Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[RELEASE] Released v0.1.1 gomodule source code and upstream v0.1.1 tag mismatch #231

Open
Dyanngg opened this issue May 22, 2024 · 2 comments
Assignees
Labels
priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now.

Comments

@Dyanngg
Copy link
Contributor

Dyanngg commented May 22, 2024

Describe the issue:
It has been brought to my attention that the source code in go module [email protected] downloaded with the go get command actually does not match the source code state in upstream v0.1.1 tag.

Specifically, according to https://pkg.go.dev/sigs.k8s.io/[email protected] the version was cut on Jul 3 2023, whereas from https://github.com/kubernetes-sigs/network-policy-api/commits/v0.1.1/ it was actually released on Aug 17. As a result, any source code / deliverables downloaded by user with the normal workflow (go.mod require or go get) for v0.1.1 will not include the change set from Jul 4 to Aug 17. If we clear all go cache and force go get to not use GOPROXY, it will try to download v0.1.1 from this repo, which will trigger a security error because of checksum mismatch:

➜  go get -u sigs.k8s.io/[email protected]
go: sigs.k8s.io/[email protected]: verifying go.mod: checksum mismatch
	downloaded: h1:h1mNosX5xtAXEYKkhcf3/M+IXMG80jqUHiPn8UnZno8=
	sum.golang.org: h1:F7S5fsb7QEzlLjuMgTGfUT4LRHylRbx2xDDpHfJKKEs=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

Suggestions:
A new release should be cut with tag v0.1.6 and marked as the latest release. After this, we should figure out how to resolve the discrepancy for v0.1.1 release.

@Dyanngg Dyanngg added the priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now. label May 22, 2024
@Dyanngg Dyanngg changed the title [Release] Released v0.1.1 gomodule source code and upstream v0.1.1 tag mismatch [RELEASE] Released v0.1.1 gomodule source code and upstream v0.1.1 tag mismatch May 22, 2024
@astoycos
Copy link
Member

@Dyanngg golang/go#42312 (comment) Unfortunately there is no way to bump the tag commit within go modules :/

Really what we are intending to do is to cut an official v0.2.0 release as soon as the FQDN feature gets merged, In the meantime we could cut a v0.1.5 patch release just to get us past this ^^^ OR just rely on the v0.1.5 tag for now

@tssurya
Copy link
Contributor

tssurya commented Jun 4, 2024

yeah as spoken in the meeting, let's cut the 0.1.5 release and then do another one for fdqn at 0.1.6 -> its easy to digest features that way

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
priority/critical-urgent Highest priority. Must be actively worked on as someone's top priority right now.
Projects
None yet
Development

No branches or pull requests

4 participants