Skip to content

Commit 01e8950

Browse files
labrenbelabrenbe
committed
Merge remote-tracking branch 'origin/main' into feature/superset-opa-integration
2 parents e387df6 + acb678d commit 01e8950

File tree

6 files changed

+57
-18
lines changed

6 files changed

+57
-18
lines changed

‎.scripts/upload_new_jmx_exporter_version.sh‎

Lines changed: 11 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -23,29 +23,28 @@ fi
2323

2424
# deletes the temp directory
2525
function cleanup {
26-
rm -rf "$WORK_DIR"
26+
rm -rf "$WORK_DIR"
2727
}
2828

2929
# register the cleanup function to be called on the EXIT signal
3030
trap cleanup EXIT
3131

3232
cd "$WORK_DIR" || exit
3333

34-
src_file=jmx_prometheus-$VERSION-src.tar.gz
34+
JAR_FILE="jmx_prometheus_javaagent-$VERSION.jar"
35+
SUM_FILE="$JAR_FILE.sha256"
3536

36-
# JMX Exporter does not currently publish signatures or SBOMs (as of 2023-07-24, latest version at this point 0.19.0)
3737
echo "Downloading JMX Exporter"
38-
# JMX Exporter provides no offficial source tarballs, download from Git
39-
git clone https://github.com/prometheus/jmx_exporter "jmx_prometheus-${VERSION}" "--branch=${VERSION}" --depth=1
38+
curl --fail -LOs "https://github.com/prometheus/jmx_exporter/releases/download/$VERSION/$JAR_FILE"
39+
curl --fail -LOs "https://github.com/prometheus/jmx_exporter/releases/download/$VERSION/$SUM_FILE"
4040

41-
echo "Archiving JMX Exporter"
42-
git -C "jmx_prometheus-${VERSION}" archive "${VERSION}" --format=tar.gz --prefix="jmx_prometheus-${VERSION}-src/" > "${src_file}"
43-
sha256sum "${src_file}" | cut --delimiter=' ' --field=1 > "${src_file}.sha256"
41+
# Check that sha256 sum matches before uploading
42+
sha256sum --check --status "$SUM_FILE" && echo "SHA256 Sum matches"
4443

4544
echo "Uploading to Nexus"
46-
curl --fail -u "$NEXUS_USER:$NEXUS_PASSWORD" --upload-file "${src_file}" 'https://repo.stackable.tech/repository/packages/jmx-exporter/'
47-
curl --fail -u "$NEXUS_USER:$NEXUS_PASSWORD" --upload-file "${src_file}.sha256" 'https://repo.stackable.tech/repository/packages/jmx-exporter/'
45+
curl --fail -u "$NEXUS_USER:$NEXUS_PASSWORD" --upload-file "$JAR_FILE" 'https://repo.stackable.tech/repository/packages/jmx-exporter/'
46+
curl --fail -u "$NEXUS_USER:$NEXUS_PASSWORD" --upload-file "$SUM_FILE" 'https://repo.stackable.tech/repository/packages/jmx-exporter/'
4847

49-
echo "Successfully uploaded new version of JMX Exporter ($VERSION) to Nexus"
48+
echo "Successfully uploaded new version of the JMX Exporter ($VERSION) Jar to Nexus"
5049
echo "https://repo.stackable.tech/service/rest/repository/browse/packages/jmx-exporter/"
51-
echo "https://github.com/prometheus/jmx_exporter/releases/tag/parent-$VERSION"
50+
echo "https://github.com/prometheus/jmx_exporter/releases/tag/$VERSION"

‎CHANGELOG.md‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,8 @@ All notable changes to this project will be documented in this file.
1414
util-linux-core contains a basic set of Linux utilities, including the
1515
command logger which allows to enter messages into the system log.
1616
- vector: Add version 0.43.1 ([#980]).
17-
- opa: Add version 1.0.0 ([#981])
17+
- opa: Add version 1.0.0 ([#981]).
18+
- statsd-exporter: Bump version to 0.28.0 ([#982]).
1819

1920
### Removed
2021

@@ -24,6 +25,7 @@ All notable changes to this project will be documented in this file.
2425

