Skip to content

Commit d4ba5f9

Browse files
v1vv1v
authored
updatecli: microsoft security patches (#566)
1 parent fcb7726 commit d4ba5f9

File tree

5 files changed

+112
-3
lines changed

5 files changed

+112
-3
lines changed

‎.github/actions/bump-golang/action.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -36,7 +36,7 @@ runs:
3636
uses: updatecli/updatecli-action@92a13b95c2cd9f1c6742c965509203c6a5635ed7 # v2.68.0
3737

3838
- name: Run Updatecli in Apply mode
39-
run: updatecli ${{ env.COMMAND }} --config ./.github/updatecli.d/bump-golang.yml
39+
run: updatecli ${{ env.COMMAND }} --config ./.github/updatecli.d/
4040
env:
4141
COMMAND: ${{ inputs.command }}
4242
BRANCH: ${{ inputs.branch }}

‎.github/updatecli.d/bump-go-microsoft-version.sh

Lines changed: 40 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,40 @@
1+
#!/usr/bin/env bash
2+
#
3+
# Given the Golang microsoft version this script will bump the version.
4+
#
5+
# This script is executed by the automation we are putting in place
6+
#
7+
# Parameters:
8+
# $1 -> the Golang release version to be bumped. Mandatory.
9+
#
10+
set -euo pipefail
11+
MSG="parameter missing."
12+
GO_RELEASE_VERSION=${1:?$MSG}
13+
OS=$(uname -s| tr '[:upper:]' '[:lower:]')
14+
if [ "${OS}" == "darwin" ] ; then
15+
SED="sed -i .bck"
16+
else
17+
SED="sed -i"
18+
fi
19+
20+
MAJOR_MINOR_PATCH_VERSION=$(echo "$GO_RELEASE_VERSION" | sed -E -e "s#([0-9]+\.[0-9]+\.[0-9]+).*#\1#g")
21+
SECURITY_VERSION=$(echo "$GO_RELEASE_VERSION" | sed -E -e "s#([0-9]+\.[0-9]+\.[0-9]+)(.+)#\2#g")
22+
23+
# Gather microsoft/go sha256 values
24+
MSFT_DOWNLOAD_METADATA=$(curl -s -L https://aka.ms/golang/release/latest/go${MAJOR_MINOR_PATCH_VERSION}.assets.json)
25+
MSFT_DOWNLOAD_SHA256_ARM=$(echo $MSFT_DOWNLOAD_METADATA | jq -r ".arches[] | select( .env.GOOS == \"linux\") | select( .env.GOARCH == \"arm64\") | .sha256")
26+
MSFT_DOWNLOAD_SHA256_AMD=$(echo $MSFT_DOWNLOAD_METADATA | jq -r ".arches[] | select( .env.GOOS == \"linux\") | select( .env.GOARCH == \"amd64\") | .sha256")
27+
28+
echo "Update go version ${GO_RELEASE_VERSION}"
29+
30+
find "go" -type f -name Dockerfile.tmpl -print0 |
31+
while IFS= read -r -d '' line; do
32+
${SED} -E -e "s#(ARG GOLANG_VERSION)=[0-9]+\.[0-9]+(\.[0-9]+)?#\1=${MAJOR_MINOR_PATCH_VERSION}#g" "$line"
33+
if echo "$line" | grep -q 'arm' ; then
34+
${SED} -E -e "s#(ARG MSFT_DOWNLOAD_SHA256)=.+#\1=${MSFT_DOWNLOAD_SHA256_ARM}#g" "$line"
35+
${SED} -E -e "s#(ARG SECURITY_VERSION)=.+#\1=${SECURITY_VERSION}#g" "$line"
36+
else
37+
${SED} -E -e "s#(ARG MSFT_DOWNLOAD_SHA256)=.+#\1=${MSFT_DOWNLOAD_SHA256_AMD}#g" "$line"
38+
${SED} -E -e "s#(ARG SECURITY_VERSION)=.+#\1=${SECURITY_VERSION}#g" "$line"
39+
fi
40+
done

