 stars 6 forks source link

chore: require 1.3.2 for indirect gogo/protobuf #31

Closed jdstrand closed 2 years ago

jdstrand commented 2 years ago

To address CVE-2021-3121:

$ go mod edit -require github.com/gogo/protobuf@v1.3.2 $ go mod tidy

For the most part, tests pass (I don't have etcd in the expected location):

$ make test
...
go fmt ./...
go vet ./...
go test ./... -coverprofile cover.out
...
      failed to start the controlplane. retried 5 times: fork/exec /usr/local/kubebuilder/bin/etcd: no such file or directory
  occurred

  /path/to/influxdb-operator/controllers/suite_test.go:56
------------------------------

Ran 0 of 0 Specs in 0.003 seconds
FAIL! -- 0 Passed | 0 Failed | 0 Pending | 0 Skipped
--- FAIL: TestAPIs (0.00s)
FAIL
coverage: 0.0% of statements
FAIL    github.com/influxdata/influxdb-operator/controllers 0.014s
FAIL
make: *** [Makefile:18: test] Error 1
jdstrand commented 2 years ago

While the changes from 1.2.1 to 1.3.2 are significant, github.com/gogo/protobuf is an indirect dependency via k8s.io/apimachinery/pkg/runtime and the code in this repository isn't doing any generation via pb files.

jdstrand commented 2 years ago

This repo is currently not supported. It might be resurrected, but per @lesam and @samhld, this repo should be archived. As such, closing this PR.