-
Notifications
You must be signed in to change notification settings - Fork 295
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
mattermost-10.2/10.2.1-r0: cve remediation #36938
mattermost-10.2/10.2.1-r0: cve remediation #36938
Conversation
Gen AI suggestions to solve the build error: Based on the error output, I'll analyze and provide a solution: • Detected Error: "go: go.mod file not found in current directory or any parent directory; see 'go help modules'" • Error Category: Build Configuration • Failure Point: The • Root Cause Analysis: • Suggested Fix: - uses: go/bump
working-directory: server
with:
deps: golang.org/x/[email protected] • Explanation: • Additional Notes:
• References:
The fix aligns with Mattermost's repository structure where Go code is maintained in the server subdirectory, ensuring proper module management during the build process. |
e4f376e
to
9ca23d6
Compare
Gen AI suggestions to solve the build error: Let me analyze the build error and provide a solution: • Detected Error: None explicitly shown in the output, but the build appears to stop after the git checkout step • Error Category: Configuration • Failure Point: After git-checkout step in the pipeline • Root Cause Analysis: • Suggested Fix:
- uses: git-checkout
with:
repository: https://github.com/mattermost/mattermost
tag: v${{package.version}}
expected-commit: d5218ee031bcd31f69a027b183cac72a6142b351
fetch-depth: 2
environment:
contents:
packages:
# existing packages...
environment:
GIT_CLONE_DEPTH: "2" • Explanation: • Additional Notes:
• References:
|
Gen AI suggestions to solve the build error: Based on the build log, I'll analyze and provide a solution. • Detected Error: Build appears to fail silently after "Running go mod tidy with go version '1.23.4' ..." • Error Category: Version/Configuration • Failure Point: go/bump step attempting to modify dependencies in ./server directory • Root Cause Analysis: The Go version 1.23.4 specified in the build environment is invalid. The latest Go version is 1.21.x, there is no Go 1.23.x series. • Suggested Fix:
environment:
contents:
packages:
- go-1.21
# ... other packages ...
- runs: |
cd server
go mod edit -go=1.21
go mod tidy • Explanation:
• Additional Notes:
• References:
The fix should allow the build to proceed with dependency updates using a supported Go version. |
Signed-off-by: Mark McCormick <[email protected]>
2b6e39e
to
d10a7ff
Compare
Gen AI suggestions to solve the build error: • Detected Error: Cannot find module providing package github.com/mattermost/enterprise/* with "terminal prompts disabled" errors • Error Category: Dependency/Build • Failure Point: Go module dependency resolution during • Root Cause Analysis: The build is trying to access private enterprise repositories from Mattermost without proper authentication, and the enterprise features are enabled in the build flags. • Suggested Fix:
- working-directory: server
pipeline:
- runs: make modules-tidy
- runs: |
unset LDFLAGS
make GOFLAGS="" config-reset
make BUILD_ENTERPRISE=false BUILD_ENTERPRISE_READY=false BUILD_NUMBER=chainguard build-cmd
make BUILD_ENTERPRISE=false BUILD_ENTERPRISE_READY=false package-linux • Explanation: • Additional Notes:
• References: |
Signed-off-by: Ville Aikas <[email protected]>
Gen AI suggestions to solve the build error: • Detected Error: Multiple "cannot find module" errors for github.com/mattermost/enterprise/* packages with "fatal: could not read Username for 'https://github.com': terminal prompts disabled" • Error Category: Build/Dependency • Failure Point: Go module resolution during build process, specifically when trying to access enterprise modules • Root Cause Analysis: The build is failing because it's trying to access private enterprise repositories from Mattermost without proper authentication. These enterprise modules are not publicly accessible. • Suggested Fix: Add BUILD_ENTERPRISE=false to the make commands to build the open-source version only. Update the pipeline section: - working-directory: server
pipeline:
- uses: go/bump
with:
deps: golang.org/x/[email protected]
modroot: .
- runs: |
unset LDFLAGS
make BUILD_ENTERPRISE=false BUILD_ENTERPRISE_READY=false GOFLAGS="" config-reset
make BUILD_ENTERPRISE=false BUILD_ENTERPRISE_READY=false BUILD_NUMBER=chainguard build-cmd
make BUILD_ENTERPRISE=false BUILD_ENTERPRISE_READY=false package-linux • Explanation: Mattermost has both open-source and enterprise components. The enterprise components are in private repositories. By setting BUILD_ENTERPRISE=false, we explicitly tell the build system to skip the enterprise features and only build the open-source components. • Additional Notes:
• References: |
Signed-off-by: Ville Aikas <[email protected]>
mattermost-10.2/10.2.1-r0: fix GHSA-v778-237x-gjrc
Advisory data: https://github.com/wolfi-dev/advisories/blob/main/mattermost-10.2.advisories.yaml