mirror of
https://github.com/moby/moby.git
synced 2022-11-09 12:21:53 -05:00
c1a9ffc97a
go1.18.3 (released 2022-06-01) includes security fixes to the crypto/rand, crypto/tls, os/exec, and path/filepath packages, as well as bug fixes to the compiler, and the crypto/tls and text/template/parse packages. See the Go 1.18.3 milestone on our issue tracker for details: https://github.com/golang/go/issues?q=milestone%3AGo1.18.3+label%3ACherryPickApproved Hello gophers, We have just released Go versions 1.18.3 and 1.17.11, minor point releases. These minor releases include 4 security fixes following the security policy: - crypto/rand: rand.Read hangs with extremely large buffers On Windows, rand.Read will hang indefinitely if passed a buffer larger than 1 << 32 - 1 bytes. Thanks to Davis Goodin and Quim Muntal, working at Microsoft on the Go toolset, for reporting this issue. This is [CVE-2022-30634][CVE-2022-30634] and Go issue https://go.dev/issue/52561. - crypto/tls: session tickets lack random ticket_age_add Session tickets generated by crypto/tls did not contain a randomly generated ticket_age_add. This allows an attacker that can observe TLS handshakes to correlate successive connections by comparing ticket ages during session resumption. Thanks to GitHub user nervuri for reporting this. This is [CVE-2022-30629][CVE-2022-30629] and Go issue https://go.dev/issue/52814. - `os/exec`: empty `Cmd.Path` can result in running unintended binary on Windows If, on Windows, `Cmd.Run`, `cmd.Start`, `cmd.Output`, or `cmd.CombinedOutput` are executed when Cmd.Path is unset and, in the working directory, there are binaries named either "..com" or "..exe", they will be executed. Thanks to Chris Darroch, brian m. carlson, and Mikhail Shcherbakov for reporting this. This is [CVE-2022-30580][CVE-2022-30580] and Go issue https://go.dev/issue/52574. - `path/filepath`: Clean(`.\c:`) returns `c:` on Windows On Windows, the `filepath.Clean` function could convert an invalid path to a valid, absolute path. For example, Clean(`.\c:`) returned `c:`. Thanks to Unrud for reporting this issue. This is [CVE-2022-29804][CVE-2022-29804] and Go issue https://go.dev/issue/52476. [CVE-2022-30634]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30634 [CVE-2022-30629]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30629 [CVE-2022-30580]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30580 [CVE-2022-29804]: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29804 Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
418 lines
16 KiB
YAML
418 lines
16 KiB
YAML
name: windows
|
|
|
|
on:
|
|
workflow_dispatch:
|
|
push:
|
|
branches:
|
|
- 'master'
|
|
- '[0-9]+.[0-9]{2}'
|
|
tags:
|
|
- 'v*'
|
|
pull_request:
|
|
|
|
env:
|
|
GO_VERSION: 1.18.3
|
|
WINDOWS_BASE_IMAGE: mcr.microsoft.com/windows/servercore
|
|
WINDOWS_BASE_TAG_2019: ltsc2019
|
|
WINDOWS_BASE_TAG_2022: ltsc2022
|
|
TEST_IMAGE_NAME: moby:test
|
|
TEST_CTN_NAME: moby
|
|
DOCKER_BUILDKIT: 0
|
|
|
|
jobs:
|
|
build:
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- windows-2019
|
|
- windows-2022
|
|
env:
|
|
GOPATH: ${{ github.workspace }}\go
|
|
GOBIN: ${{ github.workspace }}\go\bin
|
|
BIN_OUT: ${{ github.workspace }}\out
|
|
defaults:
|
|
run:
|
|
working-directory: ${{ env.GOPATH }}/src/github.com/docker/docker
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@v3
|
|
with:
|
|
path: ${{ env.GOPATH }}/src/github.com/docker/docker
|
|
-
|
|
name: Env
|
|
run: |
|
|
Get-ChildItem Env: | Out-String
|
|
-
|
|
name: Init
|
|
run: |
|
|
New-Item -ItemType "directory" -Path "${{ github.workspace }}\go-build"
|
|
New-Item -ItemType "directory" -Path "${{ github.workspace }}\go\pkg\mod"
|
|
If ("${{ matrix.os }}" -eq "windows-2019") {
|
|
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2019 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
|
|
} ElseIf ("${{ matrix.os }}" -eq "windows-2022") {
|
|
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2022 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
|
|
}
|
|
-
|
|
name: Cache
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: |
|
|
~\AppData\Local\go-build
|
|
~\go\pkg\mod
|
|
${{ github.workspace }}\go-build
|
|
${{ env.GOPATH }}\pkg\mod
|
|
key: ${{ matrix.os }}-${{ github.job }}-${{ hashFiles('**/vendor.sum') }}
|
|
restore-keys: |
|
|
${{ matrix.os }}-${{ github.job }}-
|
|
-
|
|
name: Docker info
|
|
run: |
|
|
docker info
|
|
-
|
|
name: Build base image
|
|
run: |
|
|
docker pull ${{ env.WINDOWS_BASE_IMAGE }}:${{ env.WINDOWS_BASE_IMAGE_TAG }}
|
|
docker tag ${{ env.WINDOWS_BASE_IMAGE }}:${{ env.WINDOWS_BASE_IMAGE_TAG }} microsoft/windowsservercore
|
|
docker build --build-arg GO_VERSION -t ${{ env.TEST_IMAGE_NAME }} -f Dockerfile.windows .
