prepare 6.8.0 release (launchdarkly#228)

* update gorilla/mux to 1.8.0

* update OpenCensus packages

* add Go 1.16 CI + "latest Go" CI + use latest 1.15 patch for release

* cimg images use "current", not "latest"

* seems there isn't any cimg/go "latest" or "current"

* add daily package build test in CI

* job names

* bump SDK version for traffic allocation feature

* [ch113491] update alpine base image (launchdarkly#258)

* use latest prerelease SDK

* fix enabling of test tags in CI

* add DynamoDB docker image in CI

* set a polling base URI in end-to-end tests since big segments logic will use it

* fix initialization logic so SDK client creation errors aren't lost when big segments are enabled

* fix use of prefix key in DynamoDB + improve tests (launchdarkly#260)

* more debug logging, less info logging for big segments logic

* make logging of big segments patch version mismatch clearer and use Warn level

* fix log parameter

* fix DynamoDB updates for big segments metadata

* add test to make sure sync time and cursor can be updated independently

* only start big seg synchronizer if necessary

* use SDK GA releases

* change applyPatch to exit early on version mismatch; go back to restarting stream in this case

* add unit tests for version mismatch behavior + DRY tests

* add log assertion

* fix retry logic on big segments stream failure

* add more logging for big segments connection status

* fix logging assertion

* add more big segments integration tests

* fix overly-time-sensitive file data tests

* fix more flaky tests

* run big segments tests with DynamoDB too

* Migrate transitive dep (jwt-go) to use modern version without vulnerability.

* Edit doc

* move Relay release logic to .ldrelease script

* suppress SDK big segments status query if we've never synced big segments

* dump Relay logs including debug logs if integration test fails

* include environment prefix in BigSegmentSynchronizer logging

* increase big segment integration test timeout (launchdarkly#274)

* generate client-side stream pings if big segments have changed

* clear big segments cache as needed + simplify state management

* fix tests and simplify component creation

* use GA releases of SDK packages

* disable CI package-build-test in Go 1.16+

* Migrate Relay release to Releaser v2 and support dry run (launchdarkly#278)

* Adding degraded doc blurb for big segments (launchdarkly#280)

* respect Redis password & TLS options for big segments; add Redis password integration tests

* redact Redis URL password in logs and status resource

* update go-server-sdk-redis-redigo to 1.2.1 for Redis URL logging fix

* Part 1, add the config and the documentation for the new config

* Part 2, Add the configuration validation and test

* Part 3, the actual logic to include the headers in the CORS Access-Control-Allow-Headers

* Linter

* update Alpine version to 3.14.2 to fix openssl CVEs

* Fix the global variable modification

* Go format

* turn off unnecessary metrics integrations in config for Docker smoke test

* rename test.env to smoke-test.env to clarify what it's for

* fix setting of custom Access-Control-Allow-Origin and add test (launchdarkly#285)

* add more explanatory test output and more verbose debugging for big segments integration tests (launchdarkly#287)

* update to Go 1.16.10 + Alpine 3.14.3; add some docs about releases (launchdarkly#288)

* update go-server-sdk-consul version for Consul API version update

* override x/crypto dependency version for CVE-2020-29652

* bump Prometheus dependency to eliminate jwt-go vulnerability

* drop support for Go 1.14 & 1.15

* make sure defaults are always applied for base URL properties

* rm unused

* rm unnecessary linter directive

* add separate configuration for server-side/client-side SDK base URLs & update the defaults

* remove Whitesource CI job + remove obsolete dependency issue note

* don't include any big segment status info in status resource unless that feature is active (launchdarkly#296)

* don't include any big segment status info in status resource unless that feature is active

* fix Big Segments staleness logic in status resource

* documentation

* update x/text package for vulnerability GO-2021-0113

* add Trivy security scan to CI (launchdarkly#297)

* add daily re-scan with Trivy

* use long timeout when awaiting changes related to file mod watching

* update Go version to 1.17.6 (launchdarkly#301)

