diff --git a/.dockerignore b/.dockerignore index d88a5ec..49aa35d 100644 --- a/.dockerignore +++ b/.dockerignore @@ -1,3 +1,6 @@ .* * + +# Keep in sync with the paths in .github/workflows/ci.yaml. !src/ +!files/ diff --git a/.github/workflows/build.yaml b/.github/workflows/build.yaml index c480c44..832b408 100644 --- a/.github/workflows/build.yaml +++ b/.github/workflows/build.yaml @@ -1,100 +1,85 @@ name: Build on: - pull_request: - branches: - - main - push: - branches: - - main - tags: - - v?* + workflow_call: + inputs: + registry: + type: string + required: true + description: The registry to push the image to. + image-owner: + type: string + required: true + description: The owner of the image. + image-name: + type: string + required: true + description: The name of the image. + image-tag: + type: string + required: true + description: The tag of the image. + secrets: + registry-username: + description: The username for the registry. + registry-password: + description: The password for the registry. jobs: build: - runs-on: ubuntu-latest + runs-on: ubuntu-24.04 steps: - name: Prepare - id: prep - run: | - # If this is a git tag, use the tag name as a docker tag - if [[ $GITHUB_REF == refs/tags/v?* ]]; then - registry=quay.io - name="$GITHUB_REPOSITORY" - tag="${GITHUB_REF#refs/tags/v}" - tag="${tag//+/-}" - else - registry=ttl.sh - name="${GITHUB_REPOSITORY//\//-}-$GITHUB_SHA-$GITHUB_RUN_ID" - tag=1d - fi - - { - echo registry="$registry" - echo name="$name" - echo tag="$tag" - } >>"$GITHUB_OUTPUT" + id: prepare + env: + # GitHub Actions doesn't seem to support the secrets + # context in if fields, hence this workaround. + REGISTRY_CREDENTIALS_AVAILABLE: "${{ case(secrets.registry-username != '', 'true', '') }}" + run: echo registry-credentials-available="$REGISTRY_CREDENTIALS_AVAILABLE" >>"$GITHUB_OUTPUT" - name: Set up QEMU - uses: docker/setup-qemu-action@v3.6.0 + uses: docker/setup-qemu-action@29109295f81e9208d7d86ff1c6c12d2833863392 # v3.6.0 with: platforms: amd64,arm64,arm,riscv64 - name: Set up Docker Buildx id: buildx - uses: docker/setup-buildx-action@v3.10.0 + uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0 - name: Build OCI image archive id: build - uses: docker/build-push-action@v6.16.0 + uses: docker/build-push-action@14487ce63c7a62a4a324b0bfb37086795e31c6c1 # v6.16.0 with: builder: ${{ steps.buildx.outputs.name }} platforms: linux/amd64,linux/arm64,linux/arm,linux/riscv64 - tags: ${{ format('{0}/{1}:{2}', steps.prep.outputs.registry, steps.prep.outputs.name, steps.prep.outputs.tag) }} + tags: ${{ format('{0}/{1}/{2}:{3}', inputs.registry, inputs.image-owner, inputs.image-name, inputs.image-tag) }} outputs: type=oci,dest=oci-image.tar - - name: Compress OCI image archive - # Pre-compress the image archive so that the upload-artifact action - # doesn't try to do it. The layers inside the tar archive are themselves - # already gzip compressed, so this is not for size reduction, but solely - # to prevent the very slow compression process in the upload-artifact - # action. - # See: https://github.com/actions/upload-artifact/issues/199 - # See: https://github.com/actions/toolkit/blob/6c1f9eaae833355a0b212b66c5f2e3ac366de185/packages/artifact/src/internal/upload-gzip.ts#L11-L33 - # Might be fixed when upload-artifact@v4 gets released: https://github.com/actions/toolkit/pull/1488 - run: zstdmt --fast oci-image.tar - - name: Upload OCI image archive - uses: actions/upload-artifact@v4 + uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4.6.2 with: - name: oci-image.tar.zst - path: oci-image.tar.zst + name: ${{ format('{0}-{1}.tar', inputs.image-name, inputs.image-tag) }} + path: oci-image.tar + # The layers inside the tar archive are themselves already gzip + # compressed. No need to compress the metadata. Speeds things up a + # bit. + compression-level: 0 - name: Extract OCI image archive - run: mkdir image && tar xf oci-image.tar.zst -C image/ - - - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.30.0 - with: - input: image/ - format: table - list-all-pkgs: "true" # Flags a warning, but prints out stuff nevertheless - exit-code: "1" + run: mkdir image && tar xf oci-image.tar -C image/ - name: Log in to registry - if: steps.prep.outputs.registry != 'ttl.sh' - uses: redhat-actions/podman-login@v1 + if: steps.prepare.outputs.registry-credentials-available + uses: redhat-actions/podman-login@4934294ad0449894bcd1e9f191899d7292469603 # v1.7 with: - username: ${{ secrets.DOCKER_USERNAME }} - password: ${{ secrets.DOCKER_PASSWORD }} - registry: ${{ steps.prep.outputs.registry }} + registry: ${{ inputs.registry }} + username: ${{ secrets.registry-username }} + password: ${{ secrets.registry-password }} - name: Upload OCI image to registry env: - REGISTRY: ${{ steps.prep.outputs.registry }} - NAME: ${{ steps.prep.outputs.name }} - TAG: ${{ steps.prep.outputs.tag }} + IMAGE: ${{ format('{0}/{1}/{2}:{3}', inputs.registry, inputs.image-owner, inputs.image-name, inputs.image-tag) }} run: | podmanArgs=(-v "$(realpath oci-image.tar):/image.tar:ro") skopeoArgs=(--multi-arch all --preserve-digests) @@ -107,4 +92,4 @@ jobs: set -x podman run "${podmanArgs[@]}" \ docker://quay.io/skopeo/stable:v1.18.0 copy "${skopeoArgs[@]}" \ - oci-archive:/image.tar "docker://$REGISTRY/$NAME:$TAG" + oci-archive:/image.tar "docker://$IMAGE" diff --git a/.github/workflows/ci.yaml b/.github/workflows/ci.yaml new file mode 100644 index 0000000..61ee420 --- /dev/null +++ b/.github/workflows/ci.yaml @@ -0,0 +1,27 @@ +name: CI + +on: + pull_request: &triggers + branches: + - main + - release-* + paths: + - .github/workflows/ci.yaml + - .github/workflows/build.yaml + - Dockerfile + - .dockerignore + # keep in sync with .dockerignore + - src/** + - files/** + push: *triggers + +jobs: + build: + name: Build OCI image + uses: ./.github/workflows/build.yaml + with: + # This will produce images tagged like ttl.sh/k0sproject/cni-node-27741332811-1:1d. + registry: ttl.sh + image-owner: ${{ github.repository_owner }} + image-name: ${{ format('{0}-{1}-{2}', github.event.repository.name, github.run_id, github.run_attempt) }} + image-tag: 1d diff --git a/.github/workflows/dco.yaml b/.github/workflows/dco.yaml index 92583ec..611b70f 100644 --- a/.github/workflows/dco.yaml +++ b/.github/workflows/dco.yaml @@ -18,10 +18,10 @@ jobs: runs-on: ubuntu-24.04 steps: - name: Checkout k0s - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 - name: Set up Python ${{ env.PYTHON_VERSION }} - uses: actions/setup-python@v5 + uses: actions/setup-python@a26af69be951a213d495a4c3e4e4022e16d87065 # v5.6.0 with: python-version: ${{ env.PYTHON_VERSION }} diff --git a/.github/workflows/release.yaml b/.github/workflows/release.yaml new file mode 100644 index 0000000..9cabb9f --- /dev/null +++ b/.github/workflows/release.yaml @@ -0,0 +1,19 @@ +name: Release + +on: + push: + tags: + - v?