Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

chore(deps): update dependency stacklok/minder to v0.0.65 #7634

Merged
merged 1 commit into from
Oct 10, 2024
Merged

chore(deps): update dependency stacklok/minder to v0.0.65 #7634

merged 1 commit into from
Oct 10, 2024

Conversation

uniget-bot
Copy link

This PR contains the following updates:

Package Update Change
stacklok/minder patch 0.0.64 -> 0.0.65

Warning

Some dependencies could not be looked up. Check the Dependency Dashboard for more information.

Release Notes

stacklok/minder (stacklok/minder)

v0.0.65

Compare Source

What's Changed

Full Changelog: mindersec/minder@v0.0.64...v0.0.65

Configuration

📅 Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

♻ Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.

  • If you want to rebase/retry this PR, check this box

This PR has been generated by Renovate Bot.

nicholasdille-bot
nicholasdille-bot approved these changes Oct 10, 2024
View reviewed changes
Copy link

@nicholasdille-bot nicholasdille-bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Auto-approved because label type/renovate is present.

@github-actions GitHub Actions
Copy link

🔍 Vulnerabilities of ghcr.io/uniget-org/tools/minder:0.0.65

📦 Image Reference ghcr.io/uniget-org/tools/minder:0.0.65
digestsha256:c1b7bb6e16b27867ab0f7a87bc2f26ac8b63ff09a6d8ca5f62d4a9aff79533cb
vulnerabilitiescritical: 0 high: 1 medium: 0 low: 0
platformlinux/amd64
size25 MB
packages213
critical: 0 high: 1 medium: 0 low: 0 github.com/theupdateframework/go-tuf 0.7.0 (golang)

pkg:golang/github.com/theupdateframework/go-tuf@0.7.0

high 7.5: CVE--2024--47534 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Affected range<2.0.1
Fixed version2.0.1
CVSS Score7.5
CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Description

During the ongoing work on the TUF conformance test suite, we have come across a test that reveals what we believe is a bug in go-tuf with security implications. The bug exists in go-tuf delegation tracing and could result in downloading the wrong artifact.

We have come across this issue in the test in this PR: theupdateframework/tuf-conformance#115.

The test - test_graph_traversal - sets up a repository with a series of delegations, invokes the clients refresh() and then checks the order in which the client traced the delegations. The test shows that the go-tuf client inconsistently traces the delegations in a wrong way. For example, during one CI run, the two-level-delegations test case triggered a wrong order. The delegations in this look as such:

"two-level-delegations": DelegationsTestCase(
        delegations=[
            DelegationTester("targets", "A"),
            DelegationTester("targets", "B"),
            DelegationTester("B", "C"),
        ],
        visited_order=["A", "B", "C"],
    ),

Here, targets delegate to "A", and to "B", and "B" delegates to "C". The client should trace the delegations in the order "A" then "B" then "C" but in this particular CI run, go-tuf traced the delegations "B"->"C"->"A".

In a subsequent CI run, this test case did not fail, but another one did.

@jku has done a bit of debugging and believes that the returned map of GetRolesForTarget returns a map that causes this behavior:

https://github.com/theupdateframework/go-tuf/blob/f95222bdd22d2ac4e5b8ed6fe912b645e213c3b5/metadata/metadata.go#L565-L580

We believe that this map should be an ordered list instead of a map.

@github-actions GitHub Actions
Copy link

Attempting automerge. See https://github.com/uniget-org/tools/actions/runs/11270463825.

@github-actions GitHub Actions
Copy link

PR is clean and can be merged. See https://github.com/uniget-org/tools/actions/runs/11270463825.

@github-actions github-actions bot merged commit dd9f419 into main Oct 10, 2024
9 of 10 checks passed
@github-actions github-actions bot deleted the renovate/stacklok-minder-0.0.x branch October 10, 2024 08:38
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@nicholasdille-bot nicholasdille-bot nicholasdille-bot approved these changes

Assignees
No one assigned
Labels
bump/patch type/renovate
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
3 participants
@uniget-bot @nicholasdille-bot @renovate-bot