Pin OSV to v1.4.2 (not v1.4.3) until v1.5.0 comes out?
Closed, ResolvedPublic
Actions

Assigned To

Authored By

	Jdforrester-WMF
	Nov 14 2023, 9:41 PM

Description

Per https://github.com/google/osv-scanner/issues/639 there's a bug upstream that is blocking us from using the Application Security Pipeline for function-orchestrator; it's solved upstream and will be fixed in v1.5.0 when that comes out, but until then would it be possible to pin the ASP to v1.4.2 as they recommend?

I believe that currently we're just pointed at @v1 per https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/blob/main/generic-osv/osv-ci.yaml?ref_type=heads#L33

Details

	Title	Reference	Author	Source Branch	Dest Branch
	Bump version to 1.4.2 due to bug in osv cli	repos/security/gitlab-ci-security-templates!26	sbassett	T351263-bump-osv-version-due-to-error	main

Customize query in GitLab

Related Objects

Mentioned Here: T352089: Error from using ASP v0.1.3; attempted `apt-get update` in 'step_script' fails

Event Timeline

Jdforrester-WMF created this task.Nov 14 2023, 9:41 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptNov 14 2023, 9:41 PM

sbassett added a project: Security-Team.Nov 27 2023, 5:04 PM

sbassett changed the task status from Open to In Progress.Nov 27 2023, 5:11 PM

sbassett claimed this task.

sbassett triaged this task as High priority.

sbassett added a project: user-sbassett.

sbassett moved this task from Backlog to In Progress on the user-sbassett board.

sbassett added a project: SecTeam-Processed.

sbassett opened https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/merge_requests/26

Bump version to 1.4.2 due to bug in osv cli

sbassett merged https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/merge_requests/26

Bump version to 1.4.2 due to bug in osv cli

Maintenance_bot removed a project: Patch-For-Review.Nov 27 2023, 7:11 PM

New release tagged, which incorporates this now-resolved issue: https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/tags/0.1.3

Should be ready for use:

include:
  - project: 'repos/security/gitlab-ci-security-templates'
    ref: 0.1.3
    file: 'generic-osv/osv-ci.yaml'

sbassett moved this task from In Progress to Done on the user-sbassett board.Nov 27 2023, 7:11 PM

In T351263#9360824, @sbassett wrote:
New release tagged, which incorporates this now-resolved issue: https://gitlab.wikimedia.org/repos/security/gitlab-ci-security-templates/-/tags/0.1.3

Should be ready for use:
include:
  - project: 'repos/security/gitlab-ci-security-templates'
    ref: 0.1.3
    file: 'generic-osv/osv-ci.yaml'

Thanks! Unfortunately it looks like the difference from v0.1.2 breaks us in other ways. Will file a follow-up.

In T351263#9360995, @Jdforrester-WMF wrote:

Thanks! Unfortunately it looks like the difference from v0.1.2 breaks us in other ways. Will file a follow-up.

I think we're ok now, given our Slack conversation and T352089#9361319?

In T351263#9361483, @sbassett wrote:

In T351263#9360995, @Jdforrester-WMF wrote:

Thanks! Unfortunately it looks like the difference from v0.1.2 breaks us in other ways. Will file a follow-up.

I think we're ok now, given our Slack conversation and T352089#9361319?

Yup.

Pin OSV to v1.4.2 (not v1.4.3) until v1.5.0 comes out?Closed, ResolvedPublicActions

Description

Details

Related Objects

Event Timeline

Pin OSV to v1.4.2 (not v1.4.3) until v1.5.0 comes out?
Closed, ResolvedPublic
Actions