airbyte-ci: bust java build cache to fix vulnerabilities #39321
Conversation
|
The latest updates on your projects. Learn more about Vercel for Git ↗︎ 1 Ignored Deployment
|
|
This stack of pull requests is managed by Graphite. Learn more about stacking. Join @alafanechere and the rest of your teammates on |
alafanechere
force-pushed
the
augustin/06-06-airbyte-ci_bust_java_build_cache_to_fix_vulnerabilities
branch
from
f8b06ac to
fcd4686
Compare
alafanechere
force-pushed
the
augustin/06-06-airbyte-ci_bust_java_build_cache_to_fix_vulnerabilities
branch
from
fcd4686 to
c1fcb96
Compare
alafanechere
deleted the
augustin/06-06-airbyte-ci_bust_java_build_cache_to_fix_vulnerabilities
branch
| "yum update -y", | ||
| "yum update -y --security", |
There was a problem hiding this comment.
Does this update less things (only security) or more things (whatever we updated before AND security)?
There was a problem hiding this comment.
@evantahler It updates less things (only security):
The --security parameter is important. Without it, yum update installs all updates, including bug fixes and enhancements.
(source)
There was a problem hiding this comment.
But don't we want all the updates?
There was a problem hiding this comment.
I'm not sure, I think I prefer to know that only the security patches might lead to system library version change. The less versions change the less surprises, isn't it?
|
Should we re-build everything and re-publish patch versions of every java connector to clean out the vulnerabilities? Any good way to automate it? /cc @wennergr |
What
The
yum updatecommand occuring the java connector build pipeline is cached by dagger.This prevents benefittng from updated system packages which might get fixed vulnerabilities.
How
Bust the
yum updatelayer on a daily basis.Pre-release
source-postgresto check if less vulnerabilities are in a version with a freshyum updateResults
grype airbyte/source-postgres:latestgrype airbyte/source-postgres:3.4.13-dev.fcd46868deSounds like a win 🎉