update to go1.25.1 #387

thaJeztah · 2025-10-01T14:28:30Z

depends on fix unsafe uintptr usage to be GC-safe on go1.25 danieljoos/wincred#78
depends on vendor: github.com/danieljoos/wincred v1.2.3 #388

codecov-commenter · 2025-10-01T14:29:46Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

thaJeztah · 2025-10-01T14:30:27Z

Nope, hack didn't make a difference; I'll drop that commit;

=== RUN   TestWinCredHelperRetrieveAliases
=== RUN   TestWinCredHelperRetrieveAliases/stored_with_port,_retrieved_without
    wincred_test.go:138: Error: failed to store secret for URL "https://foobar.docker.io:2376/": The stub received bad data.
=== RUN   TestWinCredHelperRetrieveAliases/stored_as_https,_retrieved_without_scheme
    wincred_test.go:138: Error: failed to store secret for URL "https://foobar.docker.io/": The stub received bad data.
=== RUN   TestWinCredHelperRetrieveAliases/stored_with_path,_retrieved_without
    wincred_test.go:138: Error: failed to store secret for URL "https://foobar.docker.io/one/two": The stub received bad data.
--- FAIL: TestWinCredHelperRetrieveAliases (0.00s)
    --- FAIL: TestWinCredHelperRetrieveAliases/stored_with_port,_retrieved_without (0.00s)
    --- FAIL: TestWinCredHelperRetrieveAliases/stored_as_https,_retrieved_without_scheme (0.00s)
    --- FAIL: TestWinCredHelperRetrieveAliases/stored_with_path,_retrieved_without (0.00s)
=== RUN   TestWinCredHelperRetrieveStrict
=== RUN   TestWinCredHelperRetrieveStrict/stored_as_https,_retrieved_using_http
    wincred_test.go:213: Error: failed to store secret for URL "https://foobar.docker.io:2376/": The stub received bad data.
=== RUN   TestWinCredHelperRetrieveStrict/stored_as_http,_retrieved_using_https
    wincred_test.go:213: Error: failed to store secret for URL "http://foobar.docker.io:2376/": The stub received bad data.
=== RUN   TestWinCredHelperRetrieveStrict/stored_as_http,_retrieved_without_scheme
    wincred_test.go:213: Error: failed to store secret for URL "http://foobar.docker.io/": The stub received bad data.
=== RUN   TestWinCredHelperRetrieveStrict/non-matching_ports
    wincred_test.go:213: Error: failed to store secret for URL "https://foobar.docker.io:1234/": The stub received bad data.
=== RUN   TestWinCredHelperRetrieveStrict/non-matching_paths
    wincred_test.go:213: Error: failed to store secret for URL "https://foobar.docker.io:1234/one/two": The stub received bad data.
--- FAIL: TestWinCredHelperRetrieveStrict (0.00s)
    --- FAIL: TestWinCredHelperRetrieveStrict/stored_as_https,_retrieved_using_http (0.00s)
    --- FAIL: TestWinCredHelperRetrieveStrict/stored_as_http,_retrieved_using_https (0.00s)
    --- FAIL: TestWinCredHelperRetrieveStrict/stored_as_http,_retrieved_without_scheme (0.00s)
    --- FAIL: TestWinCredHelperRetrieveStrict/non-matching_ports (0.00s)
    --- FAIL: TestWinCredHelperRetrieveStrict/non-matching_paths (0.00s)
=== RUN   TestWinCredHelperStoreRetrieve
=== RUN   TestWinCredHelperStoreRetrieve/foobar.docker.io
    wincred_test.go:269: Error: failed to store secret for URL: foobar.docker.io: The stub received bad data.
=== RUN   TestWinCredHelperStoreRetrieve/foobar.docker.io:2376
    wincred_test.go:269: Error: failed to store secret for URL: foobar.docker.io:2376: The stub received bad data.
=== RUN   TestWinCredHelperStoreRetrieve///foobar.docker.io:2376
    wincred_test.go:269: Error: failed to store secret for URL: //foobar.docker.io:2376: The stub received bad data.
=== RUN   TestWinCredHelperStoreRetrieve/https://foobar.docker.io:2376/
    wincred_test.go:269: Error: failed to store secret for URL: https://foobar.docker.io:2376: The stub received bad data.
=== RUN   TestWinCredHelperStoreRetrieve/http://foobar.docker.io:2376/
    wincred_test.go:269: Error: failed to store secret for URL: http://foobar.docker.io:2376: The stub received bad data.
=== RUN   TestWinCredHelperStoreRetrieve/https://foobar.docker.io:2376/some/path
    wincred_test.go:269: Error: failed to store secret for URL: https://foobar.docker.io:2376/some/path: The stub received bad data.
=== RUN   TestWinCredHelperStoreRetrieve/https://foobar.docker.io:2376/some/other/path
    wincred_test.go:269: Error: failed to store secret for URL: https://foobar.docker.io:2376/some/other/path: The stub received bad data.
=== RUN   TestWinCredHelperStoreRetrieve/https://foobar.docker.io:2376/some/other/path?foo=bar
    wincred_test.go:269: Error: failed to store secret for URL: https://foobar.docker.io:2376/some/other/path?foo=bar: The stub received bad data.

