Skip to content

WIP: Upgrade and Security Audit of dependencies.

martell requested to merge martell/gitlab-runner:glide-and-audit into master

What does this MR do?

This MR replaces go vendor with glide for easier package management. It also updates all libraries to reasonable stable versions where possible. There are many CVE's probably fixed along the way, most would only applicable to uses who already have access to gitlab but still better to be safe then sorry.

Why was this MR needed?

I plan to use gitlab-runner in a production like environment soon with azure container service. Security and stability is very important for my team so I started performing an audit in my free time. After looking at the vendor deps I refactored them into recent stable versions to harden and stabilize the runner. Go in general is not in great shape with regard to having consistent deps of deps but with glide I was able to abstract the versions we need of each library to make them consistent and readable.

Are there points in the code the reviewer needs to double check?

In the first 2 commits I replace govendor with glide The rest of the commits update individual deps along with any changes that need to be done with them.

Does this MR meet the acceptance criteria?

  • Tests
    • All builds are passing
Edited by martell

Merge request reports