‎.github/updatecli.d/bump-microsoft.yml

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
---
2+
name: Bump golang-microsoft to latest version
3+
pipelineid: 'bump-golang-microsoft-version-{{ requiredEnv "BRANCH" }}'
4+
5+
scms:
6+
githubConfig:
7+
kind: github
8+
spec:
9+
user: '{{ requiredEnv "GITHUB_ACTOR" }}'
10+
username: '{{ requiredEnv "GITHUB_ACTOR" }}'
11+
owner: elastic
12+
repository: golang-crossbuild
13+
token: '{{ requiredEnv "GITHUB_TOKEN" }}'
14+
branch: '{{ requiredEnv "BRANCH" }}'
15+
commitusingapi: true
16+
17+
actions:
18+
default:
19+
title: '[Automation] Bump Microsoft version to {{ source "latestGoVersion" }}'
20+
kind: github/pullrequest
21+
scmid: githubConfig
22+
spec:
23+
automerge: true
24+
labels:
25+
- automation
26+
- dependencies
27+
- backport-skip
28+
description: |
29+
See https://github.com/microsoft/go/releases/v{{ source "latestGoVersion" }}
30+
31+
sources:
32+
minor:
33+
name: Get minor version
34+
kind: shell
35+
transformers:
36+
- findsubmatch:
37+
pattern: '^\d+.(\d+)'
38+
captureindex: 1
39+
spec:
40+
command: echo {{ requiredEnv "GO_MINOR" }}
41+
42+
latestGoVersion:
43+
name: Get Latest Go Release
44+
kind: githubrelease
45+
dependson:
46+
- minor
47+
transformers:
48+
- trimprefix: v
49+
spec:
50+
owner: microsoft
51+
repository: go
52+
token: '{{ requiredEnv "GITHUB_TOKEN" }}'
53+
username: '{{ requiredEnv "GITHUB_ACTOR" }}'
54+
versionfilter:
55+
kind: regex
56+
pattern: v1\.{{ source "minor" }}\.(\d*)-(\d*)$
57+
58+
targets:
59+
update-go-versions:
60+
name: 'Update go version {{ source "latestGoVersion" }}'
61+
kind: shell
62+
sourceid: latestGoVersion
63+
scmid: githubConfig
64+
spec:
65+
command: .github/updatecli.d/bump-go-microsoft-version.sh
66+
environments:
67+
- name: PATH

‎go/base-arm/Dockerfile.tmpl

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,8 @@ RUN \
5959

6060
ARG GOLANG_VERSION=1.24.1
6161
{{- if eq .FIPS "true"}}
62-
ARG GOLANG_DOWNLOAD_URL=https://aka.ms/golang/release/latest/go$GOLANG_VERSION.linux-arm64.tar.gz
62+
ARG SECURITY_VERSION=
63+
ARG GOLANG_DOWNLOAD_URL=https://aka.ms/golang/release/latest/go$GOLANG_VERSION$SECURITY_VERSION.linux-arm64.tar.gz
6364
# Use a different arg name for microsoft/go sha so it can be handled seperately from the regular golang sha
6465
ARG MSFT_DOWNLOAD_SHA256=73b1befea457d5967632b2b0b93f8d2c0d899d5b6fbd1396c55d0a015292608b
6566
ARG DOWNLOAD_SHA256=$MSFT_DOWNLOAD_SHA256

‎go/base/Dockerfile.tmpl

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,8 @@ RUN ln -s /usr/bin/pip3 /usr/bin/pip
3333

3434
ARG GOLANG_VERSION=1.24.1
3535
{{- if eq .FIPS "true"}}
36-
ARG GOLANG_DOWNLOAD_URL=https://aka.ms/golang/release/latest/go$GOLANG_VERSION.linux-amd64.tar.gz
36+
ARG SECURITY_VERSION=
37+
ARG GOLANG_DOWNLOAD_URL=https://aka.ms/golang/release/latest/go$GOLANG_VERSION$SECURITY_VERSION.linux-amd64.tar.gz
3738
# Use a different arg name for microsoft/go sha so it can be handled seperately from the regular golang sha
3839
ARG MSFT_DOWNLOAD_SHA256=b0ca85ecc435a93e2ddb626dd9ef7fb6689700a0847b0392eb3e146345a8dea0
3940
ARG DOWNLOAD_SHA256=$MSFT_DOWNLOAD_SHA256

0 commit comments

Comments
 (0)