thaJeztah · 2025-10-01T15:40:25Z

So for some reason it could be that the size of what's stored changed, and that we now hit the limits of the maximum. Previously, we hit this for long passwords / tokens, but now it gives the same problem for tests in this repo;

This is effectively where things go wrong, but not sure if the size constraint is just for the blob (g.CredentialBlob), or for the struct as a whole;

docker-credential-helpers/wincred/wincred.go

Lines 18 to 28 in d4602cd

    
           // Add adds new credentials to the windows credentials manager. 
        
           func (h Wincred) Add(creds *credentials.Credentials) error { 
        
           	credsLabels := []byte(credentials.CredsLabel) 
        
           	g := winc.NewGenericCredential(creds.ServerURL) 
        
           	g.UserName = creds.Username 
        
           	g.CredentialBlob = []byte(creds.Secret) 
        
           	g.Persist = winc.PersistLocalMachine 
        
           	g.Attributes = []winc.CredentialAttribute{{Keyword: "label", Value: credsLabels}} 
        
           	return g.Write() 
        
           }

thaJeztah · 2025-10-01T15:47:31Z

wincred/wincred.go

+	out, err := json.Marshal(g)
+	if err != nil {
+		fmt.Println("Error:", err)
+	} else {
+		fmt.Println("GenericCredential:", string(out))
+	}


Just for debugging; this is what's shown;

=== RUN TestWinCredHelper GenericCredential: {"TargetName":"https://foobar.docker.io:2376/v1","Comment":"","LastWritten":"0001-01-01T00:00:00Z","CredentialBlob":"Zm9vYmFyYmF6","Attributes":[{"Keyword":"label","Value":"RG9ja2VyIENyZWRlbnRpYWxz"}],"TargetAlias":"","UserName":"foobar","Persist":2} wincred_test.go:52: The stub received bad data.

Could it be something else, e.g. the LastWritten date not being accepted or something? (because it's a zero date)?

thaJeztah · 2025-10-01T22:19:24Z

I opened a PR against danieljoos/wincred to see if CI would fail there as well, but .. it looks like tests are passing there;

gha: update go matrix; add go1.23, stable and oldstable danieljoos/wincred#77
[testing] gha: update go matrix; add go1.23, stable and oldstable thaJeztah/wincred#1

But I did notice that those set the LastWritten field to time.Now() (where we leave it empty);
https://github.com/danieljoos/wincred/blob/28dd5b4a5c520aab6b6e5cd76ff0403d56138d5b/conversion_test.go#L17

