From abafa8dc8a22a07f208c88cd339ccf70ec33e46a Mon Sep 17 00:00:00 2001 From: Mariell Hoversholm Date: Fri, 17 Jan 2025 09:37:22 +0100 Subject: [PATCH] Security: Update to Go 1.22.11 - Backport to v11.1.x (#99126) * feat: update to Go 1.22.11 * chore: make drone * chore: go work use * CI: Force re-build * build: update mariadb connection The new Alpine base that the Golang images are built on no longer trust the CA of MySQL. This is a backport of: https://github.com/grafana/grafana/pull/98857 (cherry picked from commit e1bb8ccb79b07cda80eec916f28341332a700413) (cherry picked from commit 5becd9ac03a62253727138f5c3addfae1bb7a8ed) --- .drone.yml | 224 +++++++++++++++++------------------ Dockerfile | 2 +- Makefile | 2 +- go.mod | 2 +- go.work | 2 +- go.work.sum | 3 +- scripts/drone/steps/lib.star | 4 +- scripts/drone/variables.star | 2 +- 8 files changed, 121 insertions(+), 120 deletions(-) diff --git a/.drone.yml b/.drone.yml index 0a94ff194a4..2b76626f415 100644 --- a/.drone.yml +++ b/.drone.yml @@ -25,7 +25,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - ./bin/build verify-drone @@ -75,7 +75,7 @@ steps: - go install github.com/bazelbuild/buildtools/buildifier@latest - buildifier --lint=warn -mode=check -r . depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: lint-starlark trigger: event: @@ -366,7 +366,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -375,14 +375,14 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - apk add --update build-base shared-mime-info shared-mime-info-lang @@ -390,7 +390,7 @@ steps: -timeout=5m depends_on: - wire-install - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: test-backend - commands: - apk add --update build-base @@ -399,7 +399,7 @@ steps: | grep -o '\(.*\)/' | sort -u) depends_on: - wire-install - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: test-backend-integration trigger: event: @@ -453,7 +453,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - echo $(/usr/bin/github-app-external-token) > /github-app/token @@ -497,16 +497,16 @@ steps: - apk add --update make - make gen-go depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - go run scripts/modowners/modowners.go check go.mod - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: validate-modfile - commands: - apk add --update make - make swagger-validate - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: validate-openapi-spec trigger: event: @@ -581,7 +581,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - '# It is required that code generated from Thema/CUE be committed and in sync @@ -591,7 +591,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -600,14 +600,14 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - yarn install --immutable || yarn install --immutable @@ -640,7 +640,7 @@ steps: from_secret: drone_token - commands: - /src/grafana-build artifacts -a targz:grafana:linux/amd64 -a targz:grafana:linux/arm64 - -a targz:grafana:linux/arm/v7 --go-version=1.22.7 --yarn-cache=$$YARN_CACHE_FOLDER + -a targz:grafana:linux/arm/v7 --go-version=1.22.11 --yarn-cache=$$YARN_CACHE_FOLDER --build-id=$$DRONE_BUILD_NUMBER --grafana-dir=$$PWD > packages.txt depends_on: - yarn-install @@ -852,7 +852,7 @@ steps: - /src/grafana-build artifacts -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7 -a docker:grafana:linux/arm/v7:ubuntu --yarn-cache=$$YARN_CACHE_FOLDER --build-id=$$DRONE_BUILD_NUMBER - --go-version=1.22.7 --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3 --tag-format='{{ + --go-version=1.22.11 --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3 --tag-format='{{ .version_base }}-{{ .buildID }}-{{ .arch }}' --grafana-dir=$$PWD --ubuntu-tag-format='{{ .