update to go1.23.6 by thaJeztah · Pull Request #340 · docker/docker-credential-helpers

thaJeztah · 2024-10-24T20:27:36Z

Makefile: set CGO_LDFLAGS=-latomic on arm/v6

Compiling with Go >= 1.22 on arm/v6 is failing with the following error
message:

27.84 gcc_libinit.c:44:8: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0 bytes) [-Werror,-Watomic-alignment]

For these Go versions, we need to manually link to libatomic as arm/v6
does not support atomic intrinsics and neither the CGo, nor the C
toolchain automatically link to that library.

update to go1.22.11 (fix CVE-2024-45341, CVE-2024-45336)

go1.22.11 (released 2025-01-16) includes security fixes to the crypto/x509 and
net/http packages, as well as bug fixes to the runtime. See the Go 1.22.11
milestone on our issue tracker for details.

Hello gophers,

We have just released Go versions 1.23.5 and 1.22.11, minor point releases.

These minor releases include 2 security fixes following the security policy:

crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints

A certificate with a URI which has a IPv6 address with a zone ID may
incorrectly satisfy a URI name constraint that applies to the certificate
chain.

Certificates containing URIs are not permitted in the web PKI, so this
only affects users of private PKIs which make use of URIs.

Thanks to Juho Forsén of Mattermost for reporting this issue.

This is CVE-2024-45341 and Go issue https://go.dev/issue/71156.
net/http: sensitive headers incorrectly sent after cross-domain redirect

The HTTP client drops sensitive headers after following a cross-domain redirect.
For example, a request to a.com/ containing an Authorization header which is
redirected to b.com/ will not send that header to b.com.

In the event that the client received a subsequent same-domain redirect, however,
the sensitive headers would be restored. For example, a chain of redirects from
a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization
header to b.com/2.

Thanks to Kyle Seely for reporting this issue.

This is CVE-2024-45336 and Go issue https://go.dev/issue/70530.

update to go1.23.6

- Description for the changelog

- A picture of a cute animal (not mandatory but encouraged)

codecov-commenter · 2024-10-24T20:29:27Z

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

docker-bake.hcl

thaJeztah · 2024-10-25T11:57:44Z

Looks like CGO is unhappy with some things;

 > [linux/amd64->arm/v6 build-linux 1/1] RUN --mount=type=bind,target=.     --mount=type=cache,target=/root/.cache     --mount=type=cache,target=/go/pkg/mod     --mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version     --mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT (set -ex...):
0.568 + make build-pass build-secretservice PACKAGE=github.com/docker/docker-credential-helpers VERSION=v0.8.2-6-gafc81a0 REVISION=afc81a08baa99a4edcb010b689b59620d9977137 DESTDIR=/out
0.595 go build -trimpath -ldflags="-s -w -X github.com/docker/docker-credential-helpers/credentials.Version=v0.8.2-6-gafc81a0 -X github.com/docker/docker-credential-helpers/credentials.Revision=afc81a08baa99a4edcb010b689b59620d9977137 -X github.com/docker/docker-credential-helpers/credentials.Package=github.com/docker/docker-credential-helpers -X github.com/docker/docker-credential-helpers/credentials.Name=docker-credential-pass" -o "/out/docker-credential-pass" ./pass/cmd/
25.69 go build -trimpath -ldflags="-s -w -X github.com/docker/docker-credential-helpers/credentials.Version=v0.8.2-6-gafc81a0 -X github.com/docker/docker-credential-helpers/credentials.Revision=afc81a08baa99a4edcb010b689b59620d9977137 -X github.com/docker/docker-credential-helpers/credentials.Package=github.com/docker/docker-credential-helpers -X github.com/docker/docker-credential-helpers/credentials.Name=docker-credential-secretservice" -o "/out/docker-credential-secretservice" ./secretservice/cmd/
27.84 # runtime/cgo
27.84 gcc_libinit.c:44:8: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.84 gcc_libinit.c:47:6: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.84 gcc_libinit.c:49:10: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.84 gcc_libinit.c:69:9: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.84 gcc_libinit.c:71:3: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.85 make: *** [Makefile:27: build-secretservice] Error 1

crazy-max · 2024-10-25T12:19:40Z

Looks like CGO is unhappy with some things;