|
|
-
|
|
name: Build binaries
|
|
run: |
|
|
& docker run --name ${{ env.TEST_CTN_NAME }} -e "DOCKER_GITCOMMIT=${{ github.sha }}" `
|
|
-v "${{ github.workspace }}\go-build:C:\Users\ContainerAdministrator\AppData\Local\go-build" `
|
|
-v "${{ github.workspace }}\go\pkg\mod:C:\gopath\pkg\mod" `
|
|
${{ env.TEST_IMAGE_NAME }} hack\make.ps1 -Daemon -Client
|
|
-
|
|
name: Copy artifacts
|
|
run: |
|
|
New-Item -ItemType "directory" -Path "${{ env.BIN_OUT }}"
|
|
docker cp "${{ env.TEST_CTN_NAME }}`:c`:\gopath\src\github.com\docker\docker\bundles\docker.exe" ${{ env.BIN_OUT }}\
|
|
docker cp "${{ env.TEST_CTN_NAME }}`:c`:\gopath\src\github.com\docker\docker\bundles\dockerd.exe" ${{ env.BIN_OUT }}\
|
|
docker cp "${{ env.TEST_CTN_NAME }}`:c`:\gopath\bin\gotestsum.exe" ${{ env.BIN_OUT }}\
|
|
docker cp "${{ env.TEST_CTN_NAME }}`:c`:\containerd\bin\containerd.exe" ${{ env.BIN_OUT }}\
|
|
docker cp "${{ env.TEST_CTN_NAME }}`:c`:\containerd\bin\containerd-shim-runhcs-v1.exe" ${{ env.BIN_OUT }}\
|
|
-
|
|
name: Upload artifacts
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: build-${{ matrix.os }}
|
|
path: ${{ env.BIN_OUT }}/*
|
|
if-no-files-found: error
|
|
retention-days: 2
|
|
|
|
unit-test:
|
|
runs-on: ${{ matrix.os }}
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- windows-2019
|
|
- windows-2022
|
|
env:
|
|
GOPATH: ${{ github.workspace }}\go
|
|
GOBIN: ${{ github.workspace }}\go\bin
|
|
defaults:
|
|
run:
|
|
working-directory: ${{ env.GOPATH }}/src/github.com/docker/docker
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@v3
|
|
with:
|
|
path: ${{ env.GOPATH }}/src/github.com/docker/docker
|
|
-
|
|
name: Env
|
|
run: |
|
|
Get-ChildItem Env: | Out-String
|
|
-
|
|
name: Init
|
|
run: |
|
|
New-Item -ItemType "directory" -Path "${{ github.workspace }}\go-build"
|
|
New-Item -ItemType "directory" -Path "${{ github.workspace }}\go\pkg\mod"
|
|
New-Item -ItemType "directory" -Path "bundles"
|
|
If ("${{ matrix.os }}" -eq "windows-2019") {
|
|
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2019 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
|
|
} ElseIf ("${{ matrix.os }}" -eq "windows-2022") {
|
|
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2022 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
|
|
}
|
|
-
|
|
name: Cache
|
|
uses: actions/cache@v3
|
|
with:
|
|
path: |
|
|
~\AppData\Local\go-build
|
|
~\go\pkg\mod
|
|
${{ github.workspace }}\go-build
|
|
${{ env.GOPATH }}\pkg\mod
|
|
key: ${{ matrix.os }}-${{ github.job }}-${{ hashFiles('**/vendor.sum') }}
|
|
restore-keys: |
|
|
${{ matrix.os }}-${{ github.job }}-
|
|
-
|
|
name: Docker info
|
|
run: |
|
|
docker info
|
|
-
|
|
name: Build base image
|
|
run: |
|
|
docker pull ${{ env.WINDOWS_BASE_IMAGE }}:${{ env.WINDOWS_BASE_IMAGE_TAG }}
|
|
docker tag ${{ env.WINDOWS_BASE_IMAGE }}:${{ env.WINDOWS_BASE_IMAGE_TAG }} microsoft/windowsservercore
|
|
docker build --build-arg GO_VERSION -t ${{ env.TEST_IMAGE_NAME }} -f Dockerfile.windows .