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}' > docker.txt - find ./dist -name '*docker*.tar.gz' -type f | xargs -n1 docker load -i @@ -1015,7 +1015,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - echo $DRONE_RUNNER_NAME @@ -1029,7 +1029,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -1038,14 +1038,14 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - dockerize -wait tcp://postgres:5432 -timeout 120s @@ -1066,7 +1066,7 @@ steps: GRAFANA_TEST_DB: postgres PGPASSWORD: grafanatest POSTGRES_HOST: postgres - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: postgres-integration-tests - commands: - dockerize -wait tcp://mysql57:3306 -timeout 120s @@ -1074,9 +1074,9 @@ steps: name: wait-for-mysql-5.7 - commands: - apk add --update build-base - - apk add --update mysql-client - - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root - -prootpass + - apk add --update mariadb-client + - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u + root -prootpass --disable-ssl-verify-server-cert - go clean -testcache - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' @@ -1087,7 +1087,7 @@ steps: environment: GRAFANA_TEST_DB: mysql MYSQL_HOST: mysql57 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: mysql-5.7-integration-tests - commands: - dockerize -wait tcp://mysql80:3306 -timeout 120s @@ -1095,9 +1095,9 @@ steps: name: wait-for-mysql-8.0 - commands: - apk add --update build-base - - apk add --update mysql-client - - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root - -prootpass + - apk add --update mariadb-client + - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u + root -prootpass --disable-ssl-verify-server-cert - go clean -testcache - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' @@ -1108,7 +1108,7 @@ steps: environment: GRAFANA_TEST_DB: mysql MYSQL_HOST: mysql80 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: mysql-8.0-integration-tests - commands: - dockerize -wait tcp://redis:6379 -timeout 120s @@ -1124,7 +1124,7 @@ steps: - wait-for-redis environment: REDIS_URL: redis://redis:6379/0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: redis-integration-tests - commands: - dockerize -wait tcp://memcached:11211 -timeout 120s @@ -1140,7 +1140,7 @@ steps: - wait-for-memcached environment: MEMCACHED_HOSTS: memcached:11211 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: memcached-integration-tests - commands: - dockerize -wait tcp://mimir_backend:8080 -timeout 120s @@ -1156,7 +1156,7 @@ steps: environment: AM_TENANT_ID: test AM_URL: http://mimir_backend:8080 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: remote-alertmanager-integration-tests trigger: event: @@ -1246,7 +1246,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue trigger: event: @@ -1366,7 +1366,7 @@ steps: && return 1; fi depends_on: - clone-enterprise - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: swagger-gen trigger: event: @@ -1481,7 +1481,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - '# It is required that code generated from Thema/CUE be committed and in sync @@ -1492,7 +1492,7 @@ steps: - CODEGEN_VERIFY=1 make gen-cue depends_on: - clone-enterprise - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -1502,14 +1502,14 @@ steps: - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: - clone-enterprise - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - apk add --update build-base @@ -1517,7 +1517,7 @@ steps: - go test -v -run=^$ -benchmem -timeout=1h -count=8 -bench=. ${GO_PACKAGES} depends_on: - wire-install - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: sqlite-benchmark-integration-tests - commands: - apk add --update build-base @@ -1529,7 +1529,7 @@ steps: GRAFANA_TEST_DB: postgres PGPASSWORD: grafanatest POSTGRES_HOST: postgres - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: postgres-benchmark-integration-tests - commands: - apk add --update build-base @@ -1540,7 +1540,7 @@ steps: environment: GRAFANA_TEST_DB: mysql MYSQL_HOST: mysql57 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: mysql-5.7-benchmark-integration-tests - commands: - apk add --update build-base @@ -1551,7 +1551,7 @@ steps: environment: GRAFANA_TEST_DB: mysql MYSQL_HOST: mysql80 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: mysql-8.0-benchmark-integration-tests trigger: event: @@ -1631,7 +1631,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue trigger: branch: main @@ -1804,7 +1804,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -1813,14 +1813,14 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - apk add --update build-base shared-mime-info shared-mime-info-lang @@ -1828,7 +1828,7 @@ steps: -timeout=5m depends_on: - wire-install - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: test-backend - commands: - apk add --update build-base @@ -1837,7 +1837,7 @@ steps: | grep -o '\(.