Bug 2375610
| Summary: | inspektor-gadget: mapstructure May Leak Sensitive Information [fedora-41] | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Jon Moroney <jmoroney> |
| Component: | inspektor-gadget | Assignee: | Kyle Gospodnetich <me> |
| Status: | CLOSED COMPLETED | QA Contact: | |
| Severity: | medium | Docs Contact: | |
| Priority: | medium | ||
| Version: | 41 | CC: | flaniel+fedora, go-sig, me, mfindra |
| Target Milestone: | --- | Keywords: | Security, SecurityTracking |
| Target Release: | --- | ||
| Hardware: | Unspecified | ||
| OS: | Unspecified | ||
| Whiteboard: | {"flaws": ["5f70f277-9842-4277-a0b6-f0c6634c3f05"]} | ||
| Fixed In Version: | Doc Type: | --- | |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2025-07-04 04:16:56 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
| Bug Depends On: | |||
| Bug Blocks: | 2375247, 2390114, 2391829, 2384095 | ||
|
Description
Jon Moroney
2025-06-30 17:22:22 UTC
I fixed this upstream: https://github.com/inspektor-gadget/inspektor-gadget/commit/a1c63e607b9a20b621bdb9741aa042a83d90ca45 And I have the following patch ready for rawhide, f42 and f41: ``` commit c620647ad9bee27398e7fe704ff7bb08b07f1b2a (HEAD -> f41) Author: Francis Laniel <flaniel.com> Date: Tue Jul 1 14:46:39 2025 +0700 inspektor-gadget: Bump github.com/go-viper/mapstructure/v2 to v2.3.0. Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=2375610 Signed-off-by: Francis Laniel <flaniel.com> diff --git a/README.md b/README.md index 795913d..9d43dfa 100644 --- a/README.md +++ b/README.md @@ -155,3 +155,37 @@ $ fedpkg update --type enhancement --notes "Update to v0.38.0" Congratulations! You successfully bumped Inspektor Gadget Fedora package! + +## Handling CVE in dependencies + +In case there is a CVE in dependency which was fixed upstream, we need to update the vendor archive. +Hopefully, [`go_vendor_archive`](https://fedora.gitlab.io/sigs/go/go-vendor-tools/scenarios/#security-updates) already handles this. +Let's take the real example of `github.com/go-viper/mapstructure/v2`: + +```bash +$ go_vendor_archive override --config go-vendor-tools.toml github.com/go-viper/mapstructure/v2 v2.3.0 +# go-vendor-tools was updated to use v2.3.0 instead: +$ git diff +diff --git a/go-vendor-tools.toml b/go-vendor-tools.toml +index bc94737..05214fb 100644 +--- a/go-vendor-tools.toml ++++ b/go-vendor-tools.toml +@@ -1,5 +1,7 @@ + [archive] + ++[archive.dependency_overrides] ++"github.com/go-viper/mapstructure/v2" = "v2.3.0" + [[licensing.licenses]] + path = "LICENSE-bpf.txt" + sha256sum = "7a83d7bd42c0c13bb77d9b4e76a08d3aa8b0ca71189573ddc8bb1d06d094abf0" +# Now, let's create the archive with this version of the dependency: +$ go_vendor_archive create --config go-vendor-tools.toml inspektor-gadget.spec +... +$ go get github.com/go-viper/mapstructure/v2.0 +go: upgraded github.com/go-viper/mapstructure/v2 v2.2.1 => v2.3.0 +$ go mod tidy +$ go mod vendor +Creating archive... +``` + +The archive was updated, you can now continue by uploading it with `fedpkg new-sources` and continue as usual. diff --git a/go-vendor-tools.toml b/go-vendor-tools.toml index bc94737..05214fb 100644 --- a/go-vendor-tools.toml +++ b/go-vendor-tools.toml @@ -1,5 +1,7 @@ [archive] +[archive.dependency_overrides] +"github.com/go-viper/mapstructure/v2" = "v2.3.0" [[licensing.licenses]] path = "LICENSE-bpf.txt" sha256sum = "7a83d7bd42c0c13bb77d9b4e76a08d3aa8b0ca71189573ddc8bb1d06d094abf0" diff --git a/sources b/sources index 345b33c..0cc0436 100644 --- a/sources +++ b/sources @@ -1,2 +1,2 @@ SHA512 (inspektor-gadget-0.39.0.tar.gz) = 6979fe327fb1de2cc0aa973424cfbf9bfc9169ee52e59f95560eba0ffc1b2d7c2a3013a9a7cf9cedd1e95ea14a60c74240c501ac95b32deeba565a73b7c680c4 -SHA512 (inspektor-gadget-0.39.0-vendor.tar.xz) = bb559834f09793e5fb40fb76fc29fcb80146385f76c2bac50ad0425c06f3631a47317dc7951bc6090bb3a43b7455f05d49c691d32c71c43aa2fda5eb993b994d +SHA512 (inspektor-gadget-0.39.0-vendor.tar.xz) = b4bcb68e7efb0d98db1f2766dca7ec4cf4464ecbea312c154bcb3f455460a45863c92b69193f106d822bd8356f2b19aebe9bf6000a35140b59082748fe0646d9 ``` For now, I cannot push the changes because I get a 500 due to the following outage: https://status.fedoraproject.org/ But I will continue proceeding once everything is resolved there. Closing now, as the infrastructure move finished, I was able to push the commit and triggered the build: https://src.fedoraproject.org/rpms/inspektor-gadget/c/c620647ad9bee27398e7fe704ff7bb08b07f1b2a?branch=f41 https://koji.fedoraproject.org/koji/buildinfo?buildID=2740973 *** Bug 2399718 has been marked as a duplicate of this bug. *** *** Bug 2399700 has been marked as a duplicate of this bug. *** *** Bug 2390850 has been marked as a duplicate of this bug. *** *** Bug 2384145 has been marked as a duplicate of this bug. *** *** Bug 2390871 has been marked as a duplicate of this bug. *** *** Bug 2384145 has been marked as a duplicate of this bug. *** *** Bug 2390850 has been marked as a duplicate of this bug. *** *** Bug 2390871 has been marked as a duplicate of this bug. *** |