* + +jobs: + build: + name: Build OCI image + uses: ./.github/workflows/build.yaml + with: + registry: quay.io + image-owner: ${{ github.repository_owner }} + image-name: ${{ github.event.repository.name }} + image-tag: ${{ github.ref_name }} + secrets: + registry-username: ${{ secrets.DOCKER_USERNAME }} + registry-password: ${{ secrets.DOCKER_PASSWORD }} diff --git a/.github/workflows/scan.yaml b/.github/workflows/scan.yaml index 86c44d2..d77fbcd 100644 --- a/.github/workflows/scan.yaml +++ b/.github/workflows/scan.yaml @@ -2,9 +2,6 @@ name: Security scan on: schedule: - cron: 0 2 * * 1-5 - release: - types: - - published workflow_dispatch: jobs: @@ -14,46 +11,31 @@ jobs: security-events: write # upload sarif results steps: - - name: Prepare - id: prep + - name: Determine latest release + id: latest-release + if: github.event.release.tag_name == '' env: - PUBLISHED_TAG: ${{ github.event.release.tag_name }} GH_REPO: ${{ github.repository }} GH_TOKEN: ${{ github.token }} - run: | - if [ -n "$PUBLISHED_TAG" ]; then - gitTag="$PUBLISHED_TAG" - else - # Get the tag name from the latest GitHub release - gitTag="$(gh api repos/{owner}/{repo}/releases/latest --jq .tag_name)" - fi - - # Determine OCI image tag - imageTag="${gitTag//+/-}" - imageTag="${imageTag#v}" - - { - echo git-tag="$gitTag" - echo image-tag="$imageTag" - } >>"$GITHUB_OUTPUT" + run: gh api 'repos/{owner}/{repo}/releases/latest' --jq '"tag-name=\(.tag_name)"' >>"$GITHUB_OUTPUT" # The checkout is solely required for the upload-sarif action. It needs to # know the ref and sha. Providing those manually won't work, for unknown # reasons. - name: Checkout - uses: actions/checkout@v4 + uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1 with: - ref: ${{ format('refs/tags/{0}', steps.prep.outputs.git-tag) }} + ref: ${{ format('refs/tags/{0}', github.event.release.tag_name || steps.latest-release.outputs.tag-name) }} persist-credentials: false - name: Run Trivy vulnerability scanner - uses: aquasecurity/trivy-action@0.12.0 + uses: aquasecurity/trivy-action@ed142fd0673e97e23eac54620cfb913e5ce36c25 # v0.36.0 with: - image-ref: ${{ format('quay.io/{0}:{1}', github.repository, steps.prep.outputs.image-tag) }} + image-ref: ${{ format('quay.io/{0}:{1}', github.repository, github.event.release.tag_name || steps.latest-release.outputs.tag-name) }} format: sarif output: trivy-results.sarif - name: Upload Trivy scan results to GitHub Security tab - uses: github/codeql-action/upload-sarif@v2 + uses: github/codeql-action/upload-sarif@b8d3b6e8af63cde30bdc382c0bc28114f4346c88 # v2.28.1 with: sarif_file: trivy-results.sarif diff --git a/Dockerfile b/Dockerfile index 9aa6e73..7e168dc 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,32 +1,35 @@ ARG \ - ALPINE_IMAGE=docker.io/library/alpine:3.22.2 \ - GOLANG_IMAGE=docker.io/library/golang:1.25.2-alpine \ + ALPINE_IMAGE=docker.io/library/alpine:3.22.7 \ + GOLANG_IMAGE=docker.io/library/golang:1.26.10-alpine3.23 \ VERSION=1.8.0 \ HASH=f0510b4452dda4b08d4b088d02e005ac507cb96fb7247b4422ae591286390369 -FROM --platform=$BUILDPLATFORM $GOLANG_IMAGE AS bins +FROM --platform=$BUILDPLATFORM $GOLANG_IMAGE AS sources +RUN apk add --no-cache patch +ENV GOTOOLCHAIN=local GOTELEMETRY=off +WORKDIR /go/src/containernetworking-plugins ARG VERSION HASH - -RUN wget https://github.com/containernetworking/plugins/archive/refs/tags/v${VERSION}.tar.gz \ - && { echo "${HASH} *v${VERSION}.tar.gz" | sha256sum -c -; } \ - && tar xf "v${VERSION}.tar.gz" -C /go \ - && rm -- "v${VERSION}.tar.gz" - -WORKDIR /go/plugins-$VERSION - -ARG TARGETPLATFORM -RUN set -x \ - && apk add bash \ - && mkdir -p /opt/stage/usr/local/bin \ - && case "${TARGETPLATFORM-~}" in \ - linux/amd64) export GOARCH=amd64 ;; \ - linux/arm64) export GOARCH=arm64 ;; \ - linux/arm/v7) export GOARCH=arm ;; \ - linux/riscv64) export GOARCH=riscv64 ;; \ - ~);; \ - *) echo Unsupported target platform: "$TARGETPLATFORM" >&2; exit 1;; \ - esac \ - && CGO_ENABLED=0 ./build_linux.sh -trimpath -buildvcs=false \ +RUN --mount=source=files/patches,target=/run/patches,ro \ + --mount=type=tmpfs,target=/tmp \ + set -euo pipefail \ + && wget -qO /tmp/sources.tar.gz https://github.com/containernetworking/plugins/archive/refs/tags/v$VERSION.tar.gz \ + && { echo $HASH /tmp/sources.tar.gz | sha256sum -c -; } || { sha256sum /tmp/sources.tar.gz; exit 1; } \ + && tar xf /tmp/sources.tar.gz --strip-components=1 \ + && for p in /run/patches/*.patch; do \ + [ "$p" != '/run/patches/*.patch' ] || { echo No patches found.; break; }; \ + echo Applying "$p" >&2; \ + patch -p1 <"$p"; \ + done + +# Re-vendor the dependencies, as the patches may have touched go.mod/go.sum +RUN go mod vendor + + +FROM sources AS bins +ARG TARGETARCH SOURCE_DATE_EPOCH +RUN --mount=type=cache,id=calico-gocache-$TARGETARCH,target=/root/.cache/go-build \ + --network=none \ + CGO_ENABLED=0 GOARCH=$TARGETARCH ./build_linux.sh -trimpath -buildvcs=false \ -ldflags "-s -w -extldflags -static -X github.com/containernetworking/plugins/pkg/utils/buildversion.BuildVersion=v$VERSION" @@ -45,6 +48,6 @@ LABEL org.opencontainers.image.licenses="Apache-2.0" \ org.opencontainers.image.source="https://github.com/k0sproject/cni-node" COPY --from=baselayout / / ARG VERSION -COPY --from=bins /go/plugins-$VERSION/bin/ /opt/cni/bin/ +COPY --from=bins /go/src/containernetworking-plugins/bin/ /opt/cni/bin/ ENTRYPOINT ["/bin/cni-node"] CMD ["install"] diff --git a/files/patches/.keep b/files/patches/.keep new file mode 100644 index 0000000..e69de29 diff --git a/files/patches/0001-CVE-2025-52881-Bump-selinux-to-1.13.0.patch b/files/patches/0001-CVE-2025-52881-Bump-selinux-to-1.13.0.patch new file mode 100644 index 0000000..7865d95 --- /dev/null +++ b/files/patches/0001-CVE-2025-52881-Bump-selinux-to-1.13.0.patch @@ -0,0 +1,86 @@ +From dada84a99a00147611749bc0457dd810fd71bec7 Mon Sep 17 00:00:00 2001 +From: sbiradar10 +Date: Sat, 14 Feb 2026 14:13:15 +0530 +Subject: [PATCH 1/2] CVE-2025-52881: Bump selinux to 1.13.0 + +Signed-off-by: sbiradar10 +--- +Limited to go.mod and go.sum; the vendor tree is regenerated at build time. + + go.mod | 4 +++- + go.sum | 12 ++++++++---- + 2 files changed, 11 insertions(+), 