Skip to content

Commit 84c7c48

Browse files
binbin-libinbin-li
authored
fix: enforce host checking before exchanging a refresh token (#2069) (#2081)
Signed-off-by: Binbin Li <[email protected]>
1 parent e57c9a9 commit 84c7c48

39 files changed

+464
-228
lines changed

‎.github/crd.trivyignore.yaml

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
vulnerabilities:
2+
- id: CVE-2024-45338
3+
statement: kubectl is not vulnerable to this and is reason for being flagged

‎.github/dependabot.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -33,7 +33,7 @@ updates:
3333
interval: "weekly"
3434
ignore:
3535
- dependency-name: "golang"
36-
versions: '> 1.22'
36+
versions: '> 1.23'
3737
commit-message:
3838
prefix: "chore"
3939

@@ -43,6 +43,6 @@ updates:
4343
interval: "weekly"
4444
ignore:
4545
- dependency-name: "vscode/devcontainers/go"
46-
versions: '> 1.22'
46+
versions: '> 1.23'
4747
commit-message:
4848
prefix: "chore"

‎.github/workflows/build-pr.yml

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -24,7 +24,7 @@ jobs:
2424
strategy:
2525
fail-fast: false
2626
matrix:
27-
KUBERNETES_VERSION: ["1.29.2"]
27+
KUBERNETES_VERSION: ["1.30.6"]
2828
GATEKEEPER_VERSION: ["3.17.0"]
2929
uses: ./.github/workflows/e2e-k8s.yml
3030
with:
@@ -37,7 +37,7 @@ jobs:
3737
strategy:
3838
fail-fast: false
3939
matrix:
40-
KUBERNETES_VERSION: ["1.28.12", "1.29.2"]
40+
KUBERNETES_VERSION: ["1.29.10", "1.30.6"]
4141
GATEKEEPER_VERSION: ["3.15.0", "3.16.0", "3.17.0"]
4242
uses: ./.github/workflows/e2e-k8s.yml
4343
with:
@@ -53,7 +53,7 @@ jobs:
5353
strategy:
5454
fail-fast: false
5555
matrix:
56-
KUBERNETES_VERSION: ["1.28.12", "1.29.2"]
56+
KUBERNETES_VERSION: ["1.29.10", "1.30.6"]
5757
GATEKEEPER_VERSION: ["3.15.0", "3.16.0", "3.17.0"]
5858
uses: ./.github/workflows/e2e-aks.yml
5959
with:
@@ -76,10 +76,10 @@ jobs:
7676

7777
- name: Check out code into the Go module directory
7878
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
79-
- name: Set up Go 1.22
79+
- name: Set up Go 1.23
8080
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
8181
with:
82-
go-version: "1.22"
82+
go-version: "1.23"
8383

8484
- name: Az CLI login
8585
uses: azure/login@6c251865b4e6290e7b78be643ea2d005bc51f69a # v2.1.1

‎.github/workflows/codeql.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,7 +35,7 @@ jobs:
3535
- name: setup go environment
3636
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
3737
with:
38-
go-version: "1.22"
38+
go-version: "1.23"
3939
- name: Initialize CodeQL
4040
uses: github/codeql-action/init@4dd16135b69a43b6c8efb853346f8437d92d3c93 # tag=v3.26.6
4141
with:

‎.github/workflows/e2e-aks.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ on:
99
k8s_version:
1010
description: "Kubernetes version"
1111
required: true
12-
default: "1.29.2"
12+
default: "1.30.6"
1313
type: string
1414
gatekeeper_version:
1515
description: "Gatekeeper version"
@@ -34,10 +34,10 @@ jobs:
3434

3535
- name: Check out code into the Go module directory
3636
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
37-
- name: Set up Go 1.22
37+
- name: Set up Go 1.23
3838
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
3939
with:
40-
go-version: "1.22"
40+
go-version: "1.23"
4141
- name: Az CLI login
4242
uses: azure/login@6c251865b4e6290e7b78be643ea2d005bc51f69a # v2.1.1
4343
with:

‎.github/workflows/e2e-cli.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,7 @@ jobs:
4343
- name: setup go environment
4444
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
4545
with:
46-
go-version: "1.22"
46+
go-version: "1.23"
4747
- name: Run tidy
4848
run: go mod tidy
4949
- name: Build CLI
@@ -72,7 +72,7 @@ jobs:
7272
- name: setup go environment
7373
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
7474
with:
75-
go-version: "1.22"
75+
go-version: "1.23"
7676
- name: Run tidy
7777
run: go mod tidy
7878
- name: Build CLI

‎.github/workflows/e2e-k8s.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ on:
99
k8s_version:
1010
description: "Kubernetes version"
1111
required: true
12-
default: "1.29.2"
12+
default: "1.30.6"
1313
type: string
1414
gatekeeper_version:
1515
description: "Gatekeeper version"
@@ -32,10 +32,10 @@ jobs:
3232

