Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update golang.org/x/crypto #19097

Merged
merged 4 commits into from Mar 16, 2022
Merged

Update golang.org/x/crypto #19097

merged 4 commits into from Mar 16, 2022

Conversation

Gusted
Copy link
Contributor

@Gusted Gusted commented Mar 15, 2022 •
edited

@Gusted Gusted added this to the 1.17.0 milestone Mar 15, 2022
@Gusted Gusted added topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! dependencies labels Mar 15, 2022
Gusted added a commit to Gusted/gitea that referenced this pull request Mar 15, 2022
@Gusted
Update golang.org/x/crypto (go-gitea#19097)
77bcd0d 
- Backport go-gitea#19097
@Gusted Gusted mentioned this pull request Mar 15, 2022
Merged
@Gusted Gusted added the backport/done All backports for this PR have been created label Mar 15, 2022
@GiteaBot GiteaBot added the lgtm/need 1 This PR needs approval from one additional maintainer to be merged. label Mar 15, 2022
@zeripath
Copy link
Contributor

We may not need the workaround from #17281 anymore.

@Gusted
Remove workaround
cc6ca7e 
- Introduced in go-gitea#17281
- Fixed in x/crypto:
- golang/crypto@5d542ad
- & golang/crypto@3147a52
@Gusted
Update Kex Algorithms
fae72ec 
- Use standardized name for curve22519-sha256. golang/crypto@9b07691
- Prefer SHA256 version over SHA1 version. golang/crypto@e4b3678
@zeripath
Copy link
Contributor

Does this also fix the #17798

@Gusted Gusted added the type/enhancement An improvement of existing functionality label Mar 15, 2022
@Gusted
Copy link
Contributor Author

Gusted commented Mar 15, 2022

Does this also fix the #17798

Confirmed over discord, this issue is not fixed with the recent additions to the SSH library.

@zeripath
Copy link
Contributor

yeah this doesn't fix #17798

@zeripath
Copy link
Contributor

OK I guess it's still worth updating this

@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Mar 15, 2022
@zeripath zeripath removed topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. type/enhancement An improvement of existing functionality labels Mar 15, 2022
@6543 6543 merged commit 6ab4a96 into go-gitea:main Mar 16, 2022
zjjhot added a commit to zjjhot/gitea that referenced this pull request Mar 16, 2022
@zjjhot
Merge remote-tracking branch 'giteaoffical/main'
a43267b 
* giteaoffical/main:
  rm .sample hooks which aren't used (go-gitea#19101)
  use go1.18 to build gitea (go-gitea#19099)
  Use `go run` for tool dependencies, require go 1.17 (go-gitea#18874)
  Update golang.org/x/crypto (go-gitea#19097)
  Handle email address not exist. (go-gitea#19089)
zeripath pushed a commit that referenced this pull request Mar 19, 2022
@Gusted
Update golang.org/x/crypto (#19097) (#19098)
c1e6be4 
Backport #19097

* Update golang.org/x/crypto (#19097)

- Backport #19097

* Fix deprecation notice

* Backport workaround removal
zeripath added a commit to zeripath/gitea that referenced this pull request Mar 23, 2022
@zeripath
Changelog for 1.16.5
fb7de1c 
 ## [1.16.5](https://github.com/go-gitea/gitea/releases/tag/1.16.5) - 2022-03-23

* BREAKING
  * Bump to build with go1.18 (go-gitea#19120 et al) (go-gitea#19127)
* SECURITY
  * Prevent redirect to Host (2) (go-gitea#19175) (go-gitea#19186)
  * Try to prevent autolinking of displaynames by email readers (go-gitea#19169) (go-gitea#19183)
  * Clean paths when looking in Storage (go-gitea#19124) (go-gitea#19179)
  * Do not send notification emails to inactive users (go-gitea#19131) (go-gitea#19139)
  * Do not send activation email if manual confirm is set (go-gitea#19119) (go-gitea#19122)
* ENHANCEMENTS
  * Use the new/choose link for New Issue on project page (go-gitea#19172) (go-gitea#19176)
* BUGFIXES
  * Fix compare link in active feeds for new branch (go-gitea#19149) (go-gitea#19185)
  * Redirect .wiki/* ui link to /wiki (go-gitea#18831) (go-gitea#19184)
  * Ensure deploy keys with write access can push (go-gitea#19010) (go-gitea#19182)
  * Ensure that setting.LocalURL always has a trailing slash (go-gitea#19171) (go-gitea#19177)
  * Cleanup protected branches when deleting users & teams (go-gitea#19158) (go-gitea#19174)
  * Use IterateBufferSize whilst querying repositories during adoption check (go-gitea#19140) (go-gitea#19160)
  * Fix NPE /repos/issues/search when not signed in (go-gitea#19154) (go-gitea#19155)
  * Use custom favicon when viewing static files if it exists (go-gitea#19130) (go-gitea#19152)
  * Fix the editor height in review box (go-gitea#19003) (go-gitea#19147)
  * Ensure isSSH is set whenever DISABLE_HTTP_GIT is set (go-gitea#19028) (go-gitea#19146)
  * Fix wrong scopes caused by empty scope input (go-gitea#19029) (go-gitea#19145)
  * Make migrations SKIP_TLS_VERIFY apply to git too (go-gitea#19132) (go-gitea#19141)
  * Handle email address not exist (go-gitea#19089) (go-gitea#19121)
* MISC
  * Update json-iterator to allow compilation with go1.18 (go-gitea#18644) (go-gitea#19100)
  * Update golang.org/x/crypto (go-gitea#19097) (go-gitea#19098)

Signed-off-by: Andrew Thornton <art27@cantab.net>
@zeripath zeripath mentioned this pull request Mar 23, 2022
Merged
@Gusted Gusted mentioned this pull request Mar 25, 2022
Closed
@Gusted Gusted deleted the update-go-x-crypto branch March 27, 2022 14:46
Chianina pushed a commit to Chianina/gitea that referenced this pull request Mar 28, 2022
@Gusted
Update golang.org/x/crypto (go-gitea#19097)
dfd4480 
* Update golang.org/x/crypto

- Update dependency to include fix for CVE.
- See https://groups.google.com/g/golang-announce/c/-cp44ypCT5s/m/wmegxkLiAQAJ?utm_medium=email&utm_source=footer

* Fix deprecation notice

* Remove workaround

- Introduced in go-gitea#17281
- Fixed in x/crypto:
- golang/crypto@5d542ad
- & golang/crypto@3147a52

* Update Kex Algorithms

- Use standardized name for curve22519-sha256. golang/crypto@9b07691
- Prefer SHA256 version over SHA1 version. golang/crypto@e4b3678
@feiyushi feiyushi mentioned this pull request Apr 14, 2022
Closed
@go-gitea go-gitea locked and limited conversation to collaborators Apr 28, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Reviewers

@zeripath zeripath zeripath approved these changes

@delvh delvh delvh approved these changes

Assignees
No one assigned
Labels
backport/done All backports for this PR have been created
Projects
None yet
Milestone
1.17.0
Development

Successfully merging this pull request may close these issues.

None yet
5 participants
@Gusted @zeripath @delvh @GiteaBot @6543