2526
### Fixed
2627

28+
- druid: Fix CVE-2023-34455 in Druid `30.0.0` by deleting a dependency ([#935]).
2729
- hadoop: Fix the JMX exporter configuration for metrics suffixed with
2830
`_total`, `_info` and `_created` ([#962]).
2931

@@ -32,9 +34,11 @@ All notable changes to this project will be documented in this file.
3234
[#943]: https://github.com/stackabletech/docker-images/pull/943
3335
[#958]: https://github.com/stackabletech/docker-images/pull/958
3436
[#959]: https://github.com/stackabletech/docker-images/pull/959
37+
[#935]: https://github.com/stackabletech/docker-images/pull/935
3538
[#962]: https://github.com/stackabletech/docker-images/pull/962
3639
[#980]: https://github.com/stackabletech/docker-images/pull/980
3740
[#981]: https://github.com/stackabletech/docker-images/pull/981
41+
[#982]: https://github.com/stackabletech/docker-images/pull/982
3842

3943
## [24.11.1] - 2025-01-14
4044

‎airflow/versions.py‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,23 +3,23 @@
33
"product": "2.9.2",
44
"python": "3.9",
55
"git_sync": "v4.2.4",
6-
"statsd_exporter": "0.27.1",
6+
"statsd_exporter": "0.28.0",
77
"tini": "0.19.0",
88
"vector": "0.43.1",
99
},
1010
{
1111
"product": "2.9.3",
1212
"python": "3.9",
1313
"git_sync": "v4.2.4",
14-
"statsd_exporter": "0.27.1",
14+
"statsd_exporter": "0.28.0",
1515
"tini": "0.19.0",
1616
"vector": "0.43.1",
1717
},
1818
{
1919
"product": "2.10.2",
2020
"python": "3.12",
2121
"git_sync": "v4.2.4",
22-
"statsd_exporter": "0.27.1",
22+
"statsd_exporter": "0.28.0",
2323
"tini": "0.19.0",
2424
"vector": "0.43.1",
2525
},

‎druid/stackable/patches/30.0.0/10-cve-2023-34455-rm-snappy.patch‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
Fix CVE-2023-34455
2+
see https://github.com/stackabletech/vulnerabilities/issues/558
3+
4+
At the end of build process, Druid downloads dependencies directly from a remote
5+
Maven repository ignoring existing patches that have been applyed locally.
6+
These dependencies include all transitive dependencies too.
7+
The hadoop client depends on a vulnerable version of the snappy library which
8+
is then also downloaded even though a newer version is already on the system.
9+
10+
This patch removes the vulnerable jars.
11+
12+
diff --git a/distribution/pom.xml b/distribution/pom.xml
13+
index d5918710ef..2d5bfc6ab4 100644
14+
--- a/distribution/pom.xml
15+
+++ b/distribution/pom.xml
16+
@@ -259,6 +259,20 @@
17+
</arguments>
18+
</configuration>
19+
</execution>
20+
+ <execution>
21+
+ <id>fix-cve-2023-34455-remove-snappy</id>
22+
+ <phase>package</phase>
23+
+ <goals>
24+
+ <goal>exec</goal>
25+
+ </goals>
26+
+ <configuration>
27+
+ <executable>/usr/bin/rm</executable>
28+
+ <arguments>
29+
+ <argument>${project.build.directory}/hadoop-dependencies/hadoop-client-api/3.3.6/snappy-java-1.1.8.2.jar</argument>
30+
+ <argument>${project.build.directory}/hadoop-dependencies/hadoop-client-runtime/3.3.6/snappy-java-1.1.8.2.jar</argument>
31+
+ </arguments>
32+
+ </configuration>
33+
+ </execution>
34+
</executions>
35+
</plugin>
36+
<plugin>

‎statsd_exporter/versions.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
versions = [
22
{
3-
"product": "0.27.1",
3+
"product": "0.28.0",
44
"stackable-base": "1.0.0",
55
}
66
]

‎superset/versions.py‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@
33
"product": "4.0.2",
44
"python": "3.9",
55
"vector": "0.43.1",
6-
"statsd_exporter": "0.27.1",
6+
"statsd_exporter": "0.28.0",
77
"authlib": "1.2.1", # https://github.com/dpgaspar/Flask-AppBuilder/blob/release/4.4.1/requirements/extra.txt#L7
88
},
99
]

0 commit comments

Comments
 (0)