3333
- name: Check out code into the Go module directory
3434
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
35-
- name: Set up Go 1.22
35+
- name: Set up Go 1.23
3636
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
3737
with:
38-
go-version: "1.22"
38+
go-version: "1.23"
3939

4040
- name: Bootstrap e2e
4141
run: |

‎.github/workflows/golangci-lint.yml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -21,10 +21,10 @@ jobs:
2121

2222
- uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
2323
with:
24-
go-version: "1.22"
24+
go-version: "1.23"
2525
- uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
2626
- name: golangci-lint
2727
uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
2828
with:
29-
version: v1.59.1
30-
args: --timeout=10m
29+
version: v1.62.2
30+
args: --timeout=20m

‎.github/workflows/high-availability.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -36,10 +36,10 @@ jobs:
3636

3737
- name: Check out code into the Go module directory
3838
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
39-
- name: Set up Go 1.22
39+
- name: Set up Go 1.23
4040
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
4141
with:
42-
go-version: "1.22"
42+
go-version: "1.23"
4343

4444
- name: Bootstrap e2e
4545
run: |

‎.github/workflows/publish-dev-assets.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -69,7 +69,7 @@ jobs:
6969
docker buildx build \
7070
--attest type=sbom \
7171
--attest type=provenance,mode=max \
72-
--build-arg KUBE_VERSION="1.29.2" \
72+
--build-arg KUBE_VERSION="1.30.6" \
7373
-f crd.Dockerfile \
7474
--platform linux/amd64,linux/arm64,linux/arm/v7 \
7575
--label org.opencontainers.image.revision=${{ github.sha }} \

‎.github/workflows/publish-package.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -51,7 +51,7 @@ jobs:
5151
docker buildx build \
5252
--attest type=sbom \
5353
--attest type=provenance,mode=max \
54-
--build-arg KUBE_VERSION="1.29.2" \
54+
--build-arg KUBE_VERSION="1.30.6" \
5555
-f crd.Dockerfile \
5656
--platform linux/amd64,linux/arm64,linux/arm/v7 \
5757
--label org.opencontainers.image.revision=${{ github.sha }} \

‎.github/workflows/quick-start.yml

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -27,7 +27,7 @@ jobs:
2727
contents: read
2828
strategy:
2929
matrix:
30-
KUBERNETES_VERSION: ["1.29.2"]
30+
KUBERNETES_VERSION: ["1.30.6"]
3131
steps:
3232
- name: Harden Runner
3333
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
@@ -39,7 +39,7 @@ jobs:
3939
- name: setup go environment
4040
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
4141
with:
42-
go-version: "1.22"
42+
go-version: "1.23"
4343
- name: Run tidy
4444
run: go mod tidy
4545
- name: Bootstrap e2e

‎.github/workflows/release.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -31,7 +31,7 @@ jobs:
3131
- name: Set up Go
3232
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
3333
with:
34-
go-version: "1.22"
34+
go-version: "1.23"
3535

3636
- name: Goreleaser
3737
id: goreleaser

‎.github/workflows/run-full-validation.yml

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -26,7 +26,7 @@ jobs:
2626
strategy:
2727
fail-fast: false
2828
matrix:
29-
KUBERNETES_VERSION: ["1.28.12", "1.29.2"]
29+
KUBERNETES_VERSION: ["1.29.10", "1.30.6"]
3030
GATEKEEPER_VERSION: ["3.15.0", "3.16.0", "3.17.0"]
3131
uses: ./.github/workflows/e2e-k8s.yml
3232
with:
@@ -41,7 +41,7 @@ jobs:
4141
strategy:
4242
fail-fast: false
4343
matrix:
44-
KUBERNETES_VERSION: ["1.28.12", "1.29.2"]
44+
KUBERNETES_VERSION: ["1.29.10", "1.30.6"]
4545
GATEKEEPER_VERSION: ["3.15.0", "3.16.0", "3.17.0"]
4646
uses: ./.github/workflows/e2e-aks.yml
4747
with:
@@ -64,10 +64,10 @@ jobs:
6464

6565
- name: Check out code into the Go module directory
6666
uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
67-
- name: Set up Go 1.22
67+
- name: Set up Go 1.23
6868
uses: actions/setup-go@0a12ed9d6a96ab950c8f026ed9f722fe0da7ef32 # v5.0.2
6969
with:
70-
go-version: "1.22"
70+
go-version: "1.23"
7171

7272
- name: Az CLI login
7373
uses: azure/login@6c251865b4e6290e7b78be643ea2d005bc51f69a # v2.1.1

