Upgrade to protobuf 3.19.2

[dhalperi]

This is for CVE-2021-22569 .

See: https://github.com/protocolbuffers/protobuf/releases/tag/v3.19.2

[dhalperi]

I mirrored #108. Obviously I do not have ACLs to upload files to mirror.bazel.build, so they 404, but bazel handles this gracefully.

The shas were copied from the output of the generate_sums script:

➜  private git:(3.19.2) ✗ ./generate_sums.sh 3.19.2                 
Downloading 'https://github.com/protocolbuffers/protobuf/archive/v3.19.2.tar.gz'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   133  100   133    0     0    722      0 --:--:-- --:--:-- --:--:--   751
100 5168k  100 5168k    0     0  7647k      0 --:--:-- --:--:-- --:--:-- 21.2M

        'sha256': '4dd35e788944b7686aac898f77df4e9a54da0ca694b8801bd6b2a9ffc1b3085e',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/archive/v3.19.2.tar.gz',
            'https://github.com/protocolbuffers/protobuf/archive/v3.19.2.tar.gz',
        ],
Downloading 'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-aarch_64.zip'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   669  100   669    0     0   4423      0 --:--:-- --:--:-- --:--:--  4613
100 1743k  100 1743k    0     0  3792k      0 --:--:-- --:--:-- --:--:-- 3792k

        'sha256': 'd14af76a12eaf22cb96c9eec4c82b2132f3b1ee29bd43e07551e4a3cef5cc16a',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-aarch_64.zip',
            'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-aarch_64.zip',
        ],
Downloading 'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-ppcle_64.zip'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   669  100   669    0     0   3862      0 --:--:-- --:--:-- --:--:--  4005
100 1887k  100 1887k    0     0  2296k      0 --:--:-- --:--:-- --:--:-- 4270k

        'sha256': 'b61467465e00ec86bc08b3a782f99abceadbcd91ac5c6124fe150db7a6426f66',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-ppcle_64.zip',
            'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-ppcle_64.zip',
        ],
Downloading 'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-s390_64.zip'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   668  100   668    0     0   3329      0 --:--:-- --:--:-- --:--:--  3425
100 2033k  100 2033k    0     0  3370k      0 --:--:-- --:--:-- --:--:-- 14.9M

        'sha256': '494c25dfbc302472de03b38959b149d94f6a29be3a7644e71b3d605d3b125e30',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-s390_64.zip',
            'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-s390_64.zip',
        ],
Downloading 'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-x86_32.zip'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   667  100   667    0     0   3939      0 --:--:-- --:--:-- --:--:--  4067
100 1598k  100 1598k    0     0  2871k      0 --:--:-- --:--:-- --:--:-- 2871k

        'sha256': '1d4296cade2fe12215064d440a5c692681b5a0cda02ac9ca2b4e742baa6ad30f',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-x86_32.zip',
            'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-x86_32.zip',
        ],
Downloading 'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-x86_64.zip'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   667  100   667    0     0   1301      0 --:--:-- --:--:-- --:--:--  1334
100 1660k  100 1660k    0     0   825k      0  0:00:02  0:00:02 --:--:-- 5949k

        'sha256': '595ac0beaa7d2d6a672911b3b39a27fea964a5e76eeeba418a4bd3c4e8f72405',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-x86_64.zip',
            'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-x86_64.zip',
        ],
Downloading 'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-osx-x86_64.zip'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   665  100   665    0     0   3603      0 --:--:-- --:--:-- --:--:--  3735
100 2613k  100 2613k    0     0  4365k      0 --:--:-- --:--:-- --:--:-- 12.3M

        'sha256': '1af3bdcd1e684d7cbf498749f630574609f75bc33e50b03e0c9f7243d9986771',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-osx-x86_64.zip',
            'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-osx-x86_64.zip',
        ],
Downloading 'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-win32.zip'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   660  100   660    0     0   4022      0 --:--:-- --:--:-- --:--:--  4177
100 1154k  100 1154k    0     0  1856k      0 --:--:-- --:--:-- --:--:-- 1856k

        'sha256': '0135c6abdfc7a81e5ee9cdac8ffd7380d0bb95eacf7504f6e3570cf0e8d7e1c9',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-win32.zip',
            'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-win32.zip',
        ],
Downloading 'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-win64.zip'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100   660  100   660    0     0   3650      0 --:--:-- --:--:-- --:--:--  3750
100 1488k  100 1488k    0     0  2409k      0 --:--:-- --:--:-- --:--:-- 2409k

        'sha256': '465eabb87b38c1f26f0c5404561611ad5ed9f961bd0cda095a112f641846c3d0',
        'urls': [
            'https://mirror.bazel.build/github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-win64.zip',
            'https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-win64.zip',
        ],
Downloading 'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.2/protobuf-java-3.19.2.jar'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 1642k  100 1642k    0     0  11.1M      0 --:--:-- --:--:-- --:--:-- 11.6M

