update to golang 1.22 and kubo v0.29 to address quic-go CVE

.github/workflows/golangci-lint.yml

@@ -19,19 +19,19 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
-      - name: Set up Go 1.20
-        uses: actions/setup-go@v3
+      - uses: actions/setup-go@v4
+      - name: Set up Go 1.22.5
+        uses: actions/setup-go@v4
         with:
-          go-version: 1.20.5
+          go-version: 1.22.5
         id: go
       - run: go version
 
       - name: Lint
         run: |
-          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.53.3
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s v1.55.2
           go mod tidy
-          ./bin/golangci-lint run -v --timeout=3m --go=1.20.5
+          ./bin/golangci-lint run -v --timeout=3m --go=1.22.5
 
           # Optional: working directory, useful for monorepos
           # working-directory: somedir

Dockerfile

@@ -1,12 +1,12 @@
 # Build - first phase
-FROM golang:1.20-alpine as builder
+FROM golang:1.22-alpine as builder
 RUN mkdir /build
 WORKDIR /build
 COPY . .
 RUN go mod download && CGO_ENABLED=0 GOOS=linux go build -a -ldflags="-s -w" -o ipfs-server ./server/main.go
 
 # Runtime -  second phase.
-FROM alpine:3.19
+FROM alpine:3.20
 RUN mkdir /app
 WORKDIR /app
 RUN apk update && apk add --no-cache bash nodejs npm git && npm install -g @web3-storage/w3cli
@@ -17,7 +17,7 @@ RUN apk del git && rm -rf /var/cache/apk/* /root/.npm /tmp/*
 HEALTHCHECK --interval=10s --timeout=5s CMD wget --no-verbose --tries=1 --spider localhost:3001/health
 
 ENTRYPOINT [ "/bin/bash", "-l", "-c" ]
-CMD [ "./ipfs-server -port 3001 -w3-agent-key $W3_AGENT_KEY -w3-delegation-file $W3_DELEGATION_FILE --enable-gc" ]
+CMD [ "./ipfs-server -port 3001 -enable-gc-w3-agent-key $W3_AGENT_KEY -w3-delegation-file $W3_DELEGATION_FILE -enable-gc" ]
 
 # ipfs-pinner API server;
 EXPOSE 3001

car/dagstore.go

@@ -4,7 +4,7 @@ import (
 	"context"
 
 	blocks "github.com/ipfs/go-block-format"
-	coreiface "github.com/ipfs/boxo/coreiface"
+	coreiface "github.com/ipfs/kubo/core/coreiface"
 
 	"github.com/ipfs/go-cid"
 )

core/ipfs.go

@@ -23,7 +23,7 @@ func CreateIpfsNode(ctx context.Context, cidComputeOnly bool) (*core.IpfsNode, e
 
 	var err error
 	if cidComputeOnly {
-		cfg.NilRepo = true
+		cfg.Repo = nil
 	} else {
 		cfg.Routing = libp2p.DHTOption
 		cfg.Host = libp2p.DefaultHostOption

core/support.go

@@ -15,7 +15,7 @@ const (
 	// IpfsPinnerVersionMajor is Major version component of the current release
 	IpfsPinnerVersionMajor = 1
 	// IpfsPinnerVersionMinor is Minor version component of the current release
-	IpfsPinnerVersionMinor = 0
+	IpfsPinnerVersionMinor = 2
 	// IpfsPinnerVersionPatch is Patch version component of the current release
 	IpfsPinnerVersionPatch = 0
 	clientIdentifier       = "ipfs-pinner" // Client identifier to advertise over the network

coreapi/api.go

@@ -3,8 +3,8 @@ package coreapi
 import (
 	"context"
 
-	coreiface "github.com/ipfs/boxo/coreiface"
 	"github.com/ipfs/kubo/config"
+	coreiface "github.com/ipfs/kubo/core/coreiface"
 )
 
 type CoreExtensionAPI interface {

coreapi/impl.go

@@ -4,10 +4,10 @@ import (
 	"context"
 	"log"
 
-	coreiface "github.com/ipfs/boxo/coreiface"
 	"github.com/ipfs/kubo/config"
 	"github.com/ipfs/kubo/core"
 	icore "github.com/ipfs/kubo/core/coreapi"
+	coreiface "github.com/ipfs/kubo/core/coreiface"
 	corerepo "github.com/ipfs/kubo/core/corerepo"
 )
 

dag/unixfs.go

@@ -10,12 +10,12 @@ import (
 	"time"
 
 	"github.com/covalenthq/ipfs-pinner/coreapi"
-	coreiface "github.com/ipfs/boxo/coreiface"
-	"github.com/ipfs/boxo/coreiface/options"
-	"github.com/ipfs/boxo/coreiface/path"
 	files "github.com/ipfs/boxo/files"
+	"github.com/ipfs/boxo/path"
 	"github.com/ipfs/go-cid"
 	ipldformat "github.com/ipfs/go-ipld-format"
+	coreiface "github.com/ipfs/kubo/core/coreiface"
+	"github.com/ipfs/kubo/core/coreiface/options"
 	mh "github.com/multiformats/go-multihash"
 )
 
@@ -68,14 +68,17 @@ func (api *unixfsApi) GenerateDag(ctx context.Context, reader io.Reader) (cid.Ci
 	if err != nil {
 		return cid.Undef, err
 	}
-	return rpath.Cid(), nil
+	return rpath.RootCid(), nil
 }
 
 func (api *unixfsApi) RemoveDag(ctx context.Context, cid cid.Cid) error {
-	rp, err := api.ipfs.ResolvePath(ctx, path.New(cid.String()))
+	rp, rs, err := api.ipfs.ResolvePath(ctx, path.FromCid(cid))
 	if err != nil {
 		return err
 	}
+	if rs != nil {
+		return errors.New("cannot remove a dag that is not local")
+	}
 
 	err = api.ipfs.Pin().Rm(ctx, rp, options.Pin.RmRecursive(true))
 	if err != nil {
@@ -101,7 +104,7 @@ func (api *unixfsApi) Get(ctx context.Context, cid cid.Cid) ([]byte, error) {
 		effectiveNode = api.ipfs
 	}
 
-	node, err := effectiveNode.Unixfs().Get(timeoutCtx, path.New(cidStr))
+	node, err := effectiveNode.Unixfs().Get(timeoutCtx, path.FromCid(cid))
 	if ipldformat.IsNotFound(err) || errors.Is(err, context.DeadlineExceeded) {
 		if api.peeringAvailable {
 			log.Printf("trying out http search as ipfs p2p failed: %s\n", err)