Skip to content

update vendor with https://github.com/openshift/library-go/pull/2001 #941

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
lance5890 wants to merge 1 commit into
base: main
Choose a base branch
from
Open

update vendor with https://github.com/openshift/library-go/pull/2001 #941

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ require (
github.com/onsi/ginkgo/v2 v2.27.2
github.com/onsi/gomega v1.38.2
github.com/openshift-eng/openshift-tests-extension v0.0.0-20251113163031-356b66aa5c24
github.com/openshift/api v0.0.0-20260408160412-464776f95207
github.com/openshift/api v0.0.0-20260521125114-09730f85d883
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee
github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a
github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720
github.com/prometheus/client_golang v1.23.2
github.com/prometheus/common v0.66.1
Expand Down Expand Up @@ -133,3 +133,5 @@ require (
// openshift-tests-extension (oteginkgo.BuildExtensionTestSpecsFromOpenShiftGinkgoSuite).
// Upstream ginkgo does not export these symbols (e.g. `Suite`); see https://github.com/openshift/onsi-ginkgo.
replace github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1

replace github.com/openshift/library-go => github.com/lance5890/library-go v0.0.0-20260605001424-f7fd773c8ec4
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Jun 5, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "1) Show the replacement in go.mod"
rg -n '^replace github.com/openshift/library-go' go.mod

echo
echo "2) Inspect the replaced module checksums in go.sum (hash pinning evidence)"
rg -n 'github.com/lance5890/library-go|github.com/openshift/library-go' go.sum

echo
echo "3) Query OSV for known vulns on both module names"
curl -s https://api.osv.dev/v1/query -d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | jq .
curl -s https://api.osv.dev/v1/query -d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | jq .

echo
echo "4) Capture fork module metadata (license/provenance pointers) from GitHub API"
curl -s https://api.github.com/repos/lance5890/library-go | jq '{full_name,private,fork,default_branch,license,parent,html_url,created_at,updated_at,pushed_at}'

echo
echo "5) Check for Sigstore/cosign-related release artifacts or attestations (if any)"
curl -s https://api.github.com/repos/lance5890/library-go/releases | jq '.[0:5] | map({tag_name,created_at,published_at,assets: [.assets[]?.name]})'

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 1063

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== GitHub API repo metadata (first 1k chars) =="
resp_repo="$(curl -sS https://api.github.com/repos/lance5890/library-go)"
echo "$resp_repo" | head -c 1000
echo
echo "== Parsed keys present =="
echo "$resp_repo" | jq 'keys'
echo
echo

echo "== GitHub API releases endpoint (first 1k chars) =="
resp_releases="$(curl -sS https://api.github.com/repos/lance5890/library-go/releases)"
echo "$resp_releases" | head -c 1000
echo
echo "== Parsed top-level type =="
echo "$resp_releases" | jq 'type'
echo
echo

echo "== OSV query raw (openshift path) =="
curl -sS https://api.osv.dev/v1/query \
  -d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | head -c 500
echo
echo "== OSV parsed (openshift path) =="
curl -sS https://api.osv.dev/v1/query \
  -d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | jq .
echo

echo
echo "== OSV query raw (lance fork path) =="
curl -sS https://api.osv.dev/v1/query \
  -d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | head -c 500
echo
echo "== OSV parsed (lance fork path) =="
curl -sS https://api.osv.dev/v1/query \
  -d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | jq .

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 1022

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== go.mod around line 137 =="
sed -n '120,155p' go.mod | cat -n

echo
echo "== go.sum entries for the forked module =="
rg -n 'github.com/(openshift/library-go|lance5890/library-go)\s+v0\.0\.0-20260605001424-f7fd773c8ec4' go.sum || true

echo
echo "== Count of replace directives touching openshift/library-go =="
rg -n '^replace .*openshift/library-go' go.mod || true

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 1779

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "1) Replacement in go.mod"
rg -n '^replace github.com/openshift/library-go' go.mod

echo
echo "2) Hash pins in go.sum"
rg -n 'github.com/(lance5890/library-go|openshift/library-go)\s+v0\.0\.0-20260605001424-f7fd773c8ec4' go.sum

echo
echo "3) OSV query (by module name)"
curl -sS https://api.osv.dev/v1/query \
  -d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | jq .
curl -sS https://api.osv.dev/v1/query \
  -d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | jq .

echo
echo "4) Fork metadata + license/provenance pointers (use token to avoid rate limits if needed)"
AUTH=""
if [ -n "${GITHUB_TOKEN:-}" ]; then
  AUTH="Authorization: Bearer ${GITHUB_TOKEN}"
fi
curl -sS ${AUTH:+-H "$AUTH"} https://api.github.com/repos/lance5890/library-go | jq '{full_name,private,fork,default_branch,license,parent,html_url,created_at,updated_at,pushed_at}'

echo
echo "5) Releases/artifacts (check for signing/attestations if any)"
releases="$(curl -sS ${AUTH:+-H "$AUTH"} https://api.github.com/repos/lance5890/library-go/releases)"
echo "$releases" | jq 'if type=="array" then .[0:5] | map({tag_name,created_at,published_at,assets:[.assets[]?.name]}) else . end'

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 706

🏁 Script executed:

#!/bin/bash
set -euo pipefail
rg -n 'library-go|lance5890' go.mod

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 279

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "Replacement (go.mod):"
rg -n '^replace github.com/openshift/library-go' go.mod

echo
echo "Hashes for replacement version (go.sum):"
rg -n 'github.com/(openshift/library-go|lance5890/library-go)\s+v0\.0\.0-20260605001424-f7fd773c8ec4' go.sum

echo
echo "OSV (openshift):"
curl -sS https://api.osv.dev/v1/query -d '{"package":{"ecosystem":"Go","name":"github.com/openshift/library-go"}}' | jq .

echo
echo "OSV (lance):"
curl -sS https://api.osv.dev/v1/query -d '{"package":{"ecosystem":"Go","name":"github.com/lance5890/library-go"}}' | jq .

