Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update to Go 1.22 #2550

Merged
merged 4 commits into from
Sep 5, 2024
Merged

Update to Go 1.22 #2550

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
a56f7bc
Update to Go 1.22
mtrmac Aug 22, 2024
d1532b6
Update dependencies held back for Go 1.22
mtrmac Aug 22, 2024
5ba99cd
Use for range-over-integers
mtrmac Aug 22, 2024
eb06447
Use math/rand/v2
mtrmac Aug 22, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions docker/body_reader.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ import (
"fmt"
"io"
"math"
"math/rand"
"math/rand/v2"
"net/http"
"net/url"
"strconv"
Expand Down Expand Up @@ -158,7 +158,7 @@ func (br *bodyReader) Read(p []byte) (int, error) {
logrus.Debugf("Error closing blob body: %v", err) // … and ignore err otherwise
}
br.body = nil
time.Sleep(1*time.Second + time.Duration(rand.Intn(100_000))*time.Microsecond) // Some jitter so that a failure blip doesn’t cause a deterministic stampede
time.Sleep(1*time.Second + rand.N(100_000*time.Microsecond)) // Some jitter so that a failure blip doesn’t cause a deterministic stampede

headers := map[string][]string{
"Range": {fmt.Sprintf("bytes=%d-", br.offset)},
Expand Down
2 changes: 1 addition & 1 deletion docker/docker_image_src.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -830,7 +830,7 @@ func makeBufferedNetworkReader(stream io.ReadCloser, nBuffers, bufferSize uint)
handleBufferedNetworkReader(&br)
}()

for i := uint(0); i < nBuffers; i++ {
for range nBuffers {
b := bufferedNetworkReaderBuffer{
data: make([]byte, bufferSize),
}
Expand Down
47 changes: 25 additions & 22 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
module github.com/containers/image/v5

go 1.21.0
go 1.22.5
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I have to think about this, I am not to happy about requiring a specific patch version. We may quickly end up moving faster than distros but I will look into it tomorrow.

Copy link
Collaborator Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This comes from the sigstore dependencies, e.g. sigstore/sigstore#1786 sigstore/fulcio#1735 . In these instances we can hold them back, but it comes with the usual risks of a future vulnerability forcing us to update later at a hurry, or to fork to carry a backported fix.

For the record, there’s a parallel conversation about this issue in containers/podman#23289 .

Copy link
Member

@Luap99 Luap99 Sep 4, 2024 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The problem around this is simple, we may end up moving faster than consumers.
The go 1.22 bump means no fedora 39 support already, if we start bumping the patch version we may require a newer version than in some distros. While we do have some upstream CI here we do not cover all the version we have to build on here, currently this CI setup does not use packit and we only test the latest fedora in cirrus I think so we easily break ourself in podman and buildah that have to build on fedora -1 and debian sid...
And we might break the packit tasks for centos stream/epel as well.

On every update we have to check all the versions in all the distros we care about to ensure it can still be build. I don't know how RHEL handles the golang versions but we certainly do not want to cut a new upstream releases for RHEL just to discover they cannot be build until golang is updated there.

IMO distros are responsible for shipping new golang with updated bug/security fixes, it seems strange for to require a specific patch version just because of a fix across all your consumers. It it not like go changes the behaviour on a patch release like they did with the for loop copy behavior in 1.22 which does require such an enforcement.

If a projects want to build it with a specific version they can use the toolchain directive which does not effect library users.

If these are the only dependencies where this done currently I would rather try to push back upstream. Though I understand that this can happy in any dependency at any time... I really hope it will not

And even worse this will become a gigantic PITA when backporting security fixes from such dependencies to LTS branches as these things need to happen fast but the golang update may not be so fast.

Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Per discussion we accept this risk going forward so LGTM


require (
dario.cat/mergo v1.0.1
Expand All @@ -27,17 +27,17 @@ require (
github.com/ostreedev/ostree-go v0.0.0-20210805093236-719684c64e4f
github.com/proglottis/gpgme v0.1.3
github.com/secure-systems-lab/go-securesystemslib v0.8.0
github.com/sigstore/fulcio v1.4.5
github.com/sigstore/fulcio v1.6.3
github.com/sigstore/rekor v1.3.6
github.com/sigstore/sigstore v1.8.4
github.com/sigstore/sigstore v1.8.8
github.com/sirupsen/logrus v1.9.3
github.com/stretchr/testify v1.9.0
github.com/sylabs/sif/v2 v2.18.0
github.com/sylabs/sif/v2 v2.19.1
github.com/ulikunitz/xz v0.5.12
github.com/vbatts/tar-split v0.11.5
github.com/vbauerster/mpb/v8 v8.8.3
github.com/xeipuuv/gojsonschema v1.2.0
go.etcd.io/bbolt v1.3.10
go.etcd.io/bbolt v1.3.11
golang.org/x/crypto v0.27.0
golang.org/x/exp v0.0.0-20240823005443-9b4947da3948
golang.org/x/oauth2 v0.23.0
Expand All @@ -48,28 +48,29 @@ require (

