Fix G402 reports with latest gosec version
#1416
Conversation
openshift-ci
bot
added
the
release-note-none
pull-request-size
bot
added
the
size/L
pkg/image/options.go
Outdated
| @@ -52,18 +52,10 @@ func GetOptions(ctx context.Context, imageName name.Reference, insecure bool, do | |||
| options = append(options, remote.WithContext(ctx)) | |||
|
|
|||
| transport := http.DefaultTransport.(*http.Transport).Clone() | |||
| transport.TLSClientConfig = &tls.Config{MinVersion: tls.VersionTLS12} | |||
There was a problem hiding this comment.
With insecure set to true, we in the past also did not set a MinVersion. Not sure if we want to change this.
There was a problem hiding this comment.
My rational was that with insure, the min version should not matter. But that was a hunch. I can also rewrite it to be more like the previous style.
There was a problem hiding this comment.
Hm, just notice that we forgot to even document the spec.output.insecure field in both Build and BuildRun. :-( And in the proposal we have not defined it in details (but wrote that it should be documented :-) ).
There was a problem hiding this comment.
There is sadly no other way to write that without getting yet another gosec issue.
Ref: securego/gosec#1044 (comment) Break up transport setup so that the `InsecureSkipVerify` is a single line, so that their latest changes can find the ignore statement at the exact statement level to be properly ignored. Refactor test code to only have the test client setup once.
HeavyWombat
force-pushed
the
fix/gosec-issue
branch
from
bc43952 to
4596605
Compare
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: SaschaSchwarze0 The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
bot
added
the
approved
|
Wasn't working due to Heroku. Thanks to @SaschaSchwarze0 for shipwright-io/sample-nodejs#11. |
Changes
Ref: securego/gosec#1044 (comment)
Break up transport setup so that the
InsecureSkipVerifyis a single line, so that their latest changes can find the ignore statement at the exact statement level to be properly ignored.Refactor test code to only have the test client setup once.
Submitter Checklist
See the contributor guide
for details on coding conventions, github and prow interactions, and the code review process.
Release Notes