This one's also interesting, because it doesn't fail with the same error, but DOES return a "The parameter is incorrect." error;

docker-credential-helpers/wincred/wincred_test.go

Lines 45 to 53 in d4602cd

    
           // recount for credentials 
        
           oldauths, err = helper.List() 
        
           if err != nil { 
        
           	t.Fatal(err) 
        
           } 
        
           if err := helper.Add(creds); err != nil { 
        
           	t.Fatal(err) 
        
           }

=== RUN   TestWinCredHelper
GenericCredential: {"TargetName":"https://foobar.docker.io:2376/v1","Comment":"","LastWritten":"0001-01-01T00:00:00Z","CredentialBlob":"Zm9vYmFyYmF6","Attributes":[{"Keyword":"label","Value":"RG9ja2VyIENyZWRlbnRpYWxz"}],"TargetAlias":"","UserName":"foobar","Persist":2}
sysCREDENTIAL:
 {"Flags":0,"Type":1,"TargetName":104,"Comment":0,"LastWritten":{"LowDateTime":3201347093,"HighDateTime":11290211},"CredentialBlobSize":9,"CredentialBlob":824633762576,"Persist":2,"AttributeCount":1,"Attributes":824633908264,"TargetAlias":0,"UserName":102}
    wincred_test.go:52: The parameter is incorrect.
--- FAIL: TestWinCredHelper (0.00s)

Here's what we try to write;

{"TargetName":"https://foobar.docker.io:2376/v1","Comment":"","LastWritten":"0001-01-01T00:00:00Z","CredentialBlob":"Zm9vYmFyYmF6","Attributes":[{"Keyword":"label","Value":"RG9ja2VyIENyZWRlbnRpYWxz"}],"TargetAlias":"","UserName":"foobar","Persist":2}

And the sysCREDENTIAL after converting in wincred;

 {"Flags":0,"Type":1,"TargetName":104,"Comment":0,"LastWritten":{"LowDateTime":3201347093,"HighDateTime":11290211},"CredentialBlobSize":9,"CredentialBlob":824633762576,"Persist":2,"AttributeCount":1,"Attributes":824633908264,"TargetAlias":0,"UserName":102}

Another one about "Parameter is incorrect";

=== RUN   TestWinCredHelperRetrieveAliases/stored_with_port,_retrieved_without
GenericCredential:
{"TargetName":"https://foobar.docker.io:2376","Comment":"","LastWritten":"0001-01-01T00:00:00Z","CredentialBlob":"d29ybGQ=","Attributes":[{"Keyword":"label","Value":"RG9ja2VyIENyZWRlbnRpYWxz"}],"TargetAlias":"","UserName":"hello","Persist":2}
sysCREDENTIAL:
 {"Flags":0,"Type":1,"TargetName":104,"Comment":0,"LastWritten":{"LowDateTime":3201347093,"HighDateTime":11290211},"CredentialBlobSize":5,"CredentialBlob":824633764264,"Persist":2,"AttributeCount":1,"Attributes":824634072424,"TargetAlias":0,"UserName":104}

    wincred_test.go:138: Error: failed to store secret for URL "https://foobar.docker.io:2376": The parameter is incorrect.

thaJeztah · 2025-10-01T22:20:42Z

Oh! And I just realise that ALL tests now produce a The parameter is incorrect., and not the The stub received bad data. error 🤔

thaJeztah · 2025-10-01T23:07:04Z

Makefile

 test:
 	mkdir -p $(COVERAGEDIR)
-	go test -short -v -coverprofile=$(COVERAGEDIR)/coverage.txt -covermode=atomic ./...
+	go test -gcflags=all=-d=variablemakehash=n -short -v -coverprofile=$(COVERAGEDIR)/coverage.txt -covermode=atomic ./...


OK; looks like I may have found some clues; it's go1.25 exposing bugs on how unsafe.Pointers are used; https://go.dev/doc/go1.25#faster-slices

Faster slices

The compiler can now allocate the backing store for slices on the stack in more situations, which improves performance. This change has the potential to amplify the effects of incorrect unsafe.Pointer usage, see for example issue 73199. In order to track down these problems, the bisect tool can be used to find the allocation causing trouble using the -compile=variablemake flag. All such new stack allocations can also be turned off using -gcflags=all=-d=variablemakehash=n.

Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah · 2025-10-02T19:49:51Z

And .. the last one @crazy-max

crazy-max · 2025-10-02T19:54:33Z

Needs follow-up in https://github.com/docker/packaging/blob/d1f885c3dcf854fb3568a84cddda48fe05b5e55a/docker-bake.hcl#L538

thaJeztah mentioned this pull request Oct 1, 2025

update to go1.24.7, xx v1.7.0 #383

Merged

1 task

thaJeztah force-pushed the bump_go1.25 branch from ac3ec4e to c65261d Compare October 1, 2025 14:30

thaJeztah commented Oct 1, 2025

View reviewed changes

thaJeztah force-pushed the bump_go1.25 branch from 7c5a12c to 3ab2e95 Compare October 1, 2025 22:02

thaJeztah force-pushed the bump_go1.25 branch 2 times, most recently from 7e0140e to 80a855b Compare October 1, 2025 23:06

thaJeztah commented Oct 1, 2025

View reviewed changes

thaJeztah force-pushed the bump_go1.25 branch 2 times, most recently from 85d724f to b4688d2 Compare October 2, 2025 00:45

thaJeztah mentioned this pull request Oct 2, 2025

fix unsafe uintptr usage to be GC-safe on go1.25 danieljoos/wincred#78

Merged

thaJeztah force-pushed the bump_go1.25 branch 3 times, most recently from e61e1e5 to 071737d Compare October 2, 2025 19:42

update to go1.25.1

fcb0b66

Signed-off-by: Sebastiaan van Stijn <[email protected]>

thaJeztah force-pushed the bump_go1.25 branch from 071737d to fcb0b66 Compare October 2, 2025 19:49

thaJeztah marked this pull request as ready for review October 2, 2025 19:49

crazy-max approved these changes Oct 2, 2025

View reviewed changes

thaJeztah merged commit 84c3413 into docker:master Oct 2, 2025
12 checks passed

thaJeztah deleted the bump_go1.25 branch October 2, 2025 19:54

BrewTestBot mentioned this pull request Oct 2, 2025

docker-credential-helper 0.9.4 Homebrew/homebrew-core#246689

Merged

rancherbot mentioned this pull request Oct 3, 2025

rddepman: bump dockerProvidedCredentialHelpers from 0.9.3 to 0.9.4 rancher-sandbox/rancher-desktop#9290

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

update to go1.25.1 #387

update to go1.25.1 #387

thaJeztah commented Oct 1, 2025 •

edited

Loading

Uh oh!

codecov-commenter commented Oct 1, 2025 •

edited

Loading

Uh oh!

thaJeztah commented Oct 1, 2025

Uh oh!

thaJeztah commented Oct 1, 2025

Uh oh!

thaJeztah Oct 1, 2025

Uh oh!

thaJeztah commented Oct 1, 2025

Uh oh!

thaJeztah commented Oct 1, 2025

Uh oh!

thaJeztah Oct 1, 2025

Uh oh!

thaJeztah commented Oct 2, 2025

Uh oh!

Uh oh!

crazy-max commented Oct 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

update to go1.25.1 #387

update to go1.25.1 #387

Conversation

thaJeztah commented Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov-commenter commented Oct 1, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

thaJeztah commented Oct 1, 2025

Uh oh!

thaJeztah commented Oct 1, 2025

Uh oh!

thaJeztah Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Oct 1, 2025

Uh oh!

thaJeztah commented Oct 1, 2025

Uh oh!

thaJeztah Oct 1, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Oct 2, 2025

Uh oh!

Uh oh!

crazy-max commented Oct 2, 2025

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

thaJeztah commented Oct 1, 2025 •

edited

Loading

codecov-commenter commented Oct 1, 2025 •

edited

Loading