From 946d43f97a51590179659293db858b50f971c8d2 Mon Sep 17 00:00:00 2001 From: Richard Wall Date: Thu, 22 Oct 2026 12:35:45 +0000 Subject: [PATCH] Upgrade Go to 1.27.3 to fix GO-2026-6809 - The nightly govulncheck fails on master: Go 1.27.2 is affected by GO-2026-6809 in crypto/x509, which the agent reaches through client.NGTSClient.PostDataReadingsWithOptions. - make upgrade-klone picks up Go 1.27.3 from cert-manager/makefile-modules#781, plus new base-static and base-static-csi digests and minor tool bumps. Co-Authored-By: Claude Signed-off-by: Richard Wall --- klone.yaml | 22 +++++++++++----------- make/_shared/oci-build/00_mod.mk | 4 ++-- make/_shared/tools/00_mod.mk | 26 +++++++++++++------------- 3 files changed, 26 insertions(+), 26 deletions(-) diff --git a/klone.yaml b/klone.yaml index e8aa57e3..2d7540f3 100644 --- a/klone.yaml +++ b/klone.yaml @@ -10,55 +10,55 @@ targets: - folder_name: generate-verify repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/generate-verify - folder_name: go repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/go - folder_name: helm repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/helm - folder_name: help repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/help - folder_name: kind repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/kind - folder_name: klone repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/klone - folder_name: licenses repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/licenses - folder_name: oci-build repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/oci-build - folder_name: oci-publish repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/oci-publish - folder_name: repository-base repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/repository-base - folder_name: tools repo_url: https://github.com/cert-manager/makefile-modules.git repo_ref: main - repo_hash: 652e78728e713e8895d7fa755c7aa096911a18eb + repo_hash: 7d4704c80a09d46e1ebf5d6dfd656f758da5cd0f repo_path: modules/tools diff --git a/make/_shared/oci-build/00_mod.mk b/make/_shared/oci-build/00_mod.mk index d09e64f3..93a07226 100644 --- a/make/_shared/oci-build/00_mod.mk +++ b/make/_shared/oci-build/00_mod.mk @@ -14,11 +14,11 @@ # Use distroless as minimal base image to package the manager binary # To get latest SHA run "crane digest quay.io/jetstack/base-static:latest" -base_image_static := quay.io/jetstack/base-static@sha256:516427682e450b65d12d884079d94b3247808940e4538af9246d1ec90d0d073f +base_image_static := quay.io/jetstack/base-static@sha256:925dd97b8d8cc5a2cda58ca3c82b6ab8f69a9fc2fe7521c2ce4f5c12d4197ac0 # Use custom apko-built image as minimal base image to package the manager binary # To get latest SHA run "crane digest quay.io/jetstack/base-static-csi:latest" -base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:b4c561613d6060ecb7103be4004d8cc952c14381b15549a3fb0c0960b0d78e69 +base_image_csi-static := quay.io/jetstack/base-static-csi@sha256:20af22b55b05ef87aad6355836eac6afbafa22e6831a2269265418dd7549fbfb # Utility functions fatal_if_undefined = $(if $(findstring undefined,$(origin $1)),$(error $1 is not set)) diff --git a/make/_shared/tools/00_mod.mk b/make/_shared/tools/00_mod.mk index 833f647b..fd39dd1f 100644 --- a/make/_shared/tools/00_mod.mk +++ b/make/_shared/tools/00_mod.mk @@ -32,7 +32,7 @@ export GOVENDOR_DIR ?