Skip to content

build(deps): Bump github.com/btcsuite/btcd from 0.21.0-beta to 0.23.1#87

Closed
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/github.com/btcsuite/btcd-0.23.1
Closed

build(deps): Bump github.com/btcsuite/btcd from 0.21.0-beta to 0.23.1#87
dependabot[bot] wants to merge 1 commit intomasterfrom
dependabot/go_modules/github.com/btcsuite/btcd-0.23.1

Conversation

@dependabot
Copy link

@dependabot dependabot bot commented on behalf of github Jun 8, 2022 •
edited
Loading

Bumps github.com/btcsuite/btcd from 0.21.0-beta to 0.23.1.

Release notes

Sourced from github.com/btcsuite/btcd's releases.

btcd v0.22.0-beta

This release of btcd is primarily to act as a catchup for the various changes that have accumulated.

Verifying the Release

In order to verify the release, you'll need to have gpg or gpg2 installed on your system. Once you've obtained a copy (and hopefully verified that as well), you'll first need to import the keys that have signed this release if you haven't done so already:

Once you have the required PGP keys, you can verify the release (assuming manifest-v0.22.0-beta.txt and manifest-v0.22.0-beta.txt.sig are in the current directory) with:

gpg --verify manifest-v0.22.0-beta.txt.sig

You should see the following if the verification was successful:

gpg: assuming signed data in 'manifest-v0.22.0-beta.txt'
gpg: Signature made Tue 08 Jun 2021 10:07:53 AM EDT
gpg:                using DSA key 0DB39EAF526568682088EEDFB15210D35378BD54
gpg: Good signature from "John C. Vernaleo <john@netpurgatory.com>" [ultimate]

That will verify the signature of the manifest file, which ensures integrity and authenticity of the archive you've downloaded locally containing the binaries. Next, depending on your operating system, you should then re-compute the sha256 hash of the archive with shasum -a 256 <filename>, compare it with the corresponding one in the manifest file, and ensure they match exactly.

Verifying the Release Binaries

As of this release, our release binaries are fully reproducible thanks to go1.13! Third parties are now able to verify that the release binaries were produced properly without having to trust the release manager(s). See our reproducible builds guide for how this can be achieved. The release binaries are compiled with go1.16.5, which is required by verifiers to arrive at the same ones.

Finally, you can also verify the tag itself with the following command:

git verify-tag v0.22.0-beta

You should see something along the lines of this in the case of a valid tag:

gpg: Signature made Tue 08 Jun 2021 09:42:52 AM EDT
gpg:                using DSA key 0DB39EAF526568682088EEDFB15210D35378BD54
gpg: Good signature from "John C. Vernaleo <john@netpurgatory.com>" [ultimate]

Building the Contained Release

Users are able to rebuild the target release themselves without having to fetch any of the dependencies. In order to do so, assuming that vendor.tar.gz and btcd-source-v0.22.0-beta.tar.gz are in the current directory, follow these steps:

tar -xvzf vendor.tar.gz
tar -xvzf btcd-source-v0.22.0.tar.gz
GO111MODULE=on go install -v -mod=vendor
GO111MODULE=on go install -v -mod=vendor ./cmd/btcctl
</tr></table>

... (truncated)

Commits
  • 04aac1e Merge pull request #1863 from Roasbeef/version-bump-23-1
  • e6f6ba4 build: bump version to v0.23.1
  • 8fc2d70 Merge pull request #1862 from bhandras/rpccliet-fix2
  • 1696c63 Merge pull request #1844 from chappjc/getnewaddress-rpcclient-revert
  • b2af777 rpcclient: fix missing return
  • b5fb9b0 Merge pull request #1860 from Roasbeef/version-bump-23
  • 2ce3069 build: bump version to v0.23.0
  • fd7f41c Merge pull request #1840 from ellemouton/exportCheckStandardnessFunc
  • cee92e0 Merge pull request #1856 from bhandras/rpcclient-fix
  • 97313ac rpcclient: save the last error when retrying
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Jun 8, 2022

Dependabot tried to add @melekes and @tessr as reviewers to this PR, but received the following error from GitHub:

POST https://api.github.com/repos/heliaxdev/tendermint/pulls/87/requested_reviewers: 422 - Reviews may only be requested from collaborators. One or more of the users or teams you specified is not a collaborator of the heliaxdev/tendermint repository. // See: https://docs.github.com/rest/reference/pulls#request-reviewers-for-a-pull-request

@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Jun 8, 2022

The following labels could not be found: T:dependencies.

@dependabot dependabot bot mentioned this pull request Jun 8, 2022
Closed
@dependabot
build(deps): Bump github.com/btcsuite/btcd from 0.21.0-beta to 0.23.1
2d7aae9 
Bumps [github.com/btcsuite/btcd](https://github.com/btcsuite/btcd) from 0.21.0-beta to 0.23.1.
- [Release notes](https://github.com/btcsuite/btcd/releases)
- [Changelog](https://github.com/btcsuite/btcd/blob/master/CHANGES)
- [Commits](btcsuite/btcd@v0.21.0-beta...v0.23.1)

---
updated-dependencies:
- dependency-name: github.com/btcsuite/btcd
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
@dependabot dependabot bot force-pushed the dependabot/go_modules/github.com/btcsuite/btcd-0.23.1 branch from 4f7b647 to 2d7aae9 Compare July 28, 2022 08:01
@tzemanovic tzemanovic closed this Jul 28, 2022
@dependabot @github
Copy link
Author

dependabot bot commented on behalf of github Jul 28, 2022

OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting @dependabot ignore this major version or @dependabot ignore this minor version. You can also ignore all major, minor, or patch releases for a dependency by adding an ignore condition with the desired update_types to your config file.

If you change your mind, just re-open this PR and I'll resolve any conflicts on it.

@dependabot dependabot bot deleted the dependabot/go_modules/github.com/btcsuite/btcd-0.23.1 branch July 28, 2022 08:09
adrianbrink pushed a commit that referenced this pull request May 23, 2023
@jmalicevic
p2p:prevent adding peers who have errored (backport tendermint#9500) (#…
e3b54fd 
…216)

* security/p2p: prevent peers who errored being added to the peer_set (backport tendermint#9500) (#87)

* security/p2p: prevent peers who errored being added to the peer_set (tendermint#9500)

* Mark failed removal of peer to address security bug

* Added p2p bugfix
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@tzemanovic