switch back from golang.org/x/sys/execabs to os/exec (go1.19) #7647
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Member
|
Distros may package containerd 1.7 with Go 1.18, so probably this should be postponed to v2.0 |
thaJeztah
force-pushed
the
no_execabs
branch
from
47c1419 to
d27b180
Compare
dmcgowan
added
the
status/needs-major-release
Member
|
@thaJeztah I was reviewing #8789 when I noticed the import for one of the execs was execabs, and then wound up down the same rabbit hole as you 🤣. I think we can swap now given we're on the road to 2.0 |
AkihiroSuda
approved these changes
Jul 31, 2023
Member
Author
|
Oh! Saw your comment, and then forgot about it; I just rebased this one. Looks like the only consumer of that package is now |
This comment was marked as resolved.
This comment was marked as resolved.
Member
Author
|
Rebased, and also opened a pull request in golang.org/x/tools; |
dmcgowan
approved these changes
Nov 2, 2023
Member
Author
|
Rebased after #9316 was merged (which caused one minor conflict in @AkihiroSuda @dcantah this one good to go? |
estesp
approved these changes
Nov 2, 2023
Member
Author
|
oh! needs a rebase again; let me do so |
This is effectively a revert of 2ac9968, which switched from os/exec to the golang.org/x/sys/execabs package to mitigate security issues (mainly on Windows) with lookups resolving to binaries in the current directory. from the go1.19 release notes https://go.dev/doc/go1.19#os-exec-path > ## PATH lookups > > Command and LookPath no longer allow results from a PATH search to be found > relative to the current directory. This removes a common source of security > problems but may also break existing programs that depend on using, say, > exec.Command("prog") to run a binary named prog (or, on Windows, prog.exe) in > the current directory. See the os/exec package documentation for information > about how best to update such programs. > > On Windows, Command and LookPath now respect the NoDefaultCurrentDirectoryInExePath > environment variable, making it possible to disable the default implicit search > of “.” in PATH lookups on Windows systems. Signed-off-by: Sebastiaan van Stijn <[email protected]>
Member
Author
|
done; should be good again 👍 |
samuelkarp
approved these changes
Nov 2, 2023
AkihiroSuda
approved these changes
Nov 3, 2023
github-merge-queue
bot
removed this pull request from the merge queue due to failed status checks
This was referenced Jan 5, 2024
kiashok
added a commit
to kiashok/containerd
that referenced
this pull request
Oct 23, 2024
Update fork-external main with upstream main @ 452ec25 Related work items: containerd#5890, containerd#7647, containerd#9218, containerd#9233, containerd#9258, containerd#9270, containerd#9274, containerd#9279, containerd#9283, containerd#9286, containerd#9289, containerd#9290, containerd#9294, containerd#9295, containerd#9297, containerd#9305, containerd#9306, containerd#9308, containerd#9316, containerd#9317, containerd#9319, containerd#9320, containerd#9321
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
This is effectively a revert of 2ac9968 (#5906), which switched from os/exec to the golang.org/x/sys/execabs package to mitigate security issues (mainly on Windows) with lookups resolving to binaries in the current directory.
from the go1.19 release notes https://go.dev/doc/go1.19#os-exec-path