From 7dbf380a87f24ce8a251f65354da808beeb72875 Mon Sep 17 00:00:00 2001 From: Martin Tournoij Date: Thu, 20 Aug 2026 23:01:44 +0100 Subject: [PATCH] Update dependencies for auth/kerberos module GitHub lists a bunch of security alerts for golang.org/x/crypto. I'm not sure if any of these affect us, but doesn't hurt to update. It bumps the Go version for that module, which is okay as it doesn't affect the main github.com/lib/pq module. Also test Go 1.27 in CI while we're at it, and use PostgreSQL 19beta3. --- .github/workflows/test.yml | 2 +- auth/kerberos/go.mod | 6 +++--- auth/kerberos/go.sum | 6 ++++-- auth/kerberos/krb_unix.go | 24 +++--------------------- auth/kerberos/krb_windows.go | 11 +---------- compose.yaml | 2 +- 6 files changed, 13 insertions(+), 38 deletions(-) diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml index 03e4b94b4..3f4c12f63 100644 --- a/.github/workflows/test.yml +++ b/.github/workflows/test.yml @@ -28,7 +28,7 @@ jobs: fail-fast: false matrix: pg: ['14', '15', '16', '17', '18', '19'] - go: ['1.23', '1.26'] + go: ['1.23', '1.27'] steps: - uses: 'actions/checkout@v6' - uses: 'actions/setup-go@v6' diff --git a/auth/kerberos/go.mod b/auth/kerberos/go.mod index 3c139e2f4..b57463a70 100644 --- a/auth/kerberos/go.mod +++ b/auth/kerberos/go.mod @@ -1,6 +1,6 @@ module github.com/lib/pq/auth/kerberos -go 1.21 +go 1.25.0 require ( github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e @@ -14,6 +14,6 @@ require ( github.com/jcmturner/gofork v1.7.6 // indirect github.com/jcmturner/goidentity/v6 v6.0.1 // indirect github.com/jcmturner/rpc/v2 v2.0.3 // indirect - golang.org/x/crypto v0.6.0 // indirect - golang.org/x/net v0.7.0 // indirect + golang.org/x/crypto v0.55.0 // indirect + golang.org/x/net v0.57.0 // indirect ) diff --git a/auth/kerberos/go.sum b/auth/kerberos/go.sum index c7f705b8c..102bb2903 100644 --- a/auth/kerberos/go.sum +++ b/auth/kerberos/go.sum @@ -35,16 +35,18 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY= golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= -golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc= golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4= golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s= golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c= golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= -golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g= golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= diff --git a/auth/kerberos/krb_unix.go b/auth/kerberos/krb_unix.go index e25725c05..1aa303eec 100644 --- a/auth/kerberos/krb_unix.go +++ b/auth/kerberos/krb_unix.go @@ -25,11 +25,9 @@ type GSS struct { func NewGSS() (*GSS, error) { g := &GSS{} err := g.init() - if err != nil { return nil, err } - return g, nil } @@ -50,32 +48,25 @@ func (g *GSS) init() error { } ccpath := "/tmp/krb5cc_" + u.Uid - - ccname := os.Getenv("KRB5CCNAME") - if strings.HasPrefix(ccname, "FILE:") { + if ccname := os.Getenv("KRB5CCNAME"); strings.HasPrefix(ccname, "FILE:") { ccpath = strings.SplitN(ccname, ":", 2)[1] } - ccache, err := credentials.LoadCCache(ccpath) if err != nil { return err } - cl, err := client.NewFromCCache(ccache, cfg, client.DisablePAFXFAST(true)) if err != nil { return err } cl.Login() - g.cli = cl - return nil } // GetInitToken implements the GSS interface. func (g *GSS) GetInitToken(host string, service string) ([]byte, error) { - // Resolve the hostname down to an 'A' record, if required (usually, it is) if g.cli.Config.LibDefaults.DNSCanonicalizeHostname { var err error @@ -84,26 +75,19 @@ func (g *GSS) GetInitToken(host string, service string) ([]byte, error) { return nil, err } } - - spn := service + "/" + host - - return g.GetInitTokenFromSpn(spn) + return g.GetInitTokenFromSpn(service + "/" + host) } // GetInitTokenFromSpn implements the GSS interface. func (g *GSS) GetInitTokenFromSpn(spn string) ([]byte, error) { - s := spnego.SPNEGOClient(g.cli, spn) - - st, err := s.InitSecContext() + st, err := spnego.SPNEGOClient(g.cli, spn).InitSecContext() if err != nil { return nil, fmt.Errorf("kerberos error (InitSecContext): %w", err) } - b, err := st.Marshal() if err != nil { return nil, fmt.Errorf("kerberos error (Marshaling token): %w", err) } - return b, nil } @@ -114,11 +98,9 @@ func (g *GSS) Continue(inToken []byte) (done bool, outToken []byte, err error) { if err != nil { return true, nil, fmt.Errorf("kerberos error (Unmarshaling token): %w", err) } - state := t.NegTokenResp.State() if state != spnego.NegStateAcceptCompleted { return true, nil, fmt.Errorf("kerberos: expected state 'Completed' - got %d", state) } - return true, nil, nil } diff --git a/auth/kerberos/krb_windows.go b/auth/kerberos/krb_windows.go index c1558759c..75a3881f0 100644 --- a/auth/kerberos/krb_windows.go +++ b/auth/kerberos/krb_windows.go @@ -17,11 +17,9 @@ type GSS struct { func NewGSS() (*GSS, error) { g := &GSS{} err := g.init() - if err != nil { return nil, err } - return g, nil } @@ -30,22 +28,17 @@ func (g *GSS) init() error { if err != nil { return err } - g.creds = creds return nil } // GetInitToken implements the GSS interface. func (g *GSS) GetInitToken(host string, service string) ([]byte, error) { - host, err := canonicalizeHostname(host) if err != nil { return nil, err } - - spn := service + "/" + host - - return g.GetInitTokenFromSpn(spn) + return g.GetInitTokenFromSpn(service + "/" + host) } // GetInitTokenFromSpn implements the GSS interface. @@ -54,9 +47,7 @@ func (g *GSS) GetInitTokenFromSpn(spn string) ([]byte, error) { if err != nil { return nil, err } - g.ctx = ctx - return token, nil } diff --git a/compose.yaml b/compose.yaml index f8956648a..593e56a62 100644 --- a/compose.yaml +++ b/compose.yaml @@ -30,7 +30,7 @@ services: pg19: profiles: ['pg19'] - image: 'postgres:19beta2' + image: 'postgres:19beta3' ports: ['127.0.0.1:5432:5432'] entrypoint: '/init/entry.sh' volumes: ['./testdata/postgres:/init', './testdata/ssl:/ssl']