require (
github.com/14rcole/gopopulate v0.0.0-20180821133914-b175b219e774 // indirect
github.com/Azure/go-ansiterm v0.0.0-20230124172434-306776ec8161 // indirect
github.com/Microsoft/go-winio v0.6.2 // indirect
github.com/Microsoft/hcsshim v0.12.5 // indirect
github.com/VividCortex/ewma v1.2.0 // indirect
github.com/acarl005/stripansi v0.0.0-20180116102854-5a71ef0e047d // indirect
github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/chzyer/readline v1.5.1 // indirect
github.com/containerd/cgroups/v3 v3.0.3 // indirect
github.com/containerd/errdefs v0.1.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.15.1 // indirect
github.com/coreos/go-oidc/v3 v3.10.0 // indirect
github.com/coreos/go-oidc/v3 v3.11.0 // indirect
github.com/cyphar/filepath-securejoin v0.3.1 // indirect
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
github.com/docker/go-metrics v0.0.1 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
github.com/felixge/httpsnoop v1.0.4 // indirect
github.com/go-jose/go-jose/v3 v3.0.3 // indirect
github.com/go-jose/go-jose/v4 v4.0.2 // indirect
github.com/go-logr/logr v1.4.1 // indirect
github.com/go-jose/go-jose/v4 v4.0.4 // indirect
github.com/go-logr/logr v1.4.2 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-openapi/analysis v0.23.0 // indirect
github.com/go-openapi/errors v0.22.0 // indirect
Expand All @@ -83,7 +84,7 @@ require (
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
github.com/golang/protobuf v1.5.4 // indirect
github.com/google/go-containerregistry v0.20.0 // indirect
github.com/google/go-containerregistry v0.20.2 // indirect
github.com/google/go-intervals v0.0.2 // indirect
github.com/google/uuid v1.6.0 // indirect
github.com/gorilla/mux v1.8.1 // indirect
Expand All @@ -92,7 +93,7 @@ require (
github.com/hashicorp/go-multierror v1.1.1 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/letsencrypt/boulder v0.0.0-20240418210053-89b07f4543e0 // indirect
github.com/letsencrypt/boulder v0.0.0-20240620165639-de9c06129bec // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-runewidth v0.0.16 // indirect
github.com/miekg/pkcs11 v1.1.1 // indirect
Expand All @@ -104,16 +105,18 @@ require (
github.com/moby/term v0.5.0 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/oklog/ulid v1.3.1 // indirect
github.com/opencontainers/runtime-spec v1.2.0 // indirect
github.com/opentracing/opentracing-go v1.2.0 // indirect
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/prometheus/client_golang v1.19.0 // indirect
github.com/prometheus/client_model v0.6.0 // indirect
github.com/prometheus/common v0.51.1 // indirect
github.com/prometheus/client_golang v1.20.0 // indirect
github.com/prometheus/client_model v0.6.1 // indirect
github.com/prometheus/common v0.55.0 // indirect
github.com/prometheus/procfs v0.15.1 // indirect
github.com/rivo/uniseg v0.4.7 // indirect
github.com/rogpeppe/go-internal v1.12.0 // indirect
github.com/segmentio/ksuid v1.0.4 // indirect
github.com/sergi/go-diff v1.3.1 // indirect
github.com/skratchdot/open-golang v0.0.0-20200116055534-eef842397966 // indirect
Expand All @@ -126,17 +129,17 @@ require (
go.mongodb.org/mongo-driver v1.14.0 // indirect
go.mozilla.org/pkcs7 v0.0.0-20210826202110-33d05740a352 // indirect
go.opencensus.io v0.24.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.49.0 // indirect
go.opentelemetry.io/otel v1.24.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.52.0 // indirect
go.opentelemetry.io/otel v1.28.0 // indirect
go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp v1.21.0 // indirect
go.opentelemetry.io/otel/metric v1.24.0 // indirect
go.opentelemetry.io/otel/trace v1.24.0 // indirect
go.opentelemetry.io/otel/metric v1.28.0 // indirect
go.opentelemetry.io/otel/trace v1.28.0 // indirect
golang.org/x/mod v0.20.0 // indirect
golang.org/x/net v0.26.0 // indirect
golang.org/x/net v0.28.0 // indirect
golang.org/x/sys v0.25.0 // indirect
golang.org/x/text v0.18.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
google.golang.org/grpc v1.64.1 // indirect
google.golang.org/protobuf v1.33.0 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 // indirect
google.golang.org/grpc v1.65.0 // indirect
google.golang.org/protobuf v1.34.2 // indirect
gotest.tools/v3 v3.5.1 // indirect
)
Loading