|
|
-
|
|
name: Test
|
|
run: |
|
|
& docker run --name ${{ env.TEST_CTN_NAME }} -e "DOCKER_GITCOMMIT=${{ github.sha }}" `
|
|
-v "${{ github.workspace }}\go-build:C:\Users\ContainerAdministrator\AppData\Local\go-build" `
|
|
-v "${{ github.workspace }}\go\pkg\mod:C:\gopath\pkg\mod" `
|
|
-v "${{ env.GOPATH }}\src\github.com\docker\docker\bundles:C:\gopath\src\github.com\docker\docker\bundles" `
|
|
${{ env.TEST_IMAGE_NAME }} hack\make.ps1 -TestUnit
|
|
-
|
|
name: Send to Codecov
|
|
if: matrix.os == 'windows-2022'
|
|
uses: codecov/codecov-action@v3
|
|
with:
|
|
working-directory: ${{ env.GOPATH }}\src\github.com\docker\docker
|
|
directory: bundles
|
|
env_vars: RUNNER_OS
|
|
flags: unit
|
|
-
|
|
name: Upload reports
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ${{ matrix.os }}-unit-reports
|
|
path: ${{ env.GOPATH }}\src\github.com\docker\docker\bundles\*
|
|
|
|
integration-test:
|
|
runs-on: ${{ matrix.os }}
|
|
needs:
|
|
- build
|
|
strategy:
|
|
fail-fast: false
|
|
matrix:
|
|
os:
|
|
- windows-2019
|
|
- windows-2022
|
|
runtime:
|
|
- builtin
|
|
- containerd
|
|
env:
|
|
GOPATH: ${{ github.workspace }}\go
|
|
GOBIN: ${{ github.workspace }}\go\bin
|
|
BIN_OUT: ${{ github.workspace }}\out
|
|
defaults:
|
|
run:
|
|
working-directory: ${{ env.GOPATH }}/src/github.com/docker/docker
|
|
steps:
|
|
-
|
|
name: Checkout
|
|
uses: actions/checkout@v3
|
|
with:
|
|
path: ${{ env.GOPATH }}/src/github.com/docker/docker
|
|
-
|
|
name: Env
|
|
run: |
|
|
Get-ChildItem Env: | Out-String
|
|
-
|
|
name: Download artifacts
|
|
uses: actions/download-artifact@v3
|
|
with:
|
|
name: build-${{ matrix.os }}
|
|
path: ${{ env.BIN_OUT }}
|
|
-
|
|
name: Init
|
|
run: |
|
|
New-Item -ItemType "directory" -Path "bundles"
|
|
If ("${{ matrix.os }}" -eq "windows-2019") {
|
|
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2019 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
|
|
} ElseIf ("${{ matrix.os }}" -eq "windows-2022") {
|
|
echo "WINDOWS_BASE_IMAGE_TAG=${{ env.WINDOWS_BASE_TAG_2022 }}" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
|
|
}
|
|
Write-Output "${{ env.BIN_OUT }}" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
