projectatomic / docker

Docker - the open-source application container engine
http://www.docker.com
Apache License 2.0
81 stars 58 forks source link

Update to github.com/mtrmac/gpgme v0.1.2 #369

Open mtrmac opened 4 years ago

mtrmac commented 4 years ago

- What I did

This fixes CVE-2020-8945 by incorporating proglottis/gpgme#23 .

Other changes included by the rebase:

Given how invasive the CVE fix is (affecting basically all binding code), it seems safer to just update the package (and be verifiably equivalent with upstream) than to backport and try to back out the few other changes.

- How I did it

Performed by updating vendor.conf, and

$ mkdir -p _build/src/github.com/docker
$ ln -s $(pwd) _build/src/github.com/docker/docker
$ GOPATH=$(pwd)/_build:$GOPATH vndr github.com/mtrmac/gpgme

- How to verify it

I have only checked that it compiles, via

$ mkdir -p _build/src/github.com/docker
$ ln -s $(pwd) _build/src/github.com/docker/docker
$ GOPATH=$(pwd)/_build:$GOPATH IAMSTATIC=false DOCKER_DEBUG=1 hack/make.sh dynbinary

- Description for the changelog Incorporated a fix for CVE-2020-8945 .

mtrmac commented 4 years ago

(Warning: I didn’t test one bit whether the result works.)