From 5197338ba74d67895895ea0ae67cbc40eff9085f Mon Sep 17 00:00:00 2001 From: Rodrigo Garcia Date: Fri, 7 Jun 2024 10:27:13 -0700 Subject: [PATCH 1/8] fix alpine image tag in Dockerfile to address security vulnerabilities --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index ef87ba34..36a66adf 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,7 +9,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -o bsp-agent ./cmd/bsp RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -o bsp-extractor ./scripts/extractor.go RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -o bsp-extractor-2 ./scripts/replica/extractor2.go # Runtime/test - second phase. -FROM alpine:3.15.7 +FROM alpine:3.20 RUN mkdir /app WORKDIR /app RUN apk update && apk add --no-cache bash=5.1.16-r0 From 873e8a2d4533a43699e52c428952c70f7502cf64 Mon Sep 17 00:00:00 2001 From: Rodrigo Garcia Date: Fri, 7 Jun 2024 10:41:33 -0700 Subject: [PATCH 2/8] use default bash version for each stable alpine tag --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 36a66adf..8860e65c 100644 --- a/Dockerfile +++ b/Dockerfile @@ -12,7 +12,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -o bsp-extractor-2 ./s FROM alpine:3.20 RUN mkdir /app WORKDIR /app -RUN apk update && apk add --no-cache bash=5.1.16-r0 +RUN apk update && apk add --no-cache bash RUN mkdir -p bin/block-ethereum bin/block-elrond COPY --from=builder /build/bsp-agent /app COPY --from=builder /build/entry.sh /app From 61cd818c43979add09879a38ff2a2ecb5ff6ba22 Mon Sep 17 00:00:00 2001 From: Rodrigo Garcia Date: Fri, 7 Jun 2024 10:47:43 -0700 Subject: [PATCH 3/8] using alpine:3.19 instead because there is an new CVE for openssl on 3.20 without a fix --- Dockerfile | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 8860e65c..aa8fe3a6 100644 --- a/Dockerfile +++ b/Dockerfile @@ -9,7 +9,7 @@ RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -o bsp-agent ./cmd/bsp RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -o bsp-extractor ./scripts/extractor.go RUN CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -o bsp-extractor-2 ./scripts/replica/extractor2.go # Runtime/test - second phase. -FROM alpine:3.20 +FROM alpine:3.19 RUN mkdir /app WORKDIR /app RUN apk update && apk add --no-cache bash From a04834492afa23f14a2b50fa3b3e6f51cebdccf7 Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Mon, 10 Jun 2024 16:06:47 +0000 Subject: [PATCH 4/8] Bump golang.org/x/sys from 0.18.0 to 0.21.0 Bumps [golang.org/x/sys](https://github.com/golang/sys) from 0.18.0 to 0.21.0. - [Commits](https://github.com/golang/sys/compare/v0.18.0...v0.21.0) --- updated-dependencies: - dependency-name: golang.org/x/sys dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 8 ++------ 2 files changed, 3 insertions(+), 7 deletions(-) diff --git a/go.mod b/go.mod index b7b65882..b6d6168b 100644 --- a/go.mod +++ b/go.mod @@ -19,7 +19,7 @@ require ( github.com/satori/go.uuid v1.2.0 github.com/sirupsen/logrus v1.9.3 github.com/ubiq/go-ubiq v3.0.1+incompatible - golang.org/x/sys v0.18.0 + golang.org/x/sys v0.21.0 google.golang.org/api v0.122.0 // indirect gopkg.in/avro.v0 v0.0.0-20171217001914-a730b5802183 ) diff --git a/go.sum b/go.sum index 8bc2d6d2..ee06fbc8 100644 --- a/go.sum +++ b/go.sum @@ -668,8 +668,6 @@ golang.org/x/crypto