Skip to content

Conversation

simonswine
Copy link
Contributor

What this PR does:

Update go version in build image to 1.16.6. This addresses CVE-2021-34558.

golang/go#47143

This now needs a maintainer to push a build image and update references (see https://cortexmetrics.io/docs/contributing/how-to-update-the-build-image/)

@simonswine simonswine force-pushed the 20210713_update-go-1.16.6 branch 2 times, most recently from 4591f03 to 9f23346 Compare July 13, 2021 10:28
This addresses CVE-2021-34558.

golang/go#47143

Signed-off-by: Christian Simon <simon@swine.de>
@simonswine simonswine force-pushed the 20210713_update-go-1.16.6 branch from 9f23346 to 178ab0c Compare July 13, 2021 10:29
Copy link
Contributor

@gouthamve gouthamve left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM

@pracucci
Copy link
Contributor

I'm going to build and publish the updated image.

Signed-off-by: Marco Pracucci <marco@pracucci.com>
@simonswine
Copy link
Contributor Author

@pracucci I think there is also a reference in the Makefile:

cortex/Makefile

Line 122 in 03911b6

LATEST_BUILD_IMAGE_TAG ?= build-image-multiarch-1d2497ff6

@pracucci
Copy link
Contributor

@pracucci I think there is also a reference in the Makefile:

cortex/Makefile

Line 122 in 03911b6

LATEST_BUILD_IMAGE_TAG ?= build-image-multiarch-1d2497ff6

Right. Can you fix it and also update the doc at docs/contributing/how-to-upgrade-golang-version.md, please?

Signed-off-by: Christian Simon <simon@swine.de>
@pracucci pracucci enabled auto-merge (squash) July 13, 2021 14:25
@pracucci pracucci merged commit e49102c into cortexproject:master Jul 13, 2021
alvinlin123 pushed a commit to ac1214/cortex that referenced this pull request Jan 14, 2022
* Update go version in build image to 1.16.6

This addresses CVE-2021-34558.

golang/go#47143

Signed-off-by: Christian Simon <simon@swine.de>

* Update build image and golang version in CI

Signed-off-by: Marco Pracucci <marco@pracucci.com>

* Update LATEST_BUILD_IMAGE_TAG in makefile

Signed-off-by: Christian Simon <simon@swine.de>

Co-authored-by: Marco Pracucci <marco@pracucci.com>
Signed-off-by: Alvin Lin <alvinlin@amazon.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants