oadp-1.1: Fix CVE-2023-39325 (vmware-tanzu#294)

* go1.19 build

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

* go1.19 requires code-generator to be owned by script runner

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

* `make update`

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

* Makefile.prow: move code-generator to update-generated-crd-code.sh

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

---------

Signed-off-by: Tiger Kaovilai <tkaovila@redhat.com>

.github/workflows/crds-verify-kind.yaml

@@ -14,7 +14,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.18
+          go-version: 1.19
         id: go
       # Look for a CLI that's made for this PR
       - name: Fetch built CLI

.github/workflows/e2e-test-kind.yaml

@@ -14,7 +14,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.18
+          go-version: 1.19
         id: go
       # Look for a CLI that's made for this PR
       - name: Fetch built CLI
@@ -71,7 +71,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.18
+          go-version: 1.19
         id: go
       - name: Check out the code
         uses: actions/checkout@v2

.github/workflows/pr-ci-check.yml

@@ -8,7 +8,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v2
         with:
-          go-version: 1.18
+          go-version: 1.19
         id: go
       - name: Check out the code
         uses: actions/checkout@v2

.github/workflows/push.yml

@@ -18,7 +18,7 @@ jobs:
     - name: Set up Go
       uses: actions/setup-go@v2
       with:
-        go-version: 1.18
+        go-version: 1.19
       id: go
 
     - name: Check out code into the Go module directory

.travis.yml

@@ -2,7 +2,7 @@ os: linux
 services: docker
 dist: focal
 language: go
-go: 1.18
+go: 1.19
 
 env:
   global:

Dockerfile

@@ -13,7 +13,7 @@
 # limitations under the License.
 
 # Velero binary build section
-FROM --platform=$BUILDPLATFORM golang:1.18.8 as velero-builder
+FROM --platform=$BUILDPLATFORM golang:1.19 as velero-builder
 
 ARG GOPROXY
 ARG BIN

Makefile.prow

@@ -1,5 +1,5 @@
 # warning: verify this inside a container with following:
-# docker run -it --rm -v `pwd`:`pwd` -w `pwd` golang:1.18 bash -c "make -f Makefile.prow ci"
+# docker run -it --rm -v `pwd`:`pwd` -w `pwd` golang:1.19 bash -c "make -f Makefile.prow ci"
 # 
 # otherwise unintended system changes may include, replacing your currently installed kubectl, binaries in GOBIN, files in GOPATH/src
 # 
@@ -22,7 +22,7 @@ ci:
 	make -f $(MAKEFILE) verify all test
 
 .PHONY: verify
-verify: goimports code-generator controller-gen kubectl
+verify: goimports controller-gen kubectl
 # add PROWBIN to PATH
 	@echo Verifying with PATH=$(PROWBIN):$(PATH)
 # Per
@@ -69,13 +69,6 @@ $(GOBIN)/goimports:
 	go install golang.org/x/tools/cmd/goimports@latest
 	@echo Installed goimports
 
-.PHONY: code-generator
-code-generator: $(GOSRC)/k8s.io/code-generator
-
-$(GOSRC)/k8s.io/code-generator:
-	mkdir -p $(GOSRC)/k8s.io/
-	cd $(GOSRC)/k8s.io/ && git clone -b v$(CODEGEN_VERSION) https://github.com/kubernetes/code-generator
-
 .PHONY: controller-gen
 controller-gen: $(GOBIN)/controller-gen
 

Tiltfile

@@ -50,7 +50,7 @@ git_sha = str(local("git rev-parse HEAD", quiet = True, echo_off = True)).strip(
 
 tilt_helper_dockerfile_header = """
 # Tilt image
-FROM golang:1.18 as tilt-helper
+FROM golang:1.19 as tilt-helper
 
 # Support live reloading with Tilt
 RUN wget --output-document /restart.sh --quiet https://raw.githubusercontent.com/windmilleng/rerun-process-wrapper/master/restart.sh  && \

go.mod

@@ -1,6 +1,6 @@
 module github.com/vmware-tanzu/velero
 
-go 1.18
+go 1.19
 
 require (
 	cloud.google.com/go/storage v1.10.0

hack/build-image/Dockerfile

@@ -12,20 +12,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.18.8
+FROM golang:1.19
 
 ARG GOPROXY
 
 ENV GO111MODULE=on
 # Use a proxy for go modules to reduce the likelihood of various hosts being down and breaking the build
 ENV GOPROXY=${GOPROXY}
 
-# get code-generation tools (for now keep in GOPATH since they're not fully modules-compatible yet)
-RUN mkdir -p /go/src/k8s.io
-WORKDIR /go/src/k8s.io
-RUN git config --global advice.detachedHead false
-RUN git clone -b v0.22.2 https://github.com/kubernetes/code-generator
-
 # kubebuilder test bundle is separated from kubebuilder. Need to setup it for CI test.
 RUN curl -sSLo envtest-bins.tar.gz https://go.kubebuilder.io/test-tools/1.22.1/linux/amd64 && \
     mkdir /usr/local/kubebuilder && \

hack/update-generated-crd-code.sh

@@ -25,16 +25,17 @@ if [[ -z "${GOPATH}" ]]; then
   GOPATH=~/go
 fi
 
-if [[ ! -d "${GOPATH}/src/k8s.io/code-generator" ]]; then
-  echo "k8s.io/code-generator missing from GOPATH"
-  exit 1
-fi
-
 if ! command -v controller-gen > /dev/null; then
   echo "controller-gen is missing"
   exit 1
 fi
 
+# get code-generation tools (for now keep in GOPATH since they're not fully modules-compatible yet)
+mkdir -p ${GOPATH}/src/k8s.io
+pushd ${GOPATH}/src/k8s.io
+git clone -b v0.22.2 https://github.com/kubernetes/code-generator
+popd
+
 ${GOPATH}/src/k8s.io/code-generator/generate-groups.sh \
   all \
   github.com/vmware-tanzu/velero/pkg/generated \