prometheus-snmp-exporter: 0.22.0 -> 0.25.0

[r-ryantm]

Automatic update generated by nixpkgs-update tools. This update was made based on information from https://github.com/prometheus/snmp_exporter/releases.

meta.description for prometheus-snmp-exporter is: SNMP Exporter for Prometheus

meta.homepage for prometheus-snmp-exporter is: https://github.com/prometheus/snmp_exporter

Updates performed

• Golang update

To inspect upstream changes

• Release on GitHub

• Compare changes on GitHub

Impact

Checks done (click to expand)

---

• built on NixOS
• Warning: a test defined in passthru.tests did not pass
• found 0.23.0 in filename of file in /nix/store/fgvyqb6w1v3hpxdjmlgrlbgp1455bnrw-snmp_exporter-0.23.0

---

Rebuild report (if merged into master) (click to expand)

1 total rebuild path(s)

1 package rebuild(s)

First fifty rebuilds by attrpath
prometheus-snmp-exporter

Instructions to test this update (click to expand)

---

Either download from Cachix:

nix-store -r /nix/store/fgvyqb6w1v3hpxdjmlgrlbgp1455bnrw-snmp_exporter-0.23.0 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.

Or, build yourself:

nix-build -A prometheus-snmp-exporter https://github.com/r-ryantm/nixpkgs/archive/e3fe7d2b14b3496253ff476cc9e42132dfbf0845.tar.gz

After you've downloaded or built it, look at the files and if there are any, run the binaries:

ls -la /nix/store/fgvyqb6w1v3hpxdjmlgrlbgp1455bnrw-snmp_exporter-0.23.0
ls -la /nix/store/fgvyqb6w1v3hpxdjmlgrlbgp1455bnrw-snmp_exporter-0.23.0/bin

---

Pre-merge build results

We have automatically built all packages that will get rebuilt due to
this change.

This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.

Result of nixpkgs-review run on x86_64-linux 1

1 package built:

• prometheus-snmp-exporter

---

Maintainer pings

cc @oida @WilliButz @Frostman for testing.

[r-ryantm]

Automatic update generated by nixpkgs-update tools. This update was made based on information from https://github.com/prometheus/snmp_exporter/releases.

meta.description for prometheus-snmp-exporter is: SNMP Exporter for Prometheus

meta.homepage for prometheus-snmp-exporter is: https://github.com/prometheus/snmp_exporter

Updates performed

• Golang update

To inspect upstream changes

• Release on GitHub

• Compare changes on GitHub

Impact

Checks done (click to expand)

---

• built on NixOS
• Warning: a test defined in passthru.tests did not pass
• found 0.24.1 in filename of file in /nix/store/d4ms647q7ch9ach5dv98l7a4drqc0ff5-snmp_exporter-0.24.1

---

Rebuild report (if merged into master) (click to expand)

1 total rebuild path(s)

1 package rebuild(s)

First fifty rebuilds by attrpath
prometheus-snmp-exporter

Instructions to test this update (click to expand)

---

Either download from Cachix:

nix-store -r /nix/store/d4ms647q7ch9ach5dv98l7a4drqc0ff5-snmp_exporter-0.24.1 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.

Or, build yourself:

nix-build -A prometheus-snmp-exporter https://github.com/r-ryantm/nixpkgs/archive/99d56bc8e2d4055e32592efd5ca701cacdf8f28b.tar.gz

After you've downloaded or built it, look at the files and if there are any, run the binaries:

ls -la /nix/store/d4ms647q7ch9ach5dv98l7a4drqc0ff5-snmp_exporter-0.24.1
ls -la /nix/store/d4ms647q7ch9ach5dv98l7a4drqc0ff5-snmp_exporter-0.24.1/bin

---

Pre-merge build results

We have automatically built all packages that will get rebuilt due to
this change.

This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.

Result of nixpkgs-review run on x86_64-linux 1

1 package built:

• prometheus-snmp-exporter

---

Maintainer pings

cc @oida @WilliButz @Frostman for testing.