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 555

Add supply-chain evidence for the github.com/openshift/library-go fork replacement (go.mod line 137)

  • go.mod replaces github.com/openshift/library-go with github.com/lance5890/library-go v0.0.0-20260605001424-f7fd773c8ec4, changing the upstream source of a widely used dependency.
  • The module is also explicitly required at github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720, so the trust anchor is altered by this replace.
  • go.sum includes hash pins for the replaced fork version, and OSV lookups for both module names returned no vulnerability records ({}), but the PR still lacks required supply-chain evidence: fork justification, license compatibility, provenance/SBOM/provenance-attestation info, and any Sigstore/cosign signing details for produced artifacts.
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 137, The PR replaces module github.com/openshift/library-go
with the fork github.com/lance5890/library-go
(v0.0.0-20260605001424-f7fd773c8ec4) in go.mod but lacks supply-chain evidence;
update the PR with a brief fork justification (why upstream wasn’t used), the
fork maintainer identity, license compatibility check against the original
module, and links to provenance artifacts (SBOM, build/release provenance or
attestation) for the forked release; also include any Sigstore/cosign signing
details or verification steps for published artifacts and call out the exact
replace statement in go.mod and the required version
github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720 so reviewers
can verify the changes.

12 changes: 6 additions & 6 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -139,6 +139,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
github.com/lance5890/library-go v0.0.0-20260605001424-f7fd773c8ec4 h1:HP4FeJ8+B6df8wSOQ9uXUDiXagO9LUudESij+TpHgBI=
github.com/lance5890/library-go v0.0.0-20260605001424-f7fd773c8ec4/go.mod h1:/HBhy6jm/igWI3Y1vYFwFG3ZCcXmnNsKUT6VBpPyM9A=
github.com/ledongthuc/pdf v0.0.0-20220302134840-0c2507a12d80/go.mod h1:imJHygn/1yfhB7XSJJKlFZKl/J+dCPAknuiaGOshXAs=
github.com/mailru/easyjson v0.7.7 h1:UGYAvKxe3sBsEDzO8ZeWOSlIQfWFlxbzLZe7hwFURr0=
github.com/mailru/easyjson v0.7.7/go.mod h1:xzfreul335JAWq5oZzymOObrkdz5UnU4kGfJJLY9Nlc=
Expand All @@ -156,14 +158,12 @@ github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
github.com/openshift-eng/openshift-tests-extension v0.0.0-20251113163031-356b66aa5c24 h1:bwmjtFaipakIwAyZxnDLgtkLY1Nf1nK9lRCmADvHirE=
github.com/openshift-eng/openshift-tests-extension v0.0.0-20251113163031-356b66aa5c24/go.mod h1:6gkP5f2HL0meusT0Aim8icAspcD1cG055xxBZ9yC68M=
github.com/openshift/api v0.0.0-20260408160412-464776f95207 h1:56S2U6pUgD3uYe8cQMsaBxQmUWIBpFw9YHOPFvfdfN4=
github.com/openshift/api v0.0.0-20260408160412-464776f95207/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/api v0.0.0-20260521125114-09730f85d883 h1:So9yxVJRY+F1aVBjcDw6N3M4h30wyH/GpkazK8xT4TI=
github.com/openshift/api v0.0.0-20260521125114-09730f85d883/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee h1:+Sp5GGnjHDhT/a/nQ1xdp43UscBMr7G5wxsYotyhzJ4=
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE=
github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7 h1:5GSoQlywIwYsRCw3qN+ZDmN6HrXTMZfI33bdRNm2jRQ=
github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7/go.mod h1:HhXTUIMhgzxR3Ln/zEkr4QjTL0NN7A+t9Py/we9j2ug=
github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720 h1:ljxETzJc/vDgMJlaSB8GRryBHZOAIENA2Wo5arD8avM=
github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720/go.mod h1:3bi4pLpYRdVd1aEhsHfRTJkwxwPLfRZ+ZePn3RmJd2k=
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a h1:EKx2XhOKehd1C5ptY7IrLl4WV35E8kP0pRPnG5BUZXk=
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a/go.mod h1:V933kvY/cb/Un7UCEOhXHUySNX327u7Epe8g9KNqg2Q=
github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1 h1:PMTgifBcBRLJJiM+LgSzPDTk9/Rx4qS09OUrfpY6GBQ=
github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
Expand Down
7 changes: 3 additions & 4 deletions vendor/github.com/openshift/api/config/v1/types_apiserver.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions vendor/github.com/openshift/api/config/v1/types_authentication.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions vendor/github.com/openshift/api/config/v1/types_cluster_operator.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

30 changes: 30 additions & 0 deletions vendor/github.com/openshift/api/config/v1/types_image.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 11 additions & 7 deletions vendor/github.com/openshift/api/config/v1/types_infrastructure.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading