Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

fix: upgrade go-grpc package to fix panic bug #70

Merged
merged 5 commits into from
Aug 3, 2023

Conversation

Revolyssup
Copy link
Contributor

fixes: #69

@Sn0rt Sn0rt self-requested a review July 28, 2023 03:32
@@ -44,4 +44,5 @@ jobs:
- name: Script
run: |
export PATH=$OPENRESTY_PREFIX/nginx/sbin:$PATH
export GODEBUG=x509sha1=1

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do this?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

After updating the package, the certs in the tests cannot be used as the tests fail with an error that its insecure to use sha1 algorithm[1]. This runtime flag skips the check[2]

  1. crypto/x509: reject SHA-1 signatures in Verify golang/go#41682
  2. crypto/x509: respect GODEBUG changes during program lifetime [1.19 backport] golang/go#56438

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Either this, or we would need to regenerate certificates for tests using something like SHA256. Given these are just tests, I think using this flag is fine.

@monkeyDluffy6017 monkeyDluffy6017 merged commit 8b8bd75 into api7:main Aug 3, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

upgrade grpc-go client library to fix panic issue
3 participants