*\)/' | sort -u) depends_on: - wire-install - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: test-backend-integration trigger: branch: main @@ -1882,22 +1882,22 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - apk add --update make - make gen-go depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - go run scripts/modowners/modowners.go check go.mod - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: validate-modfile - commands: - apk add --update make - make swagger-validate - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: validate-openapi-spec - commands: - ./bin/build verify-drone @@ -1968,7 +1968,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - '# It is required that code generated from Thema/CUE be committed and in sync @@ -1978,7 +1978,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -1987,14 +1987,14 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - yarn install --immutable || yarn install --immutable @@ -2026,7 +2026,7 @@ steps: name: build-frontend-packages - commands: - /src/grafana-build artifacts -a targz:grafana:linux/amd64 -a targz:grafana:linux/arm64 - -a targz:grafana:linux/arm/v7 --go-version=1.22.7 --yarn-cache=$$YARN_CACHE_FOLDER + -a targz:grafana:linux/arm/v7 --go-version=1.22.11 --yarn-cache=$$YARN_CACHE_FOLDER --build-id=$$DRONE_BUILD_NUMBER --grafana-dir=$$PWD > packages.txt depends_on: - update-package-json-version @@ -2274,7 +2274,7 @@ steps: - /src/grafana-build artifacts -a docker:grafana:linux/amd64 -a docker:grafana:linux/amd64:ubuntu -a docker:grafana:linux/arm64 -a docker:grafana:linux/arm64:ubuntu -a docker:grafana:linux/arm/v7 -a docker:grafana:linux/arm/v7:ubuntu --yarn-cache=$$YARN_CACHE_FOLDER --build-id=$$DRONE_BUILD_NUMBER - --go-version=1.22.7 --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3 --tag-format='{{ + --go-version=1.22.11 --ubuntu-base=ubuntu:22.04 --alpine-base=alpine:3.20.3 --tag-format='{{ .version_base }}-{{ .buildID }}-{{ .arch }}' --grafana-dir=$$PWD --ubuntu-tag-format='{{ .version_base }}-{{ .buildID }}-ubuntu-{{ .arch }}' > docker.txt - find ./dist -name '*docker*.tar.gz' -type f | xargs -n1 docker load -i @@ -2482,7 +2482,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - echo $DRONE_RUNNER_NAME @@ -2496,7 +2496,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -2505,14 +2505,14 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - dockerize -wait tcp://postgres:5432 -timeout 120s @@ -2533,7 +2533,7 @@ steps: GRAFANA_TEST_DB: postgres PGPASSWORD: grafanatest POSTGRES_HOST: postgres - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: postgres-integration-tests - commands: - dockerize -wait tcp://mysql57:3306 -timeout 120s @@ -2541,9 +2541,9 @@ steps: name: wait-for-mysql-5.7 - commands: - apk add --update build-base - - apk add --update mysql-client - - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root - -prootpass + - apk add --update mariadb-client + - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u + root -prootpass --disable-ssl-verify-server-cert - go clean -testcache - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' @@ -2554,7 +2554,7 @@ steps: environment: GRAFANA_TEST_DB: mysql MYSQL_HOST: mysql57 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: mysql-5.7-integration-tests - commands: - dockerize -wait tcp://mysql80:3306 -timeout 120s @@ -2562,9 +2562,9 @@ steps: name: wait-for-mysql-8.0 - commands: - apk add --update build-base - - apk add --update mysql-client - - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root - -prootpass + - apk add --update mariadb-client + - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u + root -prootpass --disable-ssl-verify-server-cert - go clean -testcache - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' @@ -2575,7 +2575,7 @@ steps: environment: GRAFANA_TEST_DB: mysql MYSQL_HOST: mysql80 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: mysql-8.0-integration-tests - commands: - dockerize -wait tcp://redis:6379 -timeout 120s @@ -2591,7 +2591,7 @@ steps: - wait-for-redis environment: REDIS_URL: redis://redis:6379/0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: redis-integration-tests - commands: - dockerize -wait tcp://memcached:11211 -timeout 120s @@ -2607,7 +2607,7 @@ steps: - wait-for-memcached environment: MEMCACHED_HOSTS: memcached:11211 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: memcached-integration-tests - commands: - dockerize -wait tcp://mimir_backend:8080 -timeout 120s @@ -2623,7 +2623,7 @@ steps: environment: AM_TENANT_ID: test AM_URL: http://mimir_backend:8080 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: remote-alertmanager-integration-tests trigger: branch: main @@ -2768,7 +2768,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - ./bin/build artifacts docker fetch --edition oss @@ -2900,7 +2900,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - ./bin/build artifacts docker fetch --edition oss @@ -3041,7 +3041,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - ./bin/build artifacts packages --artifacts-editions=oss --tag $${DRONE_TAG} --src-bucket @@ -3132,7 +3132,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - yarn install --immutable || yarn install --immutable @@ -3232,7 +3232,7 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - depends_on: - compile-build-cmd @@ -3348,7 +3348,7 @@ steps: from_secret: grafana_api_key GCP_KEY_BASE64: from_secret: gcp_key_base64 - GO_VERSION: 1.22.7 + GO_VERSION: 1.22.11 GPG_PASSPHRASE: from_secret: packages_gpg_passphrase GPG_PRIVATE_KEY: @@ -3423,7 +3423,7 @@ steps: from_secret: grafana_api_key GCP_KEY_BASE64: from_secret: gcp_key_base64 - GO_VERSION: 1.22.7 + GO_VERSION: 1.22.11 GPG_PASSPHRASE: from_secret: packages_gpg_passphrase GPG_PRIVATE_KEY: @@ -3480,13 +3480,13 @@ steps: depends_on: [] environment: CGO_ENABLED: 0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: compile-build-cmd - commands: - ./bin/build whatsnew-checker depends_on: - compile-build-cmd - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: whats-new-checker trigger: event: @@ -3585,7 +3585,7 @@ steps: from_secret: grafana_api_key GCP_KEY_BASE64: from_secret: gcp_key_base64 - GO_VERSION: 1.22.7 + GO_VERSION: 1.22.11 GPG_PASSPHRASE: from_secret: packages_gpg_passphrase GPG_PRIVATE_KEY: @@ -3736,7 +3736,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -3745,14 +3745,14 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - apk add --update build-base shared-mime-info shared-mime-info-lang @@ -3760,7 +3760,7 @@ steps: -timeout=5m depends_on: - wire-install - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: test-backend - commands: - apk add --update build-base @@ -3769,7 +3769,7 @@ steps: | grep -o '\(.*\)/' | sort -u) depends_on: - wire-install - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: test-backend-integration trigger: cron: @@ -3823,7 +3823,7 @@ steps: from_secret: grafana_api_key GCP_KEY_BASE64: from_secret: gcp_key_base64 - GO_VERSION: 1.22.7 + GO_VERSION: 1.22.11 GPG_PASSPHRASE: from_secret: packages_gpg_passphrase GPG_PRIVATE_KEY: @@ -3967,7 +3967,7 @@ steps: from_secret: grafana_api_key GCP_KEY_BASE64: from_secret: gcp_key_base64 - GO_VERSION: 1.22.7 + GO_VERSION: 1.22.11 GPG_PASSPHRASE: from_secret: packages_gpg_passphrase GPG_PRIVATE_KEY: @@ -4073,7 +4073,7 @@ steps: - export GITHUB_TOKEN=$(cat /github-app/token) - 'dagger run --silent /src/grafana-build artifacts -a $${ARTIFACTS} --grafana-ref=$${GRAFANA_REF} --enterprise-ref=$${ENTERPRISE_REF} --grafana-repo=$${GRAFANA_REPO} --version=$${VERSION} ' - - --go-version=1.22.7 + - --go-version=1.22.11 depends_on: - github-app-generate-token environment: @@ -4094,7 +4094,7 @@ steps: from_secret: grafana_api_key GCP_KEY_BASE64: from_secret: gcp_key_base64 - GO_VERSION: 1.22.7 + GO_VERSION: 1.22.11 GPG_PASSPHRASE: from_secret: packages_gpg_passphrase GPG_PRIVATE_KEY: @@ -4239,7 +4239,7 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-cue depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-cue - commands: - '# It is required that generated jsonnet is committed and in sync with its inputs.' @@ -4248,14 +4248,14 @@ steps: - apk add --update make - CODEGEN_VERIFY=1 make gen-jsonnet