 > [linux/amd64->arm/v6 build-linux 1/1] RUN --mount=type=bind,target=.     --mount=type=cache,target=/root/.cache     --mount=type=cache,target=/go/pkg/mod     --mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version     --mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT (set -ex...):
0.568 + make build-pass build-secretservice PACKAGE=github.com/docker/docker-credential-helpers VERSION=v0.8.2-6-gafc81a0 REVISION=afc81a08baa99a4edcb010b689b59620d9977137 DESTDIR=/out
0.595 go build -trimpath -ldflags="-s -w -X github.com/docker/docker-credential-helpers/credentials.Version=v0.8.2-6-gafc81a0 -X github.com/docker/docker-credential-helpers/credentials.Revision=afc81a08baa99a4edcb010b689b59620d9977137 -X github.com/docker/docker-credential-helpers/credentials.Package=github.com/docker/docker-credential-helpers -X github.com/docker/docker-credential-helpers/credentials.Name=docker-credential-pass" -o "/out/docker-credential-pass" ./pass/cmd/
25.69 go build -trimpath -ldflags="-s -w -X github.com/docker/docker-credential-helpers/credentials.Version=v0.8.2-6-gafc81a0 -X github.com/docker/docker-credential-helpers/credentials.Revision=afc81a08baa99a4edcb010b689b59620d9977137 -X github.com/docker/docker-credential-helpers/credentials.Package=github.com/docker/docker-credential-helpers -X github.com/docker/docker-credential-helpers/credentials.Name=docker-credential-secretservice" -o "/out/docker-credential-secretservice" ./secretservice/cmd/
27.84 # runtime/cgo
27.84 gcc_libinit.c:44:8: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.84 gcc_libinit.c:47:6: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.84 gcc_libinit.c:49:10: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.84 gcc_libinit.c:69:9: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.84 gcc_libinit.c:71:3: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
27.85 make: *** [Makefile:27: build-secretservice] Error 1

I think we need to set CGO_CFLAGS to -Wno-atomic-alignment

thaJeztah · 2025-01-20T15:42:43Z

Makefile

+# prevent warnings; see https://github.com/docker/docker-credential-helpers/pull/340#issuecomment-2437593837
+# gcc_libinit.c:44:8: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0  bytes) [-Werror,-Watomic-alignment]
+export CGO_CFLAGS = -Wno-atomic-alignment
+
 # 10.11 is the minimum supported version for osxkeychain
 export MACOSX_DEPLOYMENT_TARGET = 10.11
 ifeq "$(shell go env GOOS)" "darwin"
-	export CGO_CFLAGS = -mmacosx-version-min=$(MACOSX_DEPLOYMENT_TARGET)
+	export CGO_CFLAGS = $(CGO_CFLAGS) -mmacosx-version-min=$(MACOSX_DEPLOYMENT_TARGET)


Ah; that trick didn't work;

Makefile:19: *** Recursive variable `CGO_CFLAGS' references itself (eventually). Stop. mkdir -p ./bin Error: Process completed with exit code 2.

thaJeztah · 2025-01-20T15:51:26Z

booh; still no dice, but different error now 😢

mount=type=bind,source=/tmp/.version,target=/tmp/.version,from=version     --mount=type=bind,source=/tmp/.revision,target=/tmp/.revision,from=version <<EOT (set -ex...):
35.66 ld.lld: error: undefined symbol: __atomic_store_4
35.66 >>> referenced by gcc_libinit.c
35.66 >>>               /tmp/go-link-621867206/000007.o:(_cgo_wait_runtime_init_done)
35.66 >>> referenced by gcc_libinit.c
35.66 >>>               /tmp/go-link-621867206/000007.o:(x_cgo_notify_runtime_init_done)
35.66 >>> referenced by gcc_libinit.c
35.66 >>>               /tmp/go-link-621867206/000007.o:(x_cgo_set_context_function)
35.66 clang: error: linker command failed with exit code 1 (use -v to see invocation)
35.66 
35.69 make: *** [Makefile:31: build-secretservice] Error 1

thaJeztah · 2025-02-27T14:05:59Z

Pushed a commit to try what go1.23.6 does

Compiling with Go >= 1.22 on arm/v6 is failing with the following error message: 27.84 gcc_libinit.c:44:8: error: large atomic operation may incur significant performance penalty; the access size (4 bytes) exceeds the max lock-free size (0 bytes) [-Werror,-Watomic-alignment] For these Go versions, we need to manually link to libatomic as arm/v6 does not support atomic intrinsics and neither the CGo, nor the C toolchain automatically link to that library. Signed-off-by: Albin Kerouanton <albinker@gmail.com>