[r-ryantm]

Automatic update generated by nixpkgs-update tools. This update was made based on information from https://repology.org/project/snmp-exporter/versions.

meta.description for prometheus-snmp-exporter is: SNMP Exporter for Prometheus

meta.homepage for prometheus-snmp-exporter is: https://github.com/prometheus/snmp_exporter

Updates performed

• Golang update

To inspect upstream changes

• Release on GitHub

• Compare changes on GitHub

Impact

Checks done (click to expand)

---

• built on NixOS
• Warning: a test defined in passthru.tests did not pass
• found 0.25.0 in filename of file in /nix/store/l3v1xy4cl6vliapfxr8lbjk2wbai55j0-snmp_exporter-0.25.0

---

Rebuild report (if merged into master) (click to expand)

1 total rebuild path(s)

1 package rebuild(s)

First fifty rebuilds by attrpath
prometheus-snmp-exporter

Instructions to test this update (click to expand)

---

Either download from Cachix:

nix-store -r /nix/store/l3v1xy4cl6vliapfxr8lbjk2wbai55j0-snmp_exporter-0.25.0 \
  --option binary-caches 'https://cache.nixos.org/ https://nix-community.cachix.org/' \
  --option trusted-public-keys '
  nix-community.cachix.org-1:mB9FSh9qf2dCimDSUo8Zy7bkq5CX+/rkCWyvRCYg3Fs=
  cache.nixos.org-1:6NCHdD59X431o0gWypbMrAURkbJ16ZPMQFGspcDShjY=
  '

(The Cachix cache is only trusted for this store-path realization.)
For the Cachix download to work, your user must be in the trusted-users list or you can use sudo since root is effectively trusted.

Or, build yourself:

nix-build -A prometheus-snmp-exporter https://github.com/r-ryantm/nixpkgs/archive/7aa6a0efdd937a85ddeda25e80c0001421ebb3ef.tar.gz

Or:

nix build github:r-ryantm/nixpkgs/7aa6a0efdd937a85ddeda25e80c0001421ebb3ef#prometheus-snmp-exporter

After you've downloaded or built it, look at the files and if there are any, run the binaries:

ls -la /nix/store/l3v1xy4cl6vliapfxr8lbjk2wbai55j0-snmp_exporter-0.25.0
ls -la /nix/store/l3v1xy4cl6vliapfxr8lbjk2wbai55j0-snmp_exporter-0.25.0/bin

---

Pre-merge build results

We have automatically built all packages that will get rebuilt due to
this change.

This gives evidence on whether the upgrade will break dependent packages.
Note sometimes packages show up as failed to build independent of the
change, simply because they are already broken on the target branch.

Result of nixpkgs-review run on x86_64-linux 1

1 package built:

• prometheus-snmp-exporter

---

Maintainer pings

cc @oida @WilliButz @Frostman for testing.

[WilliButz]

@ofborg test prometheus-exporters.snmp

[LeSuisse]

@WilliButz Looking at the changelogs I'm not sure to see the security issue. Is this for this prometheus/snmp_exporter#968 ?

There are breaking changes in the 0.23.0 version, we will not be able to backport it to 23.11.

[WilliButz]

Now I'm a bit confused here as well, thank you for asking @LeSuisse.

Looking at the dependencies of the exporter version currently in nixpkgs I see exporter-toolkit at version 0.10.0 and I don't quite follow how it's supposed to be affected by https://nvd.nist.gov/vuln/detail/CVE-2022-46146.
According to upstream, the issue is supposed to be fixed with version 0.8.2 of the toolkit, and that was pulled in here prometheus/snmp_exporter@7dea13b.

Although https://security.gentoo.org/glsa/202401-15 shows that versions <0.24.1 are vulnerable, which I guess is based on this comment: https://bugs.gentoo.org/883649#c1

@mweinelt do you have some additional insights?

[mweinelt]

My bad, my info did indeed come from the Gentoo advisory and I did not check it further.

[WilliButz]

@mweinelt ah thank you for resolving the confusion, I also didn't check if it was indeed affected. I only checked that the dependency for 0.25.0 isn't and repurposed this PR.

In this case I'd just make this a regular update, drop the security label and add a small note to the 24.05 release notes about the breaking change. Also, I'll remove myself as maintainer here, as I'm not currently actively using the exporter.

[LeSuisse]

The Gentoo advisory seems to be incomplete, I think it refers to the commit you linked but it is available since 0.23.0 in this exporter 😅 .

For 23.11 we can probably backport only the lib update.

[WilliButz]

rebased on master to resolve the conflicting release notes.

For 23.11 we can probably backport only the lib update.

@LeSuisse I don't follow, which part would you want to backport?

[LeSuisse]

I was thinking of backporting prometheus/snmp_exporter@7dea13b

[WilliButz]

Oh, I think that is part of the misunderstanding. Version 0.22.0 is currently on stable, that already depends on a more recent version than the one referenced in that commit.

See https://github.com/prometheus/snmp_exporter/blob/v0.22.0/go.sum#L45-L46