Skip to content

Commit 02ee51e

Browse files
lhotarilhotari
authored
[fix][sec] Bump golang.org/x/net to address CVE-2025-22870, requires go 1.23 (#1351)
1 parent 0ab28c2 commit 02ee51e

File tree

13 files changed

+182
-49
lines changed

13 files changed

+182
-49
lines changed

‎.github/workflows/bot.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ on:
2222

2323
jobs:
2424
pulsarbot:
25-
runs-on: ubuntu-20.04
25+
runs-on: ubuntu-latest
2626
timeout-minutes: 10
2727
if: github.event_name == 'issue_comment' && contains(github.event.comment.body, '/pulsarbot')
2828
steps:

‎.github/workflows/ci.yml‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -22,7 +22,7 @@ jobs:
2222
runs-on: ubuntu-latest
2323
strategy:
2424
matrix:
25-
go-version: [ '1.22', '1.23' ]
25+
go-version: [ '1.23', '1.24' ]
2626
steps:
2727
- uses: actions/checkout@v3
2828
- uses: actions/setup-go@v5
@@ -36,7 +36,7 @@ jobs:
3636
- uses: actions/checkout@v3
3737
- uses: actions/setup-go@v5
3838
with:
39-
go-version: '1.22'
39+
go-version: '1.23'
4040
- name: Check license header
4141
run: docker run --rm -v $(pwd):/github/workspace ghcr.io/korandoru/hawkeye-native:v3 check
4242
- name: Run golangci-lint
@@ -48,7 +48,7 @@ jobs:
4848
runs-on: ubuntu-latest
4949
strategy:
5050
matrix:
51-
go-version: [ '1.22', '1.23' ]
51+
go-version: [ '1.23', '1.24' ]
5252
steps:
5353
- uses: actions/checkout@v3
5454
- name: Check for Docker images

‎Dockerfile‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,7 +19,7 @@
1919
# set via the Makefile or CLI
2020
ARG PULSAR_IMAGE=apachepulsar/pulsar:latest
2121

22-
ARG GO_VERSION=1.22
22+
ARG GO_VERSION=1.23
2323
FROM golang:$GO_VERSION as golang
2424

2525
FROM $PULSAR_IMAGE

‎Makefile‎

Lines changed: 14 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -18,15 +18,23 @@
1818
#
1919

2020
IMAGE_NAME = pulsar-client-go-test:latest
21-
PULSAR_VERSION ?= 4.0.0
21+
PULSAR_VERSION ?= latest
2222
PULSAR_IMAGE = apachepulsar/pulsar:$(PULSAR_VERSION)
23-
GO_VERSION ?= 1.22
23+
GO_VERSION ?= 1.23
2424
CONTAINER_ARCH ?= $(shell uname -m | sed s/x86_64/amd64/)
2525

2626
# Golang standard bin directory.
2727
GOPATH ?= $(shell go env GOPATH)
2828
GOROOT ?= $(shell go env GOROOT)
2929

30+
# Pass "-race" to go test if TEST_RACE is set to 1
31+
TEST_RACE ?= 1
32+
# Pass "-coverprofile" to go test if TEST_COVERAGE is set to 1
33+
TEST_COVERAGE ?= 0
34+
35+
# Common docker run arguments for test containers
36+
DOCKER_TEST_ARGS = --rm -i -e TEST_RACE=${TEST_RACE} -e TEST_COVERAGE=${TEST_COVERAGE} ${IMAGE_NAME}
37+
3038
build:
3139
go build ./pulsar
3240
go build ./pulsaradmin
@@ -53,23 +61,23 @@ container:
5361
test: container test_standalone test_clustered test_extensible_load_manager
5462

5563
test_standalone: container
56-
docker run --rm -v /var/run/docker.sock:/var/run/docker.sock -i ${IMAGE_NAME} bash -c "cd /pulsar/pulsar-client-go && ./scripts/run-ci.sh"
64+
docker run -v /var/run/docker.sock:/var/run/docker.sock ${DOCKER_TEST_ARGS} bash -c "cd /pulsar/pulsar-client-go && ./scripts/run-ci.sh"
5765

5866
test_clustered: container
5967
PULSAR_VERSION=${PULSAR_VERSION} docker compose -f integration-tests/clustered/docker-compose.yml up -d
6068
until curl http://localhost:8080/metrics > /dev/null 2>&1; do sleep 1; done
61-
docker run --rm --network "clustered_pulsar" -i ${IMAGE_NAME} bash -c "cd /pulsar/pulsar-client-go && ./scripts/run-ci-clustered.sh"
69+
docker run --network=clustered_pulsar ${DOCKER_TEST_ARGS} bash -c "cd /pulsar/pulsar-client-go && ./scripts/run-ci-clustered.sh"
6270
PULSAR_VERSION=${PULSAR_VERSION} docker compose -f integration-tests/clustered/docker-compose.yml down
6371