|
|
-
|
|
# removes docker service that is currently installed on the runner. we
|
|
# could use Uninstall-Package but not yet available on Windows runners.
|
|
# more info: https://github.com/actions/virtual-environments/blob/d3a5bad25f3b4326c5666bab0011ac7f1beec95e/images/win/scripts/Installers/Install-Docker.ps1#L11
|
|
name: Removing current daemon
|
|
run: |
|
|
if (Get-Service docker -ErrorAction SilentlyContinue) {
|
|
$dockerVersion = (docker version -f "{{.Server.Version}}")
|
|
Write-Host "Current installed Docker version: $dockerVersion"
|
|
# remove service
|
|
Stop-Service -Force -Name docker
|
|
Remove-Service -Name docker
|
|
# removes event log entry. we could use "Remove-EventLog -LogName -Source docker"
|
|
# but this cmd is only available since windows-2022
|
|
$ErrorActionPreference = "SilentlyContinue"
|
|
& reg delete "HKLM\SYSTEM\CurrentControlSet\Services\EventLog\Application\docker" /f 2>&1 | Out-Null
|
|
$ErrorActionPreference = "Stop"
|
|
Write-Host "Service removed"
|
|
}
|
|
-
|
|
name: Starting containerd
|
|
if: matrix.runtime == 'containerd'
|
|
run: |
|
|
Write-Host "Generating config"
|
|
& "${{ env.BIN_OUT }}\containerd.exe" config default | Out-File "$env:TEMP\ctn.toml" -Encoding ascii
|
|
Write-Host "Creating service"
|
|
New-Item -ItemType Directory "$env:TEMP\ctn-root" -ErrorAction SilentlyContinue | Out-Null
|
|
New-Item -ItemType Directory "$env:TEMP\ctn-state" -ErrorAction SilentlyContinue | Out-Null
|
|
Start-Process -Wait "${{ env.BIN_OUT }}\containerd.exe" `
|
|
-ArgumentList "--log-level=debug", `
|
|
"--config=$env:TEMP\ctn.toml", `
|
|
"--address=\\.\pipe\containerd-containerd", `
|
|
"--root=$env:TEMP\ctn-root", `
|
|
"--state=$env:TEMP\ctn-state", `
|
|
"--log-file=$env:TEMP\ctn.log", `
|
|
"--register-service"
|
|
Write-Host "Starting service"
|
|
Start-Service -Name containerd
|
|
Start-Sleep -Seconds 5
|
|
Write-Host "Service started successfully!"
|
|
-
|
|
name: Starting test daemon
|
|
run: |
|
|
Write-Host "Creating service"
|
|
If ("${{ matrix.runtime }}" -eq "containerd") {
|
|
$runtimeArg="--containerd=\\.\pipe\containerd-containerd"
|
|
echo "DOCKER_WINDOWS_CONTAINERD_RUNTIME=1" | Out-File -FilePath $Env:GITHUB_ENV -Encoding utf-8 -Append
|
|
}
|
|
New-Item -ItemType Directory "$env:TEMP\moby-root" -ErrorAction SilentlyContinue | Out-Null
|
|
New-Item -ItemType Directory "$env:TEMP\moby-exec" -ErrorAction SilentlyContinue | Out-Null
|
|
Start-Process -Wait -NoNewWindow "${{ env.BIN_OUT }}\dockerd" `
|
|
-ArgumentList $runtimeArg, "--debug", `
|
|
"--host=npipe:////./pipe/docker_engine", `
|
|
"--data-root=$env:TEMP\moby-root", `
|
|
"--exec-root=$env:TEMP\moby-exec", `
|
|
"--pidfile=$env:TEMP\docker.pid", `
|
|
"--register-service"
|
|
Write-Host "Starting service"
|
|
Start-Service -Name docker
|
|
Write-Host "Service started successfully!"
|
|
-
|
|
name: Waiting for test daemon to start
|
|
run: |
|
|
$tries=20
|
|
Write-Host "Waiting for the test daemon to start..."
|
|
While ($true) {
|
|
$ErrorActionPreference = "SilentlyContinue"
|
|
& "${{ env.BIN_OUT }}\docker" version
|
|
$ErrorActionPreference = "Stop"
|
|
If ($LastExitCode -eq 0) {
|
|
break
|
|
}
|
|
$tries--
|
|
If ($tries -le 0) {
|
|
Throw "Failed to get a response from the daemon"
|
|
}
|
|
Write-Host -NoNewline "."
|
|
Start-Sleep -Seconds 1
|
|
}
|
|
Write-Host "Test daemon started and replied!"