        'sha256': '3446cbfa13795228bc6549b91a409f27cdf6913d1c8f03e0f99572988623a04b',
        'urls': [
            'https://mirror.bazel.build/repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.2/protobuf-java-3.19.2.jar',
            'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.2/protobuf-java-3.19.2.jar',
        ],
Downloading 'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.2/protobuf-java-3.19.2-sources.jar'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  858k  100  858k    0     0  10.9M      0 --:--:-- --:--:-- --:--:-- 12.3M

        'sha256': '5150243063356046d85f2949f471cf533ee4b44d31052f419fa5e70a72e76baf',
        'urls': [
            'https://mirror.bazel.build/repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.2/protobuf-java-3.19.2-sources.jar',
            'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.2/protobuf-java-3.19.2-sources.jar',
        ],
Downloading 'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util/3.19.2/protobuf-java-util-3.19.2.jar'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 73386  100 73386    0     0  2427k      0 --:--:-- --:--:-- --:--:-- 2986k

        'sha256': '9588d67db391b19cffb4ec658d9365ac5362b2089661c157fd27f21380cdd1e8',
        'urls': [
            'https://mirror.bazel.build/repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util/3.19.2/protobuf-java-util-3.19.2.jar',
            'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util/3.19.2/protobuf-java-util-3.19.2.jar',
        ],
Downloading 'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util/3.19.2/protobuf-java-util-3.19.2-sources.jar'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 34818  100 34818    0     0  1098k      0 --:--:-- --:--:-- --:--:-- 1360k

        'sha256': '1733265b9938f062042cb70a3f330617885351097bddc1dd3e22eed9d803530f',
        'urls': [
            'https://mirror.bazel.build/repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util/3.19.2/protobuf-java-util-3.19.2-sources.jar',
            'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util/3.19.2/protobuf-java-util-3.19.2-sources.jar',
        ],
Downloading 'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-javalite/3.19.2/protobuf-javalite-3.19.2.jar'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  681k  100  681k    0     0  6961k      0 --:--:-- --:--:-- --:--:-- 7403k

        'sha256': 'bfc598474392a015c050d34be38bb84eb3986809374eac437420d51680150e94',
        'urls': [
            'https://mirror.bazel.build/repo1.maven.org/maven2/com/google/protobuf/protobuf-javalite/3.19.2/protobuf-javalite-3.19.2.jar',
            'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-javalite/3.19.2/protobuf-javalite-3.19.2.jar',
        ],
Downloading 'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-javalite/3.19.2/protobuf-javalite-3.19.2-sources.jar'...
  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  442k  100  442k    0     0  7259k      0 --:--:-- --:--:-- --:--:-- 8198k

        'sha256': '0154a27b8b6e4753013922fc8e50c59ebd7108af95f11fa9bc6b72ef14db0dc9',
        'urls': [
            'https://mirror.bazel.build/repo1.maven.org/maven2/com/google/protobuf/protobuf-javalite/3.19.2/protobuf-javalite-3.19.2-sources.jar',
            'https://repo1.maven.org/maven2/com/google/protobuf/protobuf-javalite/3.19.2/protobuf-javalite-3.19.2-sources.jar',
        ],
******************** IMPORTANT ********************

Please upload the following files to mirror.bazel.build:

  https://github.com/protocolbuffers/protobuf/archive/v3.19.2.tar.gz
  https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-aarch_64.zip
  https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-ppcle_64.zip
  https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-s390_64.zip
  https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-x86_32.zip
  https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-linux-x86_64.zip
  https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-osx-x86_64.zip
  https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-win32.zip
  https://github.com/protocolbuffers/protobuf/releases/download/v3.19.2/protoc-3.19.2-win64.zip
  https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.2/protobuf-java-3.19.2.jar
  https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java/3.19.2/protobuf-java-3.19.2-sources.jar
  https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util/3.19.2/protobuf-java-util-3.19.2.jar
  https://repo1.maven.org/maven2/com/google/protobuf/protobuf-java-util/3.19.2/protobuf-java-util-3.19.2-sources.jar
  https://repo1.maven.org/maven2/com/google/protobuf/protobuf-javalite/3.19.2/protobuf-javalite-3.19.2.jar
  https://repo1.maven.org/maven2/com/google/protobuf/protobuf-javalite/3.19.2/protobuf-javalite-3.19.2-sources.jar

but obviously you should decide to trust or not trust them based on your own internal criteria.

[dhalperi]

but obviously you should decide to trust or not trust them based on your own internal criteria.

Actually maybe CI passing is enough here.

[dhalperi]

@comius @lberki any change of taking a look at this? Or is there another maintainer to ping?

[comius]

I uploaded all files to mirror.bazel.build.