Skip to content
Success

Changes

Summary

  1. Improve README. (details)
  2. TAR-955 Helper to get pet node names. (details)
  3. TAR-955 Finally merge petMinder function. (details)
The file was modified examples/Jenkinsfile.matrixTest (diff)
The file was modified README.md (diff)
The file was addedvars/matrixTest.txt
Commit 060efd0187fe4302fe0ade72d0b5dd62d599683c by peter
TAR-955 Helper to get pet node names.
This is not currently covered by tests using JenkinsPipelineUnit since
it calls in to Jenkins internal APIs which are not easy to mock.
The file was addedvars/getNodeNamesByPrefix.txt
The file was addedvars/getNodeNamesByPrefix.groovy
Commit ff6d78d148da0a1a3da15209322cff2197985b30 by peter
TAR-955 Finally merge petMinder function.
The file was addedvars/petMinder.groovy

Summary

  1. Bump Golang 1.12.6 (details)
  2. Pin Golang images to debian stretch variant (details)
  3. Bump golang 1.12.8 (CVE-2019-9512, CVE-2019-9514) (details)
Commit fd776cdf69cfb4f7d9855655fbb55b397e22d990 by Sebastiaan van Stijn
Bump Golang 1.12.6
go1.12.6 (released 2019/06/11) includes fixes to the compiler, the
linker, the go command, and the `crypto/x509`, `net/http`, and `os`
packages. See the Go 1.12.6 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.12.6
full diff: https://github.com/golang/go/compare/go1.12.5...go1.12.6
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 01ba39e5972448ec2096cfacf56d06594cf709da)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The file was modified Makefile (diff)
The file was modified deb/Makefile (diff)
The file was modified image/Makefile (diff)
The file was modified rpm/Makefile (diff)
Commit 1fd135703681a7000b36c380cc9a06e7816fb689 by Sebastiaan van Stijn
Pin Golang images to debian stretch variant
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 1310e3974e8193745ce70cd74a20ab9d2151b8ac)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The file was modified rpm/Makefile (diff)
The file was modified image/Makefile (diff)
The file was modified deb/Makefile (diff)
Commit 75cd53f9aa9b65e8d4c3685e360115471431c415 by Sebastiaan van Stijn
Bump golang 1.12.8 (CVE-2019-9512, CVE-2019-9514)
go1.12.8 (released 2019/08/13) includes security fixes to the net/http
and net/url packages. See the Go 1.12.8 milestone on our issue tracker
for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.12.8
- net/http: Denial of Service vulnerabilities in the HTTP/2
implementation
net/http and golang.org/x/net/http2 servers that accept direct
connections from untrusted
clients could be remotely made to allocate an unlimited amount of
memory, until the program
crashes. Servers will now close connections if the send queue
accumulates too many control
messages.
The issues are CVE-2019-9512 and CVE-2019-9514, and Go issue
golang.org/issue/33606.
Thanks to Jonathan Looney from Netflix for discovering and reporting
these issues.
This is also fixed in version v0.0.0-20190813141303-74dc4d7220e7 of
golang.org/x/net/http2.
net/url: parsing validation issue
- url.Parse would accept URLs with malformed hosts, such that the Host
field could have arbitrary
suffixes that would appear in neither Hostname() nor Port(), allowing
authorization bypasses
in certain applications. Note that URLs with invalid, not numeric ports
will now return an error
from url.Parse.
The issue is CVE-2019-14809 and Go issue golang.org/issue/29098.
Thanks to Julian Hector and Nikolai Krein from Cure53, and Adi Cohen
(adico.me) for discovering
and reporting this issue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 9f5da37431039c9b2b6f2e281a0e4e53402ba148)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The file was modified image/Makefile (diff)
The file was modified Makefile (diff)
The file was modified deb/Makefile (diff)
The file was modified rpm/Makefile (diff)

Summary

  1. Bump Golang 1.12.6 (details)
  2. Pin Golang images to debian stretch variant (details)
  3. Bump golang 1.12.8 (CVE-2019-9512, CVE-2019-9514) (details)
Commit fd776cdf69cfb4f7d9855655fbb55b397e22d990 by Sebastiaan van Stijn
Bump Golang 1.12.6
go1.12.6 (released 2019/06/11) includes fixes to the compiler, the
linker, the go command, and the `crypto/x509`, `net/http`, and `os`
packages. See the Go 1.12.6 milestone on our issue tracker for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.12.6
full diff: https://github.com/golang/go/compare/go1.12.5...go1.12.6
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 01ba39e5972448ec2096cfacf56d06594cf709da)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The file was modified deb/Makefile (diff)
The file was modified image/Makefile (diff)
The file was modified rpm/Makefile (diff)
The file was modified Makefile (diff)
Commit 1fd135703681a7000b36c380cc9a06e7816fb689 by Sebastiaan van Stijn
Pin Golang images to debian stretch variant
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 1310e3974e8193745ce70cd74a20ab9d2151b8ac)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The file was modified image/Makefile (diff)
The file was modified deb/Makefile (diff)
The file was modified rpm/Makefile (diff)
Commit 75cd53f9aa9b65e8d4c3685e360115471431c415 by Sebastiaan van Stijn
Bump golang 1.12.8 (CVE-2019-9512, CVE-2019-9514)
go1.12.8 (released 2019/08/13) includes security fixes to the net/http
and net/url packages. See the Go 1.12.8 milestone on our issue tracker
for details:
https://github.com/golang/go/issues?q=milestone%3AGo1.12.8
- net/http: Denial of Service vulnerabilities in the HTTP/2
implementation
net/http and golang.org/x/net/http2 servers that accept direct
connections from untrusted
clients could be remotely made to allocate an unlimited amount of
memory, until the program
crashes. Servers will now close connections if the send queue
accumulates too many control
messages.
The issues are CVE-2019-9512 and CVE-2019-9514, and Go issue
golang.org/issue/33606.
Thanks to Jonathan Looney from Netflix for discovering and reporting
these issues.
This is also fixed in version v0.0.0-20190813141303-74dc4d7220e7 of
golang.org/x/net/http2.
net/url: parsing validation issue
- url.Parse would accept URLs with malformed hosts, such that the Host
field could have arbitrary
suffixes that would appear in neither Hostname() nor Port(), allowing
authorization bypasses
in certain applications. Note that URLs with invalid, not numeric ports
will now return an error
from url.Parse.
The issue is CVE-2019-14809 and Go issue golang.org/issue/29098.
Thanks to Julian Hector and Nikolai Krein from Cure53, and Adi Cohen
(adico.me) for discovering
and reporting this issue.
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
(cherry picked from commit 9f5da37431039c9b2b6f2e281a0e4e53402ba148)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
The file was modified deb/Makefile (diff)
The file was modified image/Makefile (diff)
The file was modified rpm/Makefile (diff)
The file was modified Makefile (diff)