5 deletions(-) + +diff --git a/go.mod b/go.mod +index edf51d4..513e7c8 100644 +--- a/go.mod ++++ b/go.mod +@@ -15,7 +15,7 @@ require ( + github.com/networkplumbing/go-nft v0.4.0 + github.com/onsi/ginkgo/v2 v2.25.1 + github.com/onsi/gomega v1.38.1 +- github.com/opencontainers/selinux v1.12.0 ++ github.com/opencontainers/selinux v1.13.0 + github.com/pkg/errors v0.9.1 + github.com/safchain/ethtool v0.6.2 + github.com/vishvananda/netlink v1.3.1 +@@ -25,12 +25,14 @@ require ( + ) + + require ( ++ cyphar.com/go-pathrs v0.2.1 // indirect + github.com/Masterminds/semver/v3 v3.4.0 // indirect + github.com/Microsoft/go-winio v0.6.2 // indirect + github.com/containerd/cgroups/v3 v3.0.3 // indirect + github.com/containerd/errdefs v0.3.0 // indirect + github.com/containerd/errdefs/pkg v0.3.0 // indirect + github.com/containerd/typeurl/v2 v2.2.0 // indirect ++ github.com/cyphar/filepath-securejoin v0.6.0 // indirect + github.com/go-logr/logr v1.4.3 // indirect + github.com/go-task/slim-sprig/v3 v3.0.0 // indirect + github.com/gogo/protobuf v1.3.2 // indirect +diff --git a/go.sum b/go.sum +index 5bd059b..708fef9 100644 +--- a/go.sum ++++ b/go.sum +@@ -1,4 +1,6 @@ + cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= ++cyphar.com/go-pathrs v0.2.1 h1:9nx1vOgwVvX1mNBWDu93+vaceedpbsDqo+XuBGL40b8= ++cyphar.com/go-pathrs v0.2.1/go.mod h1:y8f1EMG7r+hCuFf/rXsKqMJrJAUoADZGNh5/vZPKcGc= + github.com/BurntSushi/toml v0.3.1/go.mod h1:xHWCNGjB5oqiDr8zfno3MHue2Ht5sIBksp03qcyfWMU= + github.com/Masterminds/semver/v3 v3.4.0 h1:Zog+i5UMtVoCU8oKka5P7i9q9HgrJeGzI9SA1Xbatp0= + github.com/Masterminds/semver/v3 v3.4.0/go.mod h1:4V+yj/TJE1HU9XfppCwVMZq3I84lprf4nC11bSS5beM= +@@ -27,6 +29,8 @@ github.com/coreos/go-iptables v0.8.0 h1:MPc2P89IhuVpLI7ETL/2tx3XZ61VeICZjYqDEgNs + github.com/coreos/go-iptables v0.8.0/go.mod h1:Qe8Bv2Xik5FyTXwgIbLAnv2sWSBmvWdFETJConOQ//Q= + github.com/coreos/go-systemd/v22 v22.6.0 h1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo= + github.com/coreos/go-systemd/v22 v22.6.0/go.mod h1:iG+pp635Fo7ZmV/j14KUcmEyWF+0X7Lua8rrTWzYgWU= ++github.com/cyphar/filepath-securejoin v0.6.0 h1:BtGB77njd6SVO6VztOHfPxKitJvd/VPT+OFBFMOi1Is= ++github.com/cyphar/filepath-securejoin v0.6.0/go.mod h1:A8hd4EnAeyujCJRrICiOWqjS1AX0a9kM5XL+NwKoYSc= + github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= + github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= + github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= +@@ -95,8 +99,8 @@ github.com/onsi/ginkgo/v2 v2.25.1 h1:Fwp6crTREKM+oA6Cz4MsO8RhKQzs2/gOIVOUscMAfZY + github.com/onsi/ginkgo/v2 v2.25.1/go.mod h1:ppTWQ1dh9KM/F1XgpeRqelR+zHVwV81DGRSDnFxK7Sk= + github.com/onsi/gomega v1.38.1 h1:FaLA8GlcpXDwsb7m0h2A9ew2aTk3vnZMlzFgg5tz/pk= + github.com/onsi/gomega v1.38.1/go.mod h1:LfcV8wZLvwcYRwPiJysphKAEsmcFnLMK/9c+PjvlX8g= +-github.com/opencontainers/selinux v1.12.0 h1:6n5JV4Cf+4y0KNXW48TLj5DwfXpvWlxXplUkdTrmPb8= +-github.com/opencontainers/selinux v1.12.0/go.mod h1:BTPX+bjVbWGXw7ZZWUbdENt8w0htPSrlgOOysQaU62U= ++github.com/opencontainers/selinux v1.13.0 h1:Zza88GWezyT7RLql12URvoxsbLfjFx988+LGaWfbL84= ++github.com/opencontainers/selinux v1.13.0/go.mod h1:XxWTed+A/s5NNq4GmYScVy+9jzXhGBVEOAyucdRUY8s= + github.com/pierrec/lz4/v4 v4.1.21 h1:yOVMLb6qSIDP67pl/5F7RepeKYu/VmTyEXvuMI5d9mQ= + github.com/pierrec/lz4/v4 v4.1.21/go.mod h1:gZWDp/Ze/IJXGXf23ltt2EXimqmTUXEy0GFuRQyBid4= + github.com/pkg/errors v0.9.1 h1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4= +@@ -119,8 +123,8 @@ github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/ + github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg= + github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= + github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4= +-github.com/stretchr/testify v1.8.4 h1:CcVxjf3Q8PM0mHUKJCdn+eZZtm5yQwehR5yeSVQQcUk= +-github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo= ++github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= ++github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= + github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701 h1:pyC9PaHYZFgEKFdlp3G8RaCKgVpHZnecvArXvPXcFkM= + github.com/u-root/uio v0.0.0-20240224005618-d2acac8f3701/go.mod h1:P3a5rG4X7tI17Nn3aOIAYr5HbIMukwXG0urG0WuL8OA= + github.com/vishvananda/netlink v1.3.1 h1:3AEMt62VKqz90r0tmNhog0r/PpWKmrEShJU0wJW6bV0= +-- +2.54.0 + diff --git a/files/patches/0002-Bump-golang.org-x-net-to-v0.61.0.patch b/files/patches/0002-Bump-golang.org-x-net-to-v0.61.0.patch new file mode 100644 index 0000000..ce81c9e --- /dev/null +++ b/files/patches/0002-Bump-golang.org-x-net-to-v0.61.0.patch @@ -0,0 +1,112 @@ +From 995ef0a771ae6eb19ab02ffe9c27375dd520db25 Mon Sep 17 00:00:00 2001 +From: Tom Wieczorek +Date: Thu, 22 Oct 2026 09:28:40 +0200 +Subject: [PATCH 2/2] Bump golang.org/x/net to v0.61.0 + +Fixes CVE-2026-78659, CVE-2026-78660, CVE-2026-78663, CVE-2026-78669 +and CVE-2026-97032 in golang.org/x/net/http2, which are flagged by CVE +scanners in the dhcp plugin. + +Pulls in the newer golang.org/x/{sync,sys,text,tools} modules that x/net +v0.61.0 requires, and bumps the go directive to 1.26.0 accordingly. + +Signed-off-by: Tom Wieczorek +--- + go.mod | 12 ++++++------ + go.sum | 20 ++++++++++---------- + 2 files changed, 16 insertions(+), 16 deletions(-) + +diff --git a/go.mod b/go.mod +index 513e7c8..0e25794 100644 +--- a/go.mod ++++ b/go.mod +@@ -1,6 +1,6 @@ + module github.com/containernetworking/plugins + +-go 1.24.2 ++go 1.26.0 + + require ( + github.com/Microsoft/hcsshim v0.13.0 +@@ -20,7 +20,7 @@ require ( + github.com/safchain/ethtool v0.6.2 + github.com/vishvananda/netlink v1.3.1 + github.com/vishvananda/netns v0.0.5 +- golang.org/x/sys v0.35.0 ++ golang.org/x/sys v0.49.0 + sigs.k8s.io/knftables v0.0.18 + ) + +@@ -48,10 +48,10 @@ require ( + go.opencensus.io v0.24.0 // indirect + go.uber.org/automaxprocs v1.6.0 // indirect + go.yaml.in/yaml/v3 v3.0.4 // indirect +- golang.org/x/net v0.43.0 // indirect +- golang.org/x/sync v0.16.0 // indirect +- golang.org/x/text v0.28.0 // indirect +- golang.org/x/tools v0.36.0 // indirect ++ golang.org/x/net v0.61.0 // indirect ++ golang.org/x/sync v0.24.0 // indirect ++ golang.org/x/text v0.43.0 // indirect ++ golang.org/x/tools v0.51.