build: update to go1.22.4 (#23172)

Update Go toolchain to 1.22.4, which addresses two vulnerabilities in the Go
stdlib.

* CVE-2024-24789: impacts handling of certain types of invalid zip files, which
  could be exploited to create a zip file with unexpected contents. This could
  potentially impact Nomad users of `artifact` blocks who download untrusted
  artifacts.
* CVE-2024-24790: impacts parsing of IPv4-mapped IPv6 addresses.
This commit is contained in:
Tim Gross
2024-06-05 09:03:15 -04:00
committed by GitHub
parent e6bf43e825
commit c99428d553
6 changed files with 8 additions and 5 deletions

3
.changelog/23172.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:security
build: Updated Go to 1.22.4 to address Go stdlib vulnerabilities CVE-2024-24789 and CVE-2024-24790
```

View File

@@ -1 +1 @@
1.22.1
1.22.4

View File

@@ -30,7 +30,7 @@ A development environment is supplied via Vagrant to make getting started easier
Developing without Vagrant
---
1. Install [Go 1.22.1+](https://golang.org/) *(Note: `gcc-go` is not supported)*
1. Install [Go 1.22.4+](https://golang.org/) *(Note: `gcc-go` is not supported)*
1. Clone this repo
```sh
$ git clone https://github.com/hashicorp/nomad.git

2
go.mod
View File

@@ -1,6 +1,6 @@
module github.com/hashicorp/nomad
go 1.21
go 1.22
// Pinned dependencies are noted in github.com/hashicorp/nomad/issues/11826.
replace (

View File

@@ -21,7 +21,7 @@ case $(arch) in
esac
function install_go() {
local go_version="1.22.1"
local go_version="1.22.4"
local download="https://storage.googleapis.com/golang/go${go_version}.linux-${ARCH}.tar.gz"
if go version 2>&1 | grep -q "${go_version}"; then

View File

@@ -56,7 +56,7 @@ REPO_PATH="${TMP_WORKSPACE}/gopath/src/github.com/hashicorp/nomad"
mkdir -p "${TMP_WORKSPACE}/tmp"
install_go() {
local go_version="1.22.1"
local go_version="1.22.4"
local download=
download="https://storage.googleapis.com/golang/go${go_version}.darwin-amd64.tar.gz"