Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump docker/distribution to 2.8.2 #118036

Merged
merged 1 commit into from
May 17, 2023
Merged

Bump docker/distribution to 2.8.2 #118036

merged 1 commit into from
May 17, 2023

Conversation

skitt
Copy link
Member

@skitt skitt commented May 16, 2023 •
edited
Loading

What type of PR is this?

/kind cleanup

What this PR does / why we need it:

k/k doesn't use much code from docker/distribution so this doesn't change anything that's actually relevant, but 2.8.1 is identified as affected by CVE-2022-28391 and CVE-2023-2253; bumping to 2.8.2 avoids k/k triggering scanners on those CVEs.

Which issue(s) this PR fixes:

Special notes for your reviewer:

Does this PR introduce a user-facing change?

NONE

Additional documentation e.g., KEPs (Kubernetes Enhancement Proposals), usage docs, etc.:

@k8s-ci-robot k8s-ci-robot added kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files. do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels May 16, 2023
@k8s-ci-robot
Copy link
Contributor

This issue is currently awaiting triage.

If a SIG or subproject determines this is a relevant issue, they will accept it by applying the triage/accepted label and provide further guidance.

The triage/accepted label can be added by org members by writing /triage accepted in a comment.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 16, 2023
@k8s-ci-robot
Copy link
Contributor

Hi @skitt. Thanks for your PR.

I'm waiting for a kubernetes member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the needs-priority Indicates a PR lacks a `priority/foo` label and requires one. label May 16, 2023
@skitt
Bump docker/distribution to 2.8.2
3680a52 
k/k doesn't use much code from docker/distribution so this doesn't
change anything that's actually relevant, but 2.8.1 is identified as
affected by CVE-2022-28391 and CVE-2023-2253; bumping to 2.8.2 avoids
k/k triggering scanners on those CVEs.

Signed-off-by: Stephen Kitt <skitt@redhat.com>
@skitt skitt force-pushed the docker-distribution-2.8.2 branch from 3262fd4 to 3680a52 Compare May 16, 2023 07:20
@k8s-ci-robot k8s-ci-robot added area/dependency Issues or PRs related to dependency changes area/kubectl sig/cli Categorizes an issue or PR as relevant to SIG CLI. and removed do-not-merge/needs-sig Indicates an issue or PR lacks a `sig/foo` label and requires one. labels May 16, 2023
@k8s-ci-robot k8s-ci-robot requested review from ardaguclu, logicalhan and a team May 16, 2023 07:21
@k8s-ci-robot k8s-ci-robot added release-note-none Denotes a PR that doesn't merit a release note. and removed do-not-merge/release-note-label-needed Indicates that a PR should not merge because it's missing one of the release note labels. labels May 16, 2023
@dims
Copy link
Member

dims commented May 16, 2023

/me yells at scanners

the-simpsons-angry

@dims
Copy link
Member

dims commented May 16, 2023

/ok-to-test

@k8s-ci-robot k8s-ci-robot added ok-to-test Indicates a non-member PR verified by an org member that is safe to test. and removed needs-ok-to-test Indicates a PR that requires an org member to verify it is safe to test. labels May 16, 2023
@BenTheElder
Copy link
Member

but 2.8.1 is identified as affected by GHSA-h8c3-8522-vxc6

... that's not even in go code? : | ... busybox has nothing to do with any use of this library AFAIK ... sigh.

And of course registry API endpoints are only used by the underlying container runtime since dockershim removal (all currently supported k8s releases).

I wish we could get more responsibility from the scanners to correctly identify vulnerable status. At least this change is small.

@BenTheElder
Copy link
Member

@dims maybe in the future we should require info on which scanner so we can provide feedback to the scanner owners?

BenTheElder
BenTheElder reviewed May 16, 2023
View reviewed changes
Copy link
Member

@BenTheElder BenTheElder left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm
/approve

@k8s-ci-robot k8s-ci-robot added the lgtm "Looks good to me", indicates that a PR is ready to be merged. label May 16, 2023
@k8s-ci-robot
Copy link
Contributor

LGTM label has been added.

Git tree hash: 97fffefccee0bcd9711f12cb9098fbf6bfade375

@dims
Copy link
Member

dims commented May 17, 2023

@dims maybe in the future we should require info on which scanner so we can provide feedback to the scanner owners?

+100 @BenTheElder

@dims
Copy link
Member

dims commented May 17, 2023

/approve

@k8s-ci-robot
Copy link
Contributor

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: BenTheElder, dims, skitt

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@k8s-ci-robot k8s-ci-robot added the approved Indicates a PR has been approved by an approver from all required OWNERS files. label May 17, 2023
@k8s-ci-robot k8s-ci-robot merged commit 02f4d64 into kubernetes:master May 17, 2023
@k8s-ci-robot k8s-ci-robot added this to the v1.28 milestone May 17, 2023
@mkumatag
Copy link
Member

mkumatag commented Jun 9, 2023

I seeing these CVEs in the dependabot section for our project, wondering if we can cherrypick this to the older releases as well?

/cherrypick release-1.27
/cherrypick release-1.26

@skitt
Copy link
Member Author

skitt commented Jun 9, 2023

@BenTheElder this particular bump was flagged by Grype and dependabot.

@orsenthil
Copy link
Member

Cherrypick to older versions will be helpful. Otherwise, it will confuse the the people who end up with a report against older and supported versions of k8s.

This was referenced Jun 19, 2023
Closed
Closed
Closed
@skitt skitt deleted the docker-distribution-2.8.2 branch June 19, 2023 07:54
This was referenced Aug 25, 2023
Closed
Closed
@skitt skitt mentioned this pull request Oct 13, 2023
Closed
9 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@BenTheElder BenTheElder BenTheElder left review comments

@ardaguclu ardaguclu Awaiting requested review from ardaguclu

@logicalhan logicalhan Awaiting requested review from logicalhan

Assignees

@BenTheElder BenTheElder

Labels
approved Indicates a PR has been approved by an approver from all required OWNERS files. area/dependency Issues or PRs related to dependency changes area/kubectl cncf-cla: yes Indicates the PR's author has signed the CNCF CLA. kind/cleanup Categorizes issue or PR as related to cleaning up code, process, or technical debt. lgtm "Looks good to me", indicates that a PR is ready to be merged. needs-priority Indicates a PR lacks a `priority/foo` label and requires one. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. ok-to-test Indicates a non-member PR verified by an org member that is safe to test. release-note-none Denotes a PR that doesn't merit a release note. sig/cli Categorizes an issue or PR as relevant to SIG CLI. size/XS Denotes a PR that changes 0-9 lines, ignoring generated files.
Projects
None yet
Milestone
v1.28
Development

Successfully merging this pull request may close these issues.
6 participants
@skitt @k8s-ci-robot @dims @BenTheElder @mkumatag @orsenthil