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20241015192408-796eee8c2d53 // indirect + google.golang.org/grpc v1.69.0 // indirect + google.golang.org/protobuf v1.36.7 // indirect +diff --git a/go.sum b/go.sum +index 708fef9..866acd8 100644 +--- a/go.sum ++++ b/go.sum +@@ -160,8 +160,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL + golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= + golang.org/x/net v0.0.0-20201110031124-69a78807bb2b/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= + golang.org/x/net v0.0.0-20210405180319-a5a99cb37ef4/go.mod h1:p54w0d4576C0XHj96bSt6lcn1PtDYWL6XObtHCRCNQM= +-golang.org/x/net v0.43.0 h1:lat02VYK2j4aLzMzecihNvTlJNQUq316m2Mr9rnM6YE= +-golang.org/x/net v0.43.0/go.mod h1:vhO1fvI4dGsIjh73sWfUVjj3N7CA9WkKJNQm2svM6Jg= ++golang.org/x/net v0.61.0 h1:RR+6j/BTBCrggOLugxa+66R8FvoN6MHlzDlZIbN9YFw= ++golang.org/x/net v0.61.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= + golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= + golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +@@ -169,8 +169,8 @@ golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJ + golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20210220032951-036812b2e83c/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +-golang.org/x/sync v0.16.0 h1:ycBJEhp9p4vXvUZNszeOq0kGTPghopOL8q0fq3vstxw= +-golang.org/x/sync v0.16.0/go.mod h1:1dzgHSNfp02xaA81J2MS99Qcpr2w7fw1gpm99rleRqA= ++golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= ++golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= + golang.org/x/sys v0.0.0-20180830151530-49385e6e1522/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +@@ -182,13 +182,13 @@ golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBc + golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.16.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA= +-golang.org/x/sys v0.35.0 h1:vz1N37gP5bs89s7He8XuIYXpyY0+QlsKmzipCbUtyxI= +-golang.org/x/sys v0.35.0/go.mod h1:BJP2sWEmIv4KK5OTEluFJCKSidICx8ciO85XgH3Ak8k= ++golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= ++golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= + golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= + golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +-golang.org/x/text v0.28.0 h1:rhazDwis8INMIwQ4tpjLDzUhx6RlXqZNPEM0huQojng= +-golang.org/x/text v0.28.0/go.mod h1:U8nCwOR8jO/marOQ0QbDiOngZVEBB7MAiitBuMjXiNU= ++golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= ++golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= + golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= + golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= + golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= +@@ -198,8 +198,8 @@ golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtn + golang.org/x/tools v0.0.0-20200619180055-7c47624df98f/go.mod h1:EkVYQZoAsY45+roYkvgYkIh4xh/qjgUK9TdY2XT94GE= + golang.org/x/tools v0.0.0-20210106214847-113979e3529a/go.mod h1:emZCQorbCU4vsT4fOWvOPXz4eW1wZW4PmDk9uLelYpA= + golang.org/x/tools v0.1.4/go.mod h1:o0xws9oXOQQZyjljx8fwUC0k7L1pTE6eaCbjGeHmOkk= +-golang.org/x/tools v0.36.0 h1:kWS0uv/zsvHEle1LbV5LE8QujrxB3wfQyxHfhOk0Qkg= +-golang.org/x/tools v0.36.0/go.mod h1:WBDiHKJK8YgLHlcQPYQzNCkUxUypCaa5ZegCVutKm+s= ++golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= ++golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA= + golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= + golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= + golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +-- +2.54.0 +