= $(default_shared_dir)/go_vendor # https://go.dev/dl/ # renovate: datasource=golang-version packageName=go -VENDORED_GO_VERSION := 1.27.2 +VENDORED_GO_VERSION := 1.27.3 $(bin_dir)/tools $(DOWNLOAD_DIR)/tools: @mkdir -p $@ @@ -82,7 +82,7 @@ tools += kubectl=v1.37.1 tools += kind=v0.33.0 # https://www.vaultproject.io/downloads # renovate: datasource=github-releases packageName=hashicorp/vault -tools += vault=v2.1.1 +tools += vault=v2.1.2 # https://github.com/Azure/azure-workload-identity/releases # renovate: datasource=github-releases packageName=Azure/azure-workload-identity tools += azwi=v1.6.3 @@ -126,7 +126,7 @@ tools += go-licenses=v2.0.0-20250821024731-e4be79958780 tools += gotestsum=v1.13.0 # https://pkg.go.dev/sigs.k8s.io/kustomize/kustomize/v5?tab=versions # renovate: datasource=go packageName=sigs.k8s.io/kustomize/kustomize/v5 -tools += kustomize=v5.8.2 +tools += kustomize=v5.8.3 # https://pkg.go.dev/github.com/itchyny/gojq?tab=versions # renovate: datasource=go packageName=github.com/itchyny/gojq tools += gojq=v0.12.19 @@ -163,7 +163,7 @@ tools += klone=v0.3.0 tools += goreleaser=v2.18.2 # https://pkg.go.dev/github.com/anchore/syft/cmd/syft?tab=versions # renovate: datasource=go packageName=github.com/anchore/syft -tools += syft=v1.54.0 +tools += syft=v1.54.1 # https://github.com/cert-manager/helm-tool/releases # renovate: datasource=github-releases packageName=cert-manager/helm-tool tools += helm-tool=v0.6.0 @@ -225,7 +225,7 @@ tools += defaulter-gen=$(K8S_CODEGEN_VERSION) tools += conversion-gen=$(K8S_CODEGEN_VERSION) # https://github.com/kubernetes/kube-openapi # renovate: datasource=go packageName=k8s.io/kube-openapi -tools += openapi-gen=v0.0.0-20261001230523-97fa35140926 +tools += openapi-gen=v0.0.0-20261007072838-e2e80c32a35f # https://raw.githubusercontent.com/kubernetes-sigs/controller-tools/master/envtest-releases.yaml # FIXME: Find a way to configure Renovate to suggest upgrades @@ -527,10 +527,10 @@ $(foreach tool_name,$(tool_names),$(eval $(call tool_link_defs,$(tool_name)))) # File downloads # ################## -go_linux_amd64_SHA256SUM=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 -go_linux_arm64_SHA256SUM=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8 -go_darwin_amd64_SHA256SUM=587b59182488b23aa6e5fc25110405a3e0e5b38ed2f5b2f46ed13c32aee356fe -go_darwin_arm64_SHA256SUM=76812b213b1b2302c978d28fa52fa92d541704b9e7d9d5db8002c50e4018c4c5 +go_linux_amd64_SHA256SUM=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 +go_linux_arm64_SHA256SUM=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49 +go_darwin_amd64_SHA256SUM=b6f8e931e4ab497fcde6da8ae4499a58f9d258e55c8a80824a516eae5950a750 +go_darwin_arm64_SHA256SUM=dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2 .PRECIOUS: $(DOWNLOAD_DIR)/tools/go@$(VENDORED_GO_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz $(DOWNLOAD_DIR)/tools/go@$(VENDORED_GO_VERSION)_$(HOST_OS)_$(HOST_ARCH).tar.gz: | $(DOWNLOAD_DIR)/tools @@ -596,10 +596,10 @@ $(DOWNLOAD_DIR)/tools/kind@$(KIND_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD $(checkhash_script) $(outfile) $(kind_$(HOST_OS)_$(HOST_ARCH)_SHA256SUM); \ chmod +x $(outfile) -vault_linux_amd64_SHA256SUM=8aa90f9cea46f541fc7baa3d0ec692fc06afde9a248cc1f2dcac46a567c6f56b -vault_linux_arm64_SHA256SUM=c2c74e111ffbc83b3d29c6f0c0215a5e53d738c9fad045f7797bcdcde3156067 -vault_darwin_amd64_SHA256SUM=1310ccba498a08fa9bfe09c698f54f38b6d9c2ae45bae08cf91f02bc10d295b6 -vault_darwin_arm64_SHA256SUM=95d100472b726d889ee380c9335191abdf5b3e6f3108cde48f4f962bfea4f009 +vault_linux_amd64_SHA256SUM=873bbdac35ca4b0c3e2886c41991ca1272fc452826208d5499f32d12cd2e76e1 +vault_linux_arm64_SHA256SUM=57c0c4d2f8c1694b18f26f922eca40e472355934dca2f3bd63f415042d1898ed +vault_darwin_amd64_SHA256SUM=8a057a4e005113223f2d479a13ff6d9a781e9145db0327270c94d3ff14ed2af7 +vault_darwin_arm64_SHA256SUM=bdd5a4b5d4b5afe7a79ce629e41ddca6480068df8fe1d74665e681b27abd8001 .PRECIOUS: $(DOWNLOAD_DIR)/tools/vault@$(VAULT_VERSION)_$(HOST_OS)_$(HOST_ARCH) $(DOWNLOAD_DIR)/tools/vault@$(VAULT_VERSION)_$(HOST_OS)_$(HOST_ARCH): | $(DOWNLOAD_DIR)/tools