* always terminate if auto-config stream fails with a fatal error

* pass along tags header when proxying events

* comments, rm debugging

* fix auth header logic

* fix auth header logic some more

* comments

* add tags header to CORS header whitelist (launchdarkly#304)

* update to Alpine 3.14.4 for CVE-2022-0778 fix

* force upgrade of openssl in Alpine

* also upgrade libretls

* fix it in both files

* update to Alpine 3.14.5 for CVE-2022-0778/CVE-2018-25032 (launchdarkly#308)

* update to Alpine 3.14.5 for CVE-2022-0778

* revert patches that are now included in Alpine 3.14.5

* add scripts for checking and updating Go/Alpine versions (launchdarkly#309)

* update to Alpine 3.14.5 for CVE-2022-0778

* add scripts for checking and updating Go/Alpine versions

* also make sure the Docker images really exist

* update CONTRIBUTING.md

* fix file rename

* revert patches that are now included in Alpine 3.14.5

* update Alpine to 3.14.6 for CVE-2022-28391

* update SDK packages (includes sc-136333 fix)

* don't include "v" prefix in Docker image version

* update go-server-sdk-dynamodb for data size error fix & add docs (launchdarkly#316)

* update builds to use Go 1.17.9 and fix the update script

* update go-server-sdk-consul to latest release

* update remote Docker version

* update golang.org/x/crypto for CVE-2022-27191 (launchdarkly#321)

* update golang.org/x/crypto for CVE-2022-27191

* fix go.sum

* update eventsource for SSE output efficiency fix (launchdarkly#322)

* Cache the replay event in case we get multiple new client connections (launchdarkly#189)

* Cache the replay event in case we get multiple new client connections

* Use singleflight to ensure only one replay event is generated at a time

Co-authored-by: Moshe Good <[email protected]>

* don't install curl in Docker images

* fix makefile logic for lint step

* remove indirect curl-based request logic in integration tests

* fix linter installation

* update Go to 1.17.11, Alpine to 3.16.0

* improve concurrency test to verify that the data is or isn't from a separate query

* fix lint warnings and remove unnecessary error return

* update libssl & libcrypto versions for CVE-2022-2097

* add security scan of already-published Docker image (launchdarkly#328)

* update Alpine version and some Go libraries to address CVEs (launchdarkly#329)

* use Alpine 3.16.1

* update golang.org/x/net and golang.org/x/sync patch versions for CVEs

* update golang.org/x/sys patch version for CVE

* update Prometheus client library for CVE-2022-21698

* ensure that DynamoDB config is consistent between Big Segments and regular data store

* comment

* update Alpine to 3.16.2

* update golangci-lint and go-junit-report

* fix CI

* prevent traversal of directories outside target path when expanding archive

* enforce TLS >= 1.2 for secure Redis

* misc linter updates

* fix test message

* add Go 1.18 & 1.19 jobs

* make test expectation less Go-version-dependent

* linting

* revert unnecessary change

* fix installation of test coverage tool

* migrate to AWS Go SDK v2 for DynamoDB (launchdarkly#333)

* update to Go 1.19.2

* update golang.org/x/net for CVE-2022-27664

* update golang.org/x/text for CVE-2022-32149

* update Consul API dependency to avoid false report of CVE-2022-40716

* switch to fork of Stackdriver metrics client to remove AWS transitive dependency (launchdarkly#343)

* update to Go 1.19.4 and Alpine 3.16.3

* override golang.org/x/net for CVE-2022-41717 only when building executables for release

* redo the security patch by updating go.mod for all builds; drop Go 1.16

* update Redis/DDB integrations to remove misleading error logging

* chore: drop go 1.17, 1.18 tests; add go 1.20 [v6] (launchdarkly#367)

* chore: drop go 1.17,1.18 tests; add go 1.20

* fix: Fix CVE-2022-41723 by overriding golang.org/