diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 03e4b94b4..3f4c12f63 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,7 +28,7 @@ jobs: fail-fast: false matrix: pg: ['14', '15', '16', '17', '18', '19'] - go: ['1.23', '1.26'] + go: ['1.23', '1.27'] steps: - uses: 'actions/checkout@v6' - uses: 'actions/setup-go@v6' diff --git a/auth/kerberos/go.mod b/auth/kerberos/go.mod index 3c139e2f4..b57463a70 100644 --- a/auth/kerberos/go.mod +++ b/auth/kerberos/go.mod @@ -1,6 +1,6 @@ module github.com/lib/pq/auth/kerberos -go 1.21 +go 1.25.0 require ( github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e @@ -14,6 +14,6 @@ require ( github.com/jcmturner/gofork v1.7.6 // indirect github.com/jcmturner/goidentity/v6 v6.0.1 // indirect github.com/jcmturner/rpc/v2 v2.0.3 // indirect - golang.org/x/crypto v0.6.0 // indirect - golang.org/x/net v0.7.0 // indirect + golang.org/x/crypto v0.55.0 // indirect + golang.org/x/net v0.57.0 // indirect ) diff --git a/auth/kerberos/go.sum b/auth/kerberos/go.sum index c7f705b8c..102bb2903 100644 --- a/auth/kerberos/go.sum +++ b/auth/kerberos/go.sum @@ -35,16 +35,18 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc= golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= diff --git a/auth/kerberos/krb_unix.go b/auth/kerberos/krb_unix.go index e25725c05..1aa303eec 100644 --- a/auth/kerberos/krb_unix.go +++ b/auth/kerberos/krb_unix.go @@ -25,11 +25,9 @@ type GSS struct { func NewGSS() (*GSS, error) { g := &GSS{} err := g.init() - if err != nil { return nil, err } - return g, nil } @@ -50,32 +48,25 @@ func (g *GSS) init() error { } ccpath := "/tmp/krb5cc_" + u.Uid - - ccname := os.Getenv("KRB5CCNAME") - if strings.HasPrefix(ccname, "FILE:") { + if ccname := os.Getenv("KRB5CCNAME"); strings.HasPrefix(ccname, "FILE:") { ccpath = strings.SplitN(ccname, ":", 2)[1] } - ccache, err := credentials.LoadCCache(ccpath) if err != nil { return err } - cl, err := client.NewFromCCache(ccache, cfg, client.DisablePAFXFAST(true)) if err != nil { return err } cl.Login() - g.cli = cl - return nil } // GetInitToken implements the GSS interface. func (g *GSS) GetInitToken(host string, service string) ([]byte, error) { - // Resolve the hostname down to an 'A' record, if required (usually, it is) if g.cli.Config.LibDefaults.DNSCanonicalizeHostname { var err error @@ -84,26 +75,19 @@ func (g *GSS) GetInitToken(host string, service string) ([]byte, error) { return nil, err } } - - spn := service + "/" + host - - return g.GetInitTokenFromSpn(spn) + return g.GetInitTokenFromSpn(service + "/" + host) } // GetInitTokenFromSpn implements the GSS interface. func (g *GSS) GetInitTokenFromSpn(spn string) ([]byte, error) { - s := spnego.SPNEGOClient(g.cli, spn) - - st, err := s.InitSecContext() + st, err := spnego.SPNEGOClient(g.cli, spn).InitSecContext() if err != nil { return nil, fmt.Errorf("kerberos error (InitSecContext): %w", err) } - b, err := st.Marshal() if err != nil { return nil, fmt.Errorf("kerberos error (Marshaling token): %w", err) } - return b, nil } @@ -114,11 +98,9 @@ func (g *GSS) Continue(inToken []byte) (done bool, outToken []byte, err error) { if err != nil { return true, nil, fmt.Errorf("kerberos error (Unmarshaling token): %w", err) } - state := t.NegTokenResp.State() if state != spnego.NegStateAcceptCompleted { return true, nil, fmt.Errorf("kerberos: expected state 'Completed' - got %d", state) } - return true, nil, nil } diff --git a/auth/kerberos/krb_windows.go b/auth/kerberos/krb_windows.go index c1558759c..75a3881f0 100644 --- a/auth/kerberos/krb_windows.go +++ b/auth/kerberos/krb_windows.go @@ -17,11 +17,9 @@ type GSS struct { func NewGSS() (*GSS, error) { g := &GSS{} err := g.init() - if err != nil { return nil, err } - return g, nil } @@ -30,22 +28,17 @@ func (g *GSS) init() error { if err != nil { return err } - g.creds = creds return nil } // GetInitToken implements the GSS interface. func (g *GSS) GetInitToken(host string, service string) ([]byte, error) { - host, err := canonicalizeHostname(host) if err != nil { return nil, err } - - spn := service + "/" + host - - return g.GetInitTokenFromSpn(spn) + return g.GetInitTokenFromSpn(service + "/" + host) } // GetInitTokenFromSpn implements the GSS interface. @@ -54,9 +47,7 @@ func (g *GSS) GetInitTokenFromSpn(spn string) ([]byte, error) { if err != nil { return nil, err } - g.ctx = ctx - return token, nil } diff --git a/compose.yaml b/compose.yaml index f8956648a..593e56a62 100644 --- a/compose.yaml +++ b/compose.yaml @@ -30,7 +30,7 @@ services: pg19: profiles: ['pg19'] - image: 'postgres:19beta2' + image: 'postgres:19beta3' ports: ['127.0.0.1:5432:5432'] entrypoint: '/init/entry.sh' volumes: ['./testdata/postgres:/init', './testdata/ssl:/ssl']