6472
test_extensible_load_manager: container
6573
PULSAR_VERSION=${PULSAR_VERSION} docker compose -f integration-tests/extensible-load-manager/docker-compose.yml up -d
6674
until curl http://localhost:8080/metrics > /dev/null 2>&1; do sleep 1; done
67-
docker run --rm --network "extensible-load-manager_pulsar" -i ${IMAGE_NAME} bash -c "cd /pulsar/pulsar-client-go && ./scripts/run-ci-extensible-load-manager.sh"
75+
docker run --network=extensible-load-manager_pulsar ${DOCKER_TEST_ARGS} bash -c "cd /pulsar/pulsar-client-go && ./scripts/run-ci-extensible-load-manager.sh"
6876

6977
PULSAR_VERSION=${PULSAR_VERSION} docker compose -f integration-tests/blue-green/docker-compose.yml up -d
7078
until curl http://localhost:8081/metrics > /dev/null 2>&1 ; do sleep 1; done
7179

72-
docker run --rm --network="extensible-load-manager_pulsar" -i ${IMAGE_NAME} bash -c "cd /pulsar/pulsar-client-go && ./scripts/run-ci-blue-green-cluster.sh"
80+
docker run --network=extensible-load-manager_pulsar ${DOCKER_TEST_ARGS} bash -c "cd /pulsar/pulsar-client-go && ./scripts/run-ci-blue-green-cluster.sh"
7381
PULSAR_VERSION=${PULSAR_VERSION} docker compose -f integration-tests/blue-green/docker-compose.yml down
7482
PULSAR_VERSION=${PULSAR_VERSION} docker compose -f integration-tests/extensible-load-manager/docker-compose.yml down
7583

‎README.md‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ CGo-based library.
3838

3939
## Requirements
4040

41-
- Go 1.22+
41+
- Go 1.23+
4242

4343
## Status
4444

@@ -148,7 +148,7 @@ Run the tests:
148148

149149
Run the tests with specific versions of GOLANG and PULSAR:
150150

151-
make test GO_VERSION=1.22 PULSAR_VERSION=4.0.0
151+
make test GO_VERSION=1.23 PULSAR_VERSION=4.0.3
152152

153153
## Contributing
154154

‎go.mod‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/apache/pulsar-client-go
22

3-
go 1.22
3+
go 1.23.0
44

55
require (
66
github.com/99designs/keyring v1.2.1
@@ -93,11 +93,11 @@ require (
9393
go.opentelemetry.io/otel v1.24.0 // indirect
9494
go.opentelemetry.io/otel/metric v1.24.0 // indirect
9595
go.opentelemetry.io/otel/trace v1.24.0 // indirect
96-
golang.org/x/crypto v0.31.0 // indirect
97-
golang.org/x/net v0.33.0 // indirect
98-
golang.org/x/sys v0.28.0 // indirect
99-
golang.org/x/term v0.27.0 // indirect
100-
golang.org/x/text v0.21.0 // indirect
96+
golang.org/x/crypto v0.36.0 // indirect
97+
golang.org/x/net v0.38.0 // indirect
98+
golang.org/x/sys v0.31.0 // indirect
99+
golang.org/x/term v0.30.0 // indirect
100+
golang.org/x/text v0.23.0 // indirect
101101
google.golang.org/genproto/googleapis/api v0.0.0-20240318140521-94a12d6c2237 // indirect
102102
google.golang.org/genproto/googleapis/rpc v0.0.0-20240318140521-94a12d6c2237 // indirect
103103
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7 // indirect