depends_on: [] - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: verify-gen-jsonnet - commands: - apk add --update make - make gen-go depends_on: - verify-gen-cue - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: wire-install - commands: - dockerize -wait tcp://postgres:5432 -timeout 120s @@ -4276,7 +4276,7 @@ steps: GRAFANA_TEST_DB: postgres PGPASSWORD: grafanatest POSTGRES_HOST: postgres - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: postgres-integration-tests - commands: - dockerize -wait tcp://mysql57:3306 -timeout 120s @@ -4284,9 +4284,9 @@ steps: name: wait-for-mysql-5.7 - commands: - apk add --update build-base - - apk add --update mysql-client - - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql57 -P 3306 -u root - -prootpass + - apk add --update mariadb-client + - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql57 -P 3306 -u + root -prootpass --disable-ssl-verify-server-cert - go clean -testcache - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' @@ -4297,7 +4297,7 @@ steps: environment: GRAFANA_TEST_DB: mysql MYSQL_HOST: mysql57 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: mysql-5.7-integration-tests - commands: - dockerize -wait tcp://mysql80:3306 -timeout 120s @@ -4305,9 +4305,9 @@ steps: name: wait-for-mysql-8.0 - commands: - apk add --update build-base - - apk add --update mysql-client - - cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h mysql80 -P 3306 -u root - -prootpass + - apk add --update mariadb-client + - cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h mysql80 -P 3306 -u + root -prootpass --disable-ssl-verify-server-cert - go clean -testcache - go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' @@ -4318,7 +4318,7 @@ steps: environment: GRAFANA_TEST_DB: mysql MYSQL_HOST: mysql80 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: mysql-8.0-integration-tests - commands: - dockerize -wait tcp://redis:6379 -timeout 120s @@ -4334,7 +4334,7 @@ steps: - wait-for-redis environment: REDIS_URL: redis://redis:6379/0 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: redis-integration-tests - commands: - dockerize -wait tcp://memcached:11211 -timeout 120s @@ -4350,7 +4350,7 @@ steps: - wait-for-memcached environment: MEMCACHED_HOSTS: memcached:11211 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: memcached-integration-tests - commands: - dockerize -wait tcp://mimir_backend:8080 -timeout 120s @@ -4366,7 +4366,7 @@ steps: environment: AM_TENANT_ID: test AM_URL: http://mimir_backend:8080 - image: golang:1.22.7-alpine + image: golang:1.22.11-alpine name: remote-alertmanager-integration-tests trigger: event: @@ -4672,7 +4672,7 @@ steps: - commands: - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM docker:27-cli - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM alpine/git:2.40.1 - - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.22.7-alpine + - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM golang:1.22.11-alpine - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:20.9.0-alpine - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM node:20-bookworm - trivy --exit-code 0 --severity UNKNOWN,LOW,MEDIUM google/cloud-sdk:431.0.0 @@ -4711,7 +4711,7 @@ steps: - commands: - trivy --exit-code 1 --severity HIGH,CRITICAL docker:27-cli - trivy --exit-code 1 --severity HIGH,CRITICAL alpine/git:2.40.1 - - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.22.7-alpine + - trivy --exit-code 1 --severity HIGH,CRITICAL golang:1.22.11-alpine - trivy --exit-code 1 --severity HIGH,CRITICAL node:20.9.0-alpine - trivy --exit-code 1 --severity HIGH,CRITICAL node:20-bookworm - trivy --exit-code 1 --severity HIGH,CRITICAL google/cloud-sdk:431.0.0 @@ -4981,6 +4981,6 @@ kind: secret name: gcr_credentials --- kind: signature -hmac: 56063200d17b3fb138b434997203adde68518e665dc2ddd30834cf7a63088da2 +hmac: 27e32d34ccdca70ed66bb8e2a0a118deb2c00380fb20218844fa5f402bc5436b ... diff --git a/Dockerfile b/Dockerfile index 02c508b8537..6b0f7d6508d 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,7 +3,7 @@ ARG BASE_IMAGE=alpine:3.19.1 ARG JS_IMAGE=node:20-alpine ARG JS_PLATFORM=linux/amd64 -ARG GO_IMAGE=golang:1.22.7-alpine +ARG GO_IMAGE=golang:1.22.11-alpine ARG GO_SRC=go-builder ARG JS_SRC=js-builder diff --git a/Makefile b/Makefile index ff689bdc93d..b832c5cf7b7 100644 --- a/Makefile +++ b/Makefile @@ -9,7 +9,7 @@ include .bingo/Variables.mk GO = go -GO_VERSION = 1.22.7 +GO_VERSION = 1.22.11 GO_FILES ?= ./pkg/... ./pkg/apiserver/... ./pkg/apimachinery/... ./pkg/promlib/... SH_FILES ?= $(shell find ./scripts -name *.sh) GO_RACE := $(shell [ -n "$(GO_RACE)" -o -e ".go-race-enabled-locally" ] && echo 1 ) diff --git a/go.mod b/go.mod index b0fa3b3458e..154a13004cc 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/grafana/grafana -go 1.22.7 +go 1.22.11 // Override docker/docker to avoid: // go: github.com/drone-runners/drone-runner-docker@v1.8.2 requires diff --git a/go.work b/go.work index ab8a9c48e94..43c6f98926f 100644 --- a/go.work +++ b/go.work @@ -1,4 +1,4 @@ -go 1.22.7 +go 1.22.11 use ( . diff --git a/go.work.sum b/go.work.sum index b2d59931714..fcc09f4c653 100644 --- a/go.work.sum +++ b/go.work.sum @@ -276,6 +276,8 @@ github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/internal/v2 v2.0.0 h1:PTFG github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/managementgroups/armmanagementgroups v1.0.0 h1:pPvTJ1dY0sA35JOeFq6TsY2xj6Z85Yo23Pj4wCCvu4o= github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.0.0 h1:ECsQtyERDVz3NP3kvDOTLvbQhqWp/x9EsGKtb4ogUr8= github.com/Azure/azure-sdk-for-go/sdk/resourcemanager/resources/armresources v1.1.1 h1:7CBQ+Ei8SP2c6ydQTGCCrS35bDxgTMfoP2miAwK++OU= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/azkeys v1.0.1/go.mod h1:GpPjLhVR9dnUoJMyHWSPy71xY9/lcmpzIPZXmF0FCVY= +github.com/Azure/azure-sdk-for-go/sdk/security/keyvault/internal v1.0.0/go.mod h1:bTSOgj05NGRuHHhQwAdPnYr9TOdNmKlZTgGLL6nyAdI= github.com/Azure/azure-service-bus-go v0.11.5 h1:EVMicXGNrSX+rHRCBgm/TRQ4VUZ1m3yAYM/AB2R/SOs= github.com/Azure/go-amqp v0.16.4 h1:/1oIXrq5zwXLHaoYDliJyiFjJSpJZMWGgtMX9e0/Z30= github.com/Azure/go-autorest/autorest/azure/auth v0.5.11 h1:P6bYXFoao05z5uhOQzbC3Qd8JqF3jUoocoTeIxkp2cA= @@ -1002,7 +1004,6 @@ golang.org/x/telemetry v0.0.0-20240208230135-b75ee8823808 h1:+Kc94D8UVEVxJnLXp/+ golang.org/x/telemetry v0.0.0-20240228155512-f48c80bd79b2 h1:IRJeR9r1pYWsHKTRe/IInb7lYvbBVIqOgsX/u0mbOWY= golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457 h1:zf5N6UOrA487eEFacMePxjXAJctxKmyjKUsjA11Uzuk= golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457/go.mod h1:pRgIJT+bRLFKnoM1ldnzKoxTIn14Yxz928LQRYYgIN0= -golang.org/x/term v0.27.0 h1:WP60Sv1nlK1T6SupCHbXzSaN0b9wUmsPoRS9b61A23Q= golang.org/x/text v0.15.0/go.mod h1:18ZOQIKpY8NJVqYksKHtTdi31H5itFRjB5/qKTNYzSU= golang.org/x/tools v0.21.1-0.20240508182429-e35e4ccd0d2d/go.mod h1:aiJjzUbINMkxbQROHiO6hDPo2LHcIPhhQsa9DLh0yGk= gonum.org/v1/netlib v0.0.0-20190313105609-8cb42192e0e0 h1:OE9mWmgKkjJyEmDAAtGMPjXu+YNeGvK9VTSHY6+Qihc= diff --git a/scripts/drone/steps/lib.star b/scripts/drone/steps/lib.star index b81b89252ac..c0bc138c809 100644 --- a/scripts/drone/steps/lib.star +++ b/scripts/drone/steps/lib.star @@ -1010,8 +1010,8 @@ def postgres_integration_tests_steps(): def mysql_integration_tests_steps(hostname, version): cmds = [ - "apk add --update mysql-client", - "cat devenv/docker/blocks/mysql_tests/setup.sql | mysql -h {} -P 3306 -u root -prootpass".format(hostname), + "apk add --update mariadb-client", # alpine doesn't package mysql anymore; more info: https://wiki.alpinelinux.org/wiki/MySQL + "cat devenv/docker/blocks/mysql_tests/setup.sql | mariadb -h {} -P 3306 -u root -prootpass --disable-ssl-verify-server-cert".format(hostname), "go clean -testcache", "go test -p=1 -count=1 -covermode=atomic -timeout=5m -run '^TestIntegration' $(find ./pkg -type f -name '*_test.go' -exec grep -l '^func TestIntegration' '{}' '+' | grep -o '\\(.*\\)/' | sort -u)", ] diff --git a/scripts/drone/variables.star b/scripts/drone/variables.star index 4e3d8a8aad7..13b305b41bd 100644 --- a/scripts/drone/variables.star +++ b/scripts/drone/variables.star @@ -3,7 +3,7 @@ global variables """ grabpl_version = "v3.1.1" -golang_version = "1.22.7" +golang_version = "1.22.11" # nodejs_version should match what's in ".nvmrc", but without the v prefix. nodejs_version = "20.9.0"