v0.0.0-20210220033148-5ea612d1eb83/go.mod h1:jdWPYTVW3xRLrWP golang.org/x/crypto v0.0.0-20210506145944-38f3c27a63bf/go.mod h1:P+XmwS30IXTQdn5tA2iutPOUgjI07+tq3H3K9MVA1s8= golang.org/x/crypto v0.17.0 h1:r8bRNjWL3GshPW3gkd+RpvzWrZAwPS49OmTGZ/uhM4k= golang.org/x/crypto v0.17.0/go.mod h1:gCAAfMLgwOJRpTjQ2zCCt2OcSfYMTeZVSRtQlPC7Nq4= -golang.org/x/crypto v0.21.0 h1:X31++rzVUdKhX5sWmSOFZxx8UW/ldWx55cbf08iNAMA= -golang.org/x/crypto v0.21.0/go.mod h1:0BP7YvVV9gBbVKyeTG0Gyn+gZm94bibOW5BjDEYAOMs= golang.org/x/exp v0.0.0-20180321215751-8460e604b9de/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20180807140117-3d87b88a115f/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= @@ -792,10 +790,8 @@ golang.org/x/sys v0.5.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.16.0 h1:xWw16ngr6ZMtmxDyKyIgsE93KNKz5HKmMa3b8ALHidU= -golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= -golang.org/x/sys v0.18.0 h1:DBdB3niSjOA/O0blCZBqDefyWNYveAYMNF1Wum0DYQ4= -golang.org/x/sys v0.18.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +golang.org/x/sys v0.21.0 h1:rF+pYz3DAGSQAxAu1CbC7catZg4ebC4UIeIhKxBZvws= +golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= From be3389ad328bfa7292bc145098d97c24d9cb2c2e Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 11 Jun 2024 02:05:16 +0000 Subject: [PATCH 5/8] Bump github.com/linkedin/goavro/v2 from 2.12.0 to 2.13.0 Bumps [github.com/linkedin/goavro/v2](https://github.com/linkedin/goavro) from 2.12.0 to 2.13.0. - [Release notes](https://github.com/linkedin/goavro/releases) - [Changelog](https://github.com/linkedin/goavro/blob/master/debug_release.go) - [Commits](https://github.com/linkedin/goavro/compare/v2.12...v2.13.0) --- updated-dependencies: - dependency-name: github.com/linkedin/goavro/v2 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index b6d6168b..0bd7b812 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( github.com/gorilla/websocket v1.5.1 github.com/ipfs/go-cid v0.1.0 github.com/kelseyhightower/envconfig v1.4.0 - github.com/linkedin/goavro/v2 v2.12.0 + github.com/linkedin/goavro/v2 v2.13.0 github.com/satori/go.uuid v1.2.0 github.com/sirupsen/logrus v1.9.3 github.com/ubiq/go-ubiq v3.0.1+incompatible diff --git a/go.sum b/go.sum index ee06fbc8..77ddf371 100644 --- a/go.sum +++ b/go.sum @@ -387,8 +387,8 @@ github.com/leanovate/gopter v0.2.9 h1:fQjYxZaynp97ozCzfOyOuAGOU4aU/z37zf/tOujFk7 github.com/lib/pq v1.0.0 h1:X5PMW56eZitiTeO7tKzZxFCSpbFZJtkMMooicw2us9A= github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM= github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4= -github.com/linkedin/goavro/v2 v2.12.0 h1:rIQQSj8jdAUlKQh6DttK8wCRv4t4QO09g1C4aBWXslg= -github.com/linkedin/goavro/v2 v2.12.0/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk= +github.com/linkedin/goavro/v2 v2.13.0 h1:L8eI8GcuciwUkt41Ej62joSZS4kKaYIUdze+6for9NU= +github.com/linkedin/goavro/v2 v2.13.0/go.mod h1:KXx+erlq+RPlGSPmLF7xGo6SAbh8sCQ53x064+ioxhk= github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ= github.com/mattn/go-colorable v0.0.9/go.mod h1:9vuHe8Xs5qXnSaW/c/ABM9alt+Vo+STaOChaDxuIBZU= github.com/mattn/go-colorable v0.1.13 h1:fFA4WZxdEF4tXPZVKMLwD8oUnCTTo08duU7wxecdEvA= From dcdc9d62fdb0885d6a5622531ed18674302bcf34 Mon Sep 17 00:00:00 2001 From: Pranay Valson Date: Mon, 10 Jun 2024 19:06:41 -0700 Subject: [PATCH 6/8] update dependabot config Signed-off-by: Pranay Valson --- .github/dependabot.