‎go.sum‎

Lines changed: 10 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -254,8 +254,8 @@ golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACk
254254
golang.org/x/crypto v0.0.0-20190701094942-4def268fd1a4/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
255255
golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI=
256256
golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto=
257-
golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U=
258-
golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk=
257+
golang.org/x/crypto v0.36.0 h1:AnAEvhDddvBdpY+uR+MyHmuZzzNqXSe/GvuDeob5L34=
258+
golang.org/x/crypto v0.36.0/go.mod h1:Y4J0ReaxCR1IMaabaSMugxJES1EpwhBHhv2bDHklZvc=
259259
golang.org/x/mod v0.2.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
260260
golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA=
261261
golang.org/x/mod v0.20.0 h1:utOm6MM3R3dnawAiJgn0y+xvuYRsm1RKM/4giyfDgV0=
@@ -269,8 +269,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL
269269
golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A=
270270
golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU=
271271
golang.org/x/net v0.0.0-20210726213435-c6fcb2dbf985/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y=
272-
golang.org/x/net v0.33.0 h1:74SYHlV8BIgHIFC/LrYkOGIwL19eTYXQ5wc6TBuO36I=
273-
golang.org/x/net v0.33.0/go.mod h1:HXLR5J+9DxmrqMwG9qjGCxZ+zKXxBru04zlTvWlWuN4=
272+
golang.org/x/net v0.38.0 h1:vRMAPTMaeGqVhG5QyLJHqNDwecKTomGeqbnfZyKlBI8=
273+
golang.org/x/net v0.38.0/go.mod h1:ivrbrMbzFq5J41QOQh0siUuly180yBYtLp+CKbEaFx8=
274274
golang.org/x/oauth2 v0.25.0 h1:CY4y7XT9v0cRI9oupztF8AgiIu99L/ksR/Xp/6jrZ70=
275275
golang.org/x/oauth2 v0.25.0/go.mod h1:XYTD2NtWslqkgxebSiOHnXEap4TF09sJSc7H1sXbhtI=
276276
golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
@@ -297,17 +297,17 @@ golang.org/x/sys v0.0.0-20220908164124-27713097b956/go.mod h1:oPkhp1MJrh7nUepCBc
297297
golang.org/x/sys v0.8.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
298298
golang.org/x/sys v0.11.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
299299
golang.org/x/sys v0.15.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
300-
golang.org/x/sys v0.28.0 h1:Fksou7UEQUWlKvIdsqzJmUmCX3cZuD2+P3XyyzwMhlA=
301-
golang.org/x/sys v0.28.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
300+
golang.org/x/sys v0.31.0 h1:ioabZlmFYtWhL+TRYpcnNlLwhyxaM9kWTDEmfnprqik=
301+
golang.org/x/sys v0.31.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k=
302302
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
303-
golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q=
304-
golang.org/x/term v0.27.0/go.mod h1:iMsnZpn0cago0GOrHO2+Y7u7JPn5AylBrcoWkElMTSM=
303+
golang.org/x/term v0.30.0 h1:PQ39fJZ+mfadBm0y5WlL4vlM7Sx1Hgf13sMIY2+QS9Y=
304+
golang.org/x/term v0.30.0/go.mod h1:NYYFdzHoI5wRh/h5tDMdMqCqPJZEuNqVR5xJLd/n67g=
305305
golang.org/x/text v0.0.0-20170915032832-14c0d48ead0c/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
306306
golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ=
307307
golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
308308
golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ=
309-
golang.org/x/text v0.21.0 h1:zyQAAkrwaneQ066sspRyJaG9VNi/YJ1NfzcGB3hZ/qo=
310-
golang.org/x/text v0.21.0/go.mod h1:4IBbMaMmOPCJ8SecivzSH54+73PCFmPWxNTLm+vZkEQ=
309+
golang.org/x/text v0.23.0 h1:D71I7dUrlY+VX0gQShAThNGHFxZ13dGLBHQLVl1mJlY=
310+
golang.org/x/text v0.23.0/go.mod h1:/BLNzu4aZCJ1+kcD0DNRotWKage4q2rGVAg4o22unh4=
311311
golang.org/x/time v0.9.0 h1:EsRrnYcQiGH+5FfbgvV4AP7qEZstoyrHB0DzarOQ4ZY=
312312
golang.org/x/time v0.9.0/go.mod h1:3BpzKBy/shNhVucY/MWOyx10tF3SFh9QdLuxbVysPQM=
313313
golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ=

‎pulsar/consumer_test.go‎

Lines changed: 17 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -546,13 +546,19 @@ func TestPartitionTopicsConsumerPubSubEncryption(t *testing.T) {
546546

547547
makeHTTPCall(t, http.MethodPut, testURL, "6")
548548

549-
// create producer
549+
// Verify encryption keys exist
550+
keyReader := crypto.NewFileKeyReader("crypto/testdata/pub_key_rsa.pem", "crypto/testdata/pri_key_rsa.pem")
551+
_, err = keyReader.PublicKey("client-rsa.pem", nil)
552+
assert.Nil(t, err, "Failed to load public key")
553+
_, err = keyReader.PrivateKey("client-rsa.pem", nil)
554+
assert.Nil(t, err, "Failed to load private key")
555+
556+
// create producer with encryption
550557
producer, err := client.CreateProducer(ProducerOptions{
551558
Topic: topic,
552559
Encryption: &ProducerEncryptionInfo{
553-
KeyReader: crypto.NewFileKeyReader("crypto/testdata/pub_key_rsa.pem",
554-
"crypto/testdata/pri_key_rsa.pem"),
555-
Keys: []string{"client-rsa.pem"},
560+
KeyReader: keyReader,
561+
Keys: []string{"client-rsa.pem"},
556562
},
557563
})
558564
assert.Nil(t, err)
@@ -564,21 +570,24 @@ func TestPartitionTopicsConsumerPubSubEncryption(t *testing.T) {
564570
assert.Equal(t, topic+"-partition-1", topics[1])
565571
assert.Equal(t, topic+"-partition-2", topics[2])
566572