|
|
env:
|
|
DOCKER_HOST: npipe:////./pipe/docker_engine
|
|
-
|
|
name: Docker info
|
|
run: |
|
|
& "${{ env.BIN_OUT }}\docker" info
|
|
env:
|
|
DOCKER_HOST: npipe:////./pipe/docker_engine
|
|
-
|
|
name: Building contrib/busybox
|
|
run: |
|
|
& "${{ env.BIN_OUT }}\docker" build -t busybox `
|
|
--build-arg WINDOWS_BASE_IMAGE `
|
|
--build-arg WINDOWS_BASE_IMAGE_TAG `
|
|
.\contrib\busybox\
|
|
env:
|
|
DOCKER_HOST: npipe:////./pipe/docker_engine
|
|
-
|
|
name: List images
|
|
run: |
|
|
& "${{ env.BIN_OUT }}\docker" images
|
|
env:
|
|
DOCKER_HOST: npipe:////./pipe/docker_engine
|
|
-
|
|
name: Set up Go
|
|
uses: actions/setup-go@v3
|
|
with:
|
|
go-version: ${{ env.GO_VERSION }}
|
|
-
|
|
name: Test API
|
|
run: |
|
|
.\hack\make.ps1 -TestIntegration
|
|
env:
|
|
DOCKER_HOST: npipe:////./pipe/docker_engine
|
|
GO111MODULE: "off"
|
|
TEST_CLIENT_BINARY: ${{ env.BIN_OUT }}\docker
|
|
-
|
|
name: Test CLI
|
|
run: |
|
|
& gotestsum `
|
|
--format=standard-verbose `
|
|
--jsonfile="./bundles/go-test-report-int-cli-tests.json" `
|
|
--junitfile="./bundles/junit-report-int-cli-tests.xml" `
|
|
--packages="./integration-cli/..." `
|
|
-- `
|
|
"-coverprofile" "./bundles/coverage-report-int-cli-tests.txt" `
|
|
"-covermode" "atomic" `
|
|
"-tags" "autogen" `
|
|
"-test.timeout" "200m"
|
|
env:
|
|
DOCKER_HOST: npipe:////./pipe/docker_engine
|
|
GO111MODULE: "off"
|
|
TEST_CLIENT_BINARY: ${{ env.BIN_OUT }}\docker
|
|
-
|
|
name: Send to Codecov
|
|
if: matrix.os == 'windows-2022'
|
|
uses: codecov/codecov-action@v3
|
|
with:
|
|
working-directory: ${{ env.GOPATH }}\src\github.com\docker\docker
|
|
directory: bundles
|
|
env_vars: RUNNER_OS
|
|
flags: integration,${{ matrix.runtime }}
|
|
-
|
|
name: Docker info
|
|
run: |
|
|
& "${{ env.BIN_OUT }}\docker" info
|
|
env:
|
|
DOCKER_HOST: npipe:////./pipe/docker_engine
|
|
-
|
|
name: Stop containerd
|
|
if: always() && matrix.runtime == 'containerd'
|
|
run: |
|
|
$ErrorActionPreference = "SilentlyContinue"
|
|
Stop-Service -Force -Name containerd
|
|
$ErrorActionPreference = "Stop"
|
|
-
|
|
name: Containerd logs
|
|
if: always() && matrix.runtime == 'containerd'
|
|
run: |
|
|
Copy-Item "$env:TEMP\ctn.log" -Destination ".\bundles\containerd.log"
|
|
Get-Content "$env:TEMP\ctn.log" | Out-Host
|
|
-
|
|
name: Stop daemon
|
|
if: always()
|
|
run: |
|
|
$ErrorActionPreference = "SilentlyContinue"
|
|
Stop-Service -Force -Name docker
|
|
$ErrorActionPreference = "Stop"
|
|
-
|
|
# as the daemon is registered as a service we have to check the event
|
|
# logs against the docker provider.
|
|
name: Daemon event logs
|
|
if: always()
|
|
run: |
|
|
Get-WinEvent -ea SilentlyContinue `
|
|
-FilterHashtable @{ProviderName= "docker"; LogName = "application"} |
|
|
Select-Object -Property TimeCreated, @{N='Detailed Message'; E={$_.Message}} |
|
|
Sort-Object @{Expression="TimeCreated";Descending=$false} |
|
|
Select-Object -ExpandProperty 'Detailed Message' | Tee-Object -file ".\bundles\daemon.log"
|
|
-
|
|
name: Upload reports
|
|
if: always()
|
|
uses: actions/upload-artifact@v3
|
|
with:
|
|
name: ${{ matrix.os }}-integration-reports-${{ matrix.runtime }}
|
|
path: ${{ env.GOPATH }}\src\github.com\docker\docker\bundles\*
|