[CSPM] upgrade rego dependency#9535
Conversation
paulcacheux
added
do-not-merge/WIP
changelog/no-changelog
fd5e6af to
943e1eb
Compare
943e1eb to
b89e9d3
Compare
mx-psi
left a comment
mx-psi
left a comment
There was a problem hiding this comment.
Thanks for doing this! I have a small question to understand this better: do you understand what are the implications of returning an empty user? To put it another way, where is the username value used in glog?
|
Returning the empty string as a username will just leave the username to its default value (currently This username is only used in the file name where the logs are dumped. |
mx-psi
left a comment
mx-psi
left a comment
There was a problem hiding this comment.
Makes sense, looks good to me then :)
|
Do you want me to move the fork under Datadog org then ? Or should I just let the fork where it is currently ? |
No strong opinion on it, I will let the Agent security team decide that |
* [CSPM] upgrade rego dependency * [CSPM] update license file * [CSPM] replace glog 1.0.0 with non-panicing fork
3 participants
What does this PR do?
This PR upgrades the dependency
github.com/open-policy-agent/opafromv0.31.0tov0.33.1.This upgrade implies an upgrade of
github.com/dgraph-io/ristrettofromv0.0.3tov0.1.0.This upgrade is problematic as the dependency on
github.com/golang/glog v1.0.0is added, which is crashing on Windows nanoserver container images because of a missing DLL (netapi32.dll).See the following PR/issues as other examples of the underlying problem :
os/userwon't build on Nanoserver due to missingNetApi32.dlldocker-library/golang#348The solution implemented in this PR is to fork
github.com/golang/glogand recover on a potential panic of theuser.Current()function call. We then use areplacein thego.modto replace use of the original repo with the fork.Using this fork should not pose major problems as the original repo is not actively developed (it's mainly a mirror of an internal project inside Google that is sync infrequently).
Here is the branch with the fix: https://github.com/paulcacheux/glog/tree/recover-panic-current-user
If this potential solution is agreed upon, we can move this fork under the Datadog Github Org.
Motivation
Keep dependencies up to date.
Describe how to test your changes
This update should be a no-op. The main thing to test is that a windows container based on a nanoserver image can actually start.
Checklist
changelog/no-changeloglabel has been applied.need-change/operatorandneed-change/helmlabels has been applied if applicable.team/..label has been applied, if known.Triagemilestone is set.Note: Adding GitHub labels is only possible for contributors with write access.