573+
// create consumer with encryption
567574
consumer, err := client.Subscribe(ConsumerOptions{
568575
Topic: topic,
569576
SubscriptionName: "my-sub",
570577
Type: Exclusive,
571578
ReceiverQueueSize: 10,
572579
Decryption: &MessageDecryptionInfo{
573-
KeyReader: crypto.NewFileKeyReader("crypto/testdata/pub_key_rsa.pem",
574-
"crypto/testdata/pri_key_rsa.pem"),
580+
KeyReader: keyReader,
575581
ConsumerCryptoFailureAction: crypto.ConsumerCryptoFailureActionFail,
576582
},
577583
})
578584
assert.Nil(t, err)
579585
defer consumer.Close()
580586

581-
ctx := context.Background()
587+
ctx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
588+
defer cancel()
589+
590+
// Send messages with encryption
582591
for i := 0; i < 10; i++ {
583592
_, err := producer.Send(ctx, &ProducerMessage{
584593
Payload: []byte(fmt.Sprintf("hello-%d", i)),
@@ -588,6 +597,7 @@ func TestPartitionTopicsConsumerPubSubEncryption(t *testing.T) {
588597

589598
msgs := make([]string, 0)
590599

600+
// Receive messages with encryption
591601
for i := 0; i < 10; i++ {
592602
msg, err := consumer.Receive(ctx)
593603
assert.Nil(t, err)

‎scripts/pulsar-test-service-start.sh‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,9 @@ cd $SRC_DIR
2424

2525
IMAGE_NAME=pulsar-client-go-test:latest
2626

27+
export PULSAR_MEM="-Xms1g -Xmx1g -XX:MaxDirectMemorySize=1g"
28+
export PULSAR_STANDALONE_USE_ZOOKEEPER=1
29+
2730
if [[ -f /.dockerenv ]]; then
2831
# When running tests inside docker
2932
PULSAR_ADMIN=/pulsar/bin/pulsar-admin
@@ -38,6 +41,8 @@ else
3841
-p 6650:6650 \
3942
-p 8443:8443 \
4043
-p 6651:6651 \
44+
-e PULSAR_MEM=${PULSAR_MEM} \
45+
-e PULSAR_STANDALONE_USE_ZOOKEEPER=${PULSAR_STANDALONE_USE_ZOOKEEPER} \
4146
${IMAGE_NAME} \
4247
/pulsar/bin/pulsar standalone \
4348
--no-functions-worker --no-stream-storage

‎scripts/run-ci-blue-green-cluster.sh‎

Lines changed: 30 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -16,7 +16,34 @@
1616
# specific language governing permissions and limitations
1717
# under the License.
1818

19-
set -e -x
19+
set -x
2020

21-
go test -race -coverprofile=/tmp/coverage-blue_green_topic_migration -timeout=5m -tags extensible_load_manager -v -run TestBlueGreenMigrationTestSuite ./pulsar
22-
go tool cover -html=/tmp/coverage-blue_green_topic_migration -o coverage-blue_green_topic_migration.html
21+
TEST_LOG=/tmp/test-log-$(date +%s).log
22+
23+
# Default values for test configuration
24+
: "${TEST_RACE:=1}"
25+
: "${TEST_COVERAGE:=0}"
26+
27+
# Build the test command dynamically
28+
TEST_CMD="go test"
29+
if [ "$TEST_RACE" = "1" ]; then
30+
TEST_CMD="$TEST_CMD -race"
31+
fi
32+
if [ "$TEST_COVERAGE" = "1" ]; then
33+
TEST_CMD="$TEST_CMD -coverprofile=/tmp/coverage-blue_green_topic_migration"
34+
fi
35+
TEST_CMD="$TEST_CMD -timeout=5m -tags extensible_load_manager -v -run TestBlueGreenMigrationTestSuite ./pulsar"
36+
37+
$TEST_CMD 2>&1 | tee $TEST_LOG
38+
retval=$?
39+
if [ $retval -ne 0 ]; then
40+
# Make it easier to find out which test failed
41+
echo "Tests failed"
42+
grep -- "--- FAIL: " $TEST_LOG
43+
exit $retval
44+
else
45+
echo "Tests passed"
46+
if [ "$TEST_COVERAGE" = "1" ]; then
47+
go tool cover -html=/tmp/coverage-blue_green_topic_migration -o coverage-blue_green_topic_migration.html
48+
fi
49+
fi

0 commit comments

Comments
 (0)