go1.22.11 (released 2025-01-16) includes security fixes to the crypto/x509 and net/http packages, as well as bug fixes to the runtime. See the Go 1.22.11 milestone on our issue tracker for details. - https://github.com/golang/go/issues?q=milestone%3AGo1.22.11+label%3ACherryPickApproved - full diff: golang/go@go1.22.10...go1.22.11 Hello gophers, We have just released Go versions 1.23.5 and 1.22.11, minor point releases. These minor releases include 2 security fixes following the security policy: - crypto/x509: usage of IPv6 zone IDs can bypass URI name constraints A certificate with a URI which has a IPv6 address with a zone ID may incorrectly satisfy a URI name constraint that applies to the certificate chain. Certificates containing URIs are not permitted in the web PKI, so this only affects users of private PKIs which make use of URIs. Thanks to Juho Forsén of Mattermost for reporting this issue. This is CVE-2024-45341 and Go issue https://go.dev/issue/71156. - net/http: sensitive headers incorrectly sent after cross-domain redirect The HTTP client drops sensitive headers after following a cross-domain redirect. For example, a request to a.com/ containing an Authorization header which is redirected to b.com/ will not send that header to b.com. In the event that the client received a subsequent same-domain redirect, however, the sensitive headers would be restored. For example, a chain of redirects from a.com/, to b.com/1, and finally to b.com/2 would incorrectly send the Authorization header to b.com/2. Thanks to Kyle Seely for reporting this issue. This is CVE-2024-45336 and Go issue https://go.dev/issue/70530. Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah

thanks @akerouanton ! I swapped the order of commits, and rebased

LGTM

thaJeztah self-assigned this Oct 24, 2024

thaJeztah force-pushed the bump_golang_1.22.8 branch from b2d6fb6 to 90b0f17 Compare October 25, 2024 11:48

crazy-max reviewed Oct 25, 2024

View reviewed changes

docker-bake.hcl Outdated Show resolved Hide resolved

thaJeztah force-pushed the bump_golang_1.22.8 branch from 90b0f17 to 28867b4 Compare October 25, 2024 11:58

thaJeztah force-pushed the bump_golang_1.22.8 branch from 28867b4 to c95aff6 Compare January 20, 2025 15:33

thaJeztah changed the title ~~update to go1.22.8~~ update to go1.22.11 (fix CVE-2024-45341, CVE-2024-45336) Jan 20, 2025

thaJeztah force-pushed the bump_golang_1.22.8 branch from c95aff6 to 680afe0 Compare January 20, 2025 15:40

thaJeztah commented Jan 20, 2025

View reviewed changes

thaJeztah force-pushed the bump_golang_1.22.8 branch from 680afe0 to 766d258 Compare January 20, 2025 15:44

thaJeztah force-pushed the bump_golang_1.22.8 branch from 766d258 to 098e63a Compare January 20, 2025 16:38

thaJeztah force-pushed the bump_golang_1.22.8 branch 2 times, most recently from a637ac3 to 26ce9a9 Compare February 27, 2025 14:05

thaJeztah marked this pull request as draft February 27, 2025 14:05

akerouanton and others added 3 commits February 27, 2025 23:39

update to go1.23.6

a767624

Signed-off-by: Sebastiaan van Stijn <github@gone.nl>

thaJeztah force-pushed the bump_golang_1.22.8 branch from 1236a71 to a767624 Compare February 27, 2025 22:40

thaJeztah changed the title ~~update to go1.22.11 (fix CVE-2024-45341, CVE-2024-45336)~~ update to go1.23.6 Feb 27, 2025

thaJeztah marked this pull request as ready for review February 27, 2025 22:42

thaJeztah commented Feb 27, 2025

View reviewed changes

dmcgowan approved these changes Feb 27, 2025

View reviewed changes

thaJeztah merged commit 4e957ec into docker:master Feb 27, 2025
12 checks passed

thaJeztah deleted the bump_golang_1.22.8 branch February 27, 2025 23:13

BrewTestBot mentioned this pull request Feb 28, 2025

docker-credential-helper 0.9.0 Homebrew/homebrew-core#209208

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

update to go1.23.6#340

update to go1.23.6#340
thaJeztah merged 3 commits intodocker:masterfrom
thaJeztah:bump_golang_1.22.8

thaJeztah commented Oct 24, 2024 •

edited

Loading

Uh oh!

codecov-commenter commented Oct 24, 2024 •

edited

Loading

Uh oh!

Uh oh!

thaJeztah commented Oct 25, 2024

Uh oh!

crazy-max commented Oct 25, 2024

Uh oh!

thaJeztah Jan 20, 2025

Uh oh!

thaJeztah commented Jan 20, 2025

Uh oh!

thaJeztah commented Feb 27, 2025

Uh oh!

thaJeztah left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

thaJeztah commented Oct 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Makefile: set CGO_LDFLAGS=-latomic on arm/v6

update to go1.22.11 (fix CVE-2024-45341, CVE-2024-45336)

update to go1.23.6

Uh oh!

codecov-commenter commented Oct 24, 2024 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

thaJeztah commented Oct 25, 2024

Uh oh!

crazy-max commented Oct 25, 2024

Uh oh!

thaJeztah Jan 20, 2025

Choose a reason for hiding this comment

Uh oh!

thaJeztah commented Jan 20, 2025

Uh oh!

thaJeztah commented Feb 27, 2025

Uh oh!

thaJeztah left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

thaJeztah commented Oct 24, 2024 •

edited

Loading

codecov-commenter commented Oct 24, 2024 •

edited

Loading