‎.github/workflows/scan-vulns.yaml

Lines changed: 4 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -37,6 +37,8 @@ jobs:
3737
name: "[Trivy] Scan for vulnerabilities"
3838
runs-on: ubuntu-22.04
3939
timeout-minutes: 15
40+
env:
41+
TRIVY_VERSION: 0.58.2
4042
steps:
4143
- name: Harden Runner
4244
uses: step-security/harden-runner@91182cccc01eb5e619899d80e4e971d6181294a7 # v2.10.1
@@ -52,8 +54,6 @@ jobs:
5254
wget https://github.com/aquasecurity/trivy/releases/download/v${{ env.TRIVY_VERSION }}/trivy_${{ env.TRIVY_VERSION }}_Linux-64bit.tar.gz
5355
tar zxvf trivy_${{ env.TRIVY_VERSION }}_Linux-64bit.tar.gz
5456
echo "$(pwd)" >> $GITHUB_PATH
55-
env:
56-
TRIVY_VERSION: "0.46.0"
5757
5858
- name: Run trivy on git repository
5959
run: |
@@ -70,6 +70,5 @@ jobs:
7070
done
7171
- name: Run trivy on images and exit on HIGH severity
7272
run: |
73-
for img in "localbuild:test" "localbuildcrd:test"; do
74-
trivy image --ignore-unfixed --exit-code 1 --severity HIGH --vuln-type="os,library" "${img}"
75-
done
73+
trivy image --skip-db-update --ignore-unfixed --exit-code 1 --severity HIGH,CRITICAL --vuln-type="os,library" "localbuild:test"
74+
trivy image --skip-db-update --ignore-unfixed --exit-code 1 --severity HIGH,CRITICAL --vuln-type="os,library" --show-suppressed --ignorefile ./.github/crd.trivyignore.yaml "localbuildcrd:test"

‎CONTRIBUTING.md

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -186,7 +186,7 @@ export REGISTRY=yourregistry
186186
docker buildx create --use
187187

188188
docker buildx build -f httpserver/Dockerfile --platform linux/amd64 --build-arg build_sbom=true --build-arg build_licensechecker=true --build-arg build_schemavalidator=true --build-arg build_vulnerabilityreport=true -t ${REGISTRY}/ratify-project/ratify:yourtag .
189-
docker build --progress=plain --build-arg KUBE_VERSION="1.29.2" --build-arg TARGETOS="linux" --build-arg TARGETARCH="amd64" -f crd.Dockerfile -t ${REGISTRY}/localbuildcrd:yourtag ./charts/ratify/crds
189+
docker build --progress=plain --build-arg KUBE_VERSION="1.30.6" --build-arg TARGETOS="linux" --build-arg TARGETARCH="amd64" -f crd.Dockerfile -t ${REGISTRY}/localbuildcrd:yourtag ./charts/ratify/crds
190190
```
191191

192192
#### [Authenticate](https://docs.docker.com/engine/reference/commandline/login/#usage) with your registry, and push the newly built image

‎Makefile

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -25,9 +25,9 @@ LDFLAGS += -X $(GO_PKG)/internal/version.GitCommitHash=$(GIT_COMMIT_HASH)
2525
LDFLAGS += -X $(GO_PKG)/internal/version.GitTreeState=$(GIT_TREE_STATE)
2626
LDFLAGS += -X $(GO_PKG)/internal/version.GitTag=$(GIT_TAG)
2727

28-
KIND_VERSION ?= 0.22.0
29-
KUBERNETES_VERSION ?= 1.29.2
30-
KIND_KUBERNETES_VERSION ?= 1.29.2
28+
KIND_VERSION ?= 0.25.0
29+
KUBERNETES_VERSION ?= 1.30.6
30+
KIND_KUBERNETES_VERSION ?= 1.30.6
3131
GATEKEEPER_VERSION ?= 3.17.0
3232
DAPR_VERSION ?= 1.12.5
3333
COSIGN_VERSION ?= 2.2.3
@@ -202,7 +202,7 @@ e2e-dependencies:
202202
# Download and install kind
203203
curl -L https://github.com/kubernetes-sigs/kind/releases/download/v${KIND_VERSION}/kind-linux-amd64 --output ${GITHUB_WORKSPACE}/bin/kind && chmod +x ${GITHUB_WORKSPACE}/bin/kind
204204
# Download and install kubectl
205-
curl -L https://storage.googleapis.com/kubernetes-release/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl --output ${GITHUB_WORKSPACE}/bin/kubectl && chmod +x ${GITHUB_WORKSPACE}/bin/kubectl
205+
curl -L https://dl.k8s.io/release/v${KUBERNETES_VERSION}/bin/linux/amd64/kubectl --output ${GITHUB_WORKSPACE}/bin/kubectl && chmod +x ${GITHUB_WORKSPACE}/bin/kubectl
206206
# Download and install bats
207207
curl -sSLO https://github.com/bats-core/bats-core/archive/v${BATS_VERSION}.tar.gz && tar -zxvf v${BATS_VERSION}.tar.gz && bash bats-core-${BATS_VERSION}/install.sh ${GITHUB_WORKSPACE}
208208
# Download and install jq
@@ -270,6 +270,7 @@ e2e-helmfile-install:
270270
cd .staging/helmfilebin && tar -xvf helmfilebin.tar.gz
271271

272272
e2e-docker-credential-store-setup:
273+
sudo apt-get install pass
273274
rm -rf .staging/pass
274275
mkdir -p .staging/pass
275276
cd .staging/pass && git clone https://github.com/docker/docker-credential-helpers.git

0 commit comments

Comments
 (0)