Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

BREAKING CHANGE/update kubo 0.29.0 #100

Merged
merged 20 commits into from
Oct 7, 2024

Conversation

D4ryl00
Copy link
Collaborator

@D4ryl00 D4ryl00 commented Aug 5, 2024

This PR updates kubo to v0.29.0 and its dependencies.
Because there are many breaking changes between the previous version and this new one, many fixes were made in this PR.

The gRPC package deprecated DialContext in favor of NewClient, the DNS resolver should be explicitly used: https://stackoverflow.com/questions/78485578/how-to-use-the-bufconn-package-with-grpc-newclient
We removed gogoproto for the API generation, but copied the utility functions to read/write proto messages, into the new package protoio.
The API is now generated with the official Golang protoc plugin instead of gogoproto.
By removing gogoproto, we also lost some fancy features, like renaming protobuf fields, enum prefix removal or field tags. So we had to rename many fields by their standard name, like accountPk instead of accountPK (k is now lowercase). We added a new buf generation tool to add field tags, that is used after protoc-gen-go by Buf.
The protobuf marshaling also wants UTF-8 compatibility for string data type. Because the rendez-vous point mechanism uses protobuf string that was not UTF-8 compliant, we now use base-64 conversion because marshaling rendez-vous point address.
To be able to compile the API files, we needed to update the docker image bertytech/buf dependencies.
The Buf version was bumped and the configuration files were updated to v2.

The new golangce-lint version is more strict, so we fixed many unused variables, use pointers instead of objects for event transmission.

Copy link

guardrails bot commented Aug 5, 2024

⚠️ We detected 20 security issues in this pull request:

Insecure Access Control (1)
Severity Details Docs
High Title: Missing User Instruction
FROM golang:1.22-alpine as builder
📚

More info on how to fix Insecure Access Control in Dockerfile.


Vulnerable Libraries (19)
Severity Details
High pkg:golang/golang.org/x/[email protected] upgrade to: > v0.23.0
High pkg:golang/github.com/srikrsna/[email protected] upgrade to: > v1.0.1
High pkg:golang/github.com/multiformats/[email protected] upgrade to: > v0.12.4
N/A pkg:golang/google.golang.org/[email protected] upgrade to: 1.64.1
High pkg:golang/github.com/ipfs/[email protected] upgrade to: > v0.1.0
Critical pkg:golang/github.com/libp2p/[email protected] upgrade to: > v0.25.2
High pkg:golang/github.com/prometheus/[email protected] upgrade to: > v1.19.1
Critical pkg:golang/github.com/berty/[email protected] upgrade to: > v0.5.1
Critical pkg:golang/berty.tech/[email protected] upgrade to: > v1.10.3-0.20240719141234-29e2d26e2aeb
Critical pkg:golang/github.com/libp2p/[email protected] upgrade to: > v0.11.1-0.20240711152552-e508d8643ddb
Critical pkg:golang/berty.tech/[email protected] upgrade to: > v1.3.1-0.20240722095251-c6b363b38785
Critical pkg:golang/github.com/libp2p/[email protected] upgrade to: > v0.34.1
High pkg:golang/go.uber.org/[email protected] upgrade to: > v1.27.0
Critical pkg:golang/github.com/ipfs/[email protected] upgrade to: > v0.29.0
High pkg:golang/github.com/stretchr/[email protected] upgrade to: > v1.9.0
High pkg:golang/go.uber.org/[email protected] upgrade to: > v1.3.0
Medium pkg:golang/github.com/multiformats/[email protected] upgrade to: > v0.2.3
Critical pkg:golang/berty.tech/[email protected] upgrade to: > v1.22.2-0.20240719144258-ec7d1faaca68
High pkg:golang/golang.org/x/[email protected] upgrade to: > v0.21.0

More info on how to fix Vulnerable Libraries in Go.


👉 Go to the dashboard for detailed results.

📥 Happy? Share your feedback with us.

@D4ryl00 D4ryl00 self-assigned this Oct 7, 2024
Copy link
Contributor

@jefft0 jefft0 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Tested between two locations with Berty mini and the iOS simulator.

@D4ryl00 D4ryl00 changed the title Chore/update kubo 0.29.0 BREAKING CHANGE/update kubo 0.29.0 Oct 7, 2024
@D4ryl00 D4ryl00 merged commit aaa7aae into berty:main Oct 7, 2024
17 checks passed
@D4ryl00 D4ryl00 deleted the chore/update-kubo-0.29.0 branch October 7, 2024 10:29
@D4ryl00 D4ryl00 mentioned this pull request Oct 17, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants