Repository navigation
deps: security bumps (x/crypto, otel/sdk, chi) - #3071
momosh-ssv wants to merge 5 commits into
Conversation
Codecov Report✅ All modified and coverable lines are covered by tests. ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
 |
![greptile-apps[bot]](https://avatars.githubusercontent.com/in/867647?s=60&v=4){kind=small}
|
Both Greptile findings are addressed: metrics scrape assertion added in 11ded7f, PKCS#12 covered by the signer E2E run (details in thread). The pushes dismissed the earlier approvals, could you take another look? |
|
@greptile pls re-review |
|
@iurii-ssv @y0sher the re-review raised one finding on the scrape test, which is a false positive (details in the thread, the test passes at 11ded7f). All threads are resolved and CI is green, could you re-approve when you get a chance? |
iurii-ssv
left a comment
iurii-ssv
left a comment
There was a problem hiding this comment.
Cross-checked against govulncheck. Notes are inline and none of them block this PR.
grpc is still at v1.79.1 here (5 advisories). #3093 bumps it to v1.83.2 and is stacked on this PR because it needs this PR's otel v1.45.0 + semconv v1.43.0 move. Bumping grpc on stage directly pulls otel/sdk to 1.44 while semconv stays on 1.39, and buildResources then fails at startup with a schema URL conflict. #3094 on top of that handles the remaining cleanup mentioned below.
The merge-base changed after approval.
Supersedes renovate #2322 (abandoned).
otel/sdk v1.45.0's resource.Default() reports the semconv 1.43.0 schema. With resources.go still on v1.39.0, resource.Merge returns ErrSchemaURLConflict and start_node exits via log.Fatalf (same failure as #3020). Moves the root module's semconv imports to v1.43.0; the attribute keys used are unchanged between the two versions. ssvsigner keeps v1.39.0: its own go.mod is on otel v1.41.0, which does not ship v1.43.0, and it only uses attribute keys (no resource merge). Adds TestBuildResources so the next otel/sdk bump fails CI instead of node startup.
…crape The Prometheus exporter stays at v0.58.0 while otel/sdk/metric moves to v1.45.0. TestHandler_Start only checks for HTTP 200, so an exporter/sdk incompatibility that drops measurements would pass. Records a counter through InitializeProvider and asserts its value in the parsed scrape.
11ded7f to
a3ccb4c
Compare
iurii-ssv
left a comment
iurii-ssv
left a comment
There was a problem hiding this comment.
LGTM, just 1 nit to adjust PR description.
| // (it advances when otel/sdk is bumped); a mismatch makes the resource.Merge | ||
| // below fail with ErrSchemaURLConflict and aborts node startup (issue #3020). | ||
| semconv "go.opentelemetry.io/otel/semconv/v1.39.0" | ||
| semconv "go.opentelemetry.io/otel/semconv/v1.43.0" |
There was a problem hiding this comment.
Process note: this import move and the otel/sdk bump only work as a pair, so "each can be reverted alone" from the description doesn't hold for those two commits. I tried both on this branch:
- Reverting only the otel/sdk commit doesn't build:
no required module provides package go.opentelemetry.io/otel/semconv/v1.43.0. - Reverting only this commit builds, but
buildResourcesthen fails withconflicting Schema URL: https://opentelemetry.io/schemas/1.43.0 and https://opentelemetry.io/schemas/1.39.0. That's the [epbs-gloas] Node fails to boot: OTel resource schema-URL conflict (otel/sdk v1.41 resource.Default() schema 1.39 vs observability semconv v1.37) #3020 startup abort, and since the revert also removesTestBuildResources, CI stays green.
The otel/sdk commit on its own has the same startup failure, so a bisect could land on it if the commits go in individually. I'd note in the description that the two revert together.
This branch has not been deployed
3 participants
One commit per dependency so each can be reverted alone. Each lands in a different part of the node, so a problem on stage points at one commit.
Supersedes #2942, #2708, #2322.
Why #2942 failed CI: it bumped only ssvsigner/go.mod, but the root module replaces ssvsigner with ./ssvsigner, so root go.mod needs tidying too.
Verified locally: build, vet, lint, unit tests (both modules, network packages excluded, CI covers those).
Note: these are the Renovate-proposed versions, not the advisory-free ones. Still open on the bumped modules (govulncheck v1.1.4 at 11ded7f):
x/crypto/ssh. The only trace is ssvsigner's e2e testenv via testcontainers, not shipped code.RedirectSlashesand GO-2026-5774RealIP). None reachable,api/serveronly usesThrottle,CompressandNewWrapResponseWriter.Not touched here, but reachable in both modules: x/text 0.37.0 GO-2026-5970 via keystore encrypt/decrypt.
The stacked follow-ups clear all of the above: #3093 (grpc v1.83.2, root x/net, x/crypto, x/text) and #3094 (chi 5.3.2, x/crypto 0.56.0 and x/net/x/text in ssvsigner, otel exporters aligned to v1.45.0).