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 978616cc..d714c9a9 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -12,5 +12,5 @@ updates: target-branch: "develop" reviewers: - "noslav" - - "sudeepdino008" + - "rogarcia" From a358c991a75c5c0dbe3993f3c89628655c7f8bdc Mon Sep 17 00:00:00 2001 From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com> Date: Tue, 11 Jun 2024 03:01:44 +0000 Subject: [PATCH 7/8] Bump github.com/fatih/color from 1.16.0 to 1.17.0 Bumps [github.com/fatih/color](https://github.com/fatih/color) from 1.16.0 to 1.17.0. - [Release notes](https://github.com/fatih/color/releases) - [Commits](https://github.com/fatih/color/compare/v1.16.0...v1.17.0) --- updated-dependencies: - dependency-name: github.com/fatih/color dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] --- go.mod | 2 +- go.sum | 4 ++-- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/go.mod b/go.mod index 5573a4e5..72541abf 100644 --- a/go.mod +++ b/go.mod @@ -69,7 +69,7 @@ require ( github.com/cespare/xxhash/v2 v2.2.0 // indirect github.com/decred/dcrd/dcrec/secp256k1/v4 v4.0.1 // indirect github.com/djherbis/times v1.5.0 // indirect - github.com/fatih/color v1.16.0 + github.com/fatih/color v1.17.0 github.com/fsnotify/fsnotify v1.6.0 // indirect github.com/go-ole/go-ole v1.3.0 // indirect github.com/gogo/protobuf v1.3.2 // indirect diff --git a/go.sum b/go.sum index 423efedd..976a403c 100644 --- a/go.sum +++ b/go.sum @@ -179,8 +179,8 @@ github.com/ethereum/c-kzg-4844 v0.4.0/go.mod h1:VewdlzQmpT5QSrVhbBuGoCdFJkpaJlO1 github.com/ethereum/go-ethereum v1.13.15 h1:U7sSGYGo4SPjP6iNIifNoyIAiNjrmQkz6EwQG+/EZWo= github.com/ethereum/go-ethereum v1.13.15/go.mod h1:TN8ZiHrdJwSe8Cb6x+p0hs5CxhJZPbqB7hHkaUXcmIU= github.com/fatih/color v1.7.0/go.mod h1:Zm6kSWBoL9eyXnKyktHP6abPY2pDugNf5KwzbycvMj4= -github.com/fatih/color v1.16.0 h1:zmkK9Ngbjj+K0yRhTVONQh1p/HknKYSlNT+vZCzyokM= -github.com/fatih/color v1.16.0/go.mod h1:fL2Sau1YI5c0pdGEVCbKQbLXB6edEj1ZgiY4NijnWvE= +github.com/fatih/color v1.17.0 h1:GlRw1BRJxkpqUCBKzKOw098ed57fEsKeNjpTe3cSjK4= +github.com/fatih/color v1.17.0/go.mod h1:YZ7TlrGPkiz6ku9fK3TLD/pl3CpsiFyu8N92HLgmosI= github.com/fjl/memsize v0.0.2 h1:27txuSD9or+NZlnOWdKUxeBzTAUkWCVh+4Gf2dWFOzA= github.com/fogleman/gg v1.2.1-0.20190220221249-0403632d5b90/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k= github.com/fogleman/gg v1.3.0/go.mod h1:R/bRT+9gY/C5z7JzPU0zXsXHKM4/ayA+zqcVNZzPa1k= From 3a51b04ebaf8b459923d95e47eb940106d1a1898 Mon Sep 17 00:00:00 2001 From: Pranay Valson Date: Mon, 10 Jun 2024 21:12:28 -0700 Subject: [PATCH 8/8] bump bsp-agent patch version Signed-off-by: Pranay Valson --- internal/utils/utils.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/utils/utils.go b/internal/utils/utils.go index cb96e42d..1b57bdcf 100644 --- a/internal/utils/utils.go +++ b/internal/utils/utils.go @@ -34,7 +34,7 @@ const ( // BspAgentVersionMinor is Minor version component of the current release BspAgentVersionMinor = 7 // BspAgentVersionPatch is Patch version component of the current release - BspAgentVersionPatch = 0 + BspAgentVersionPatch = 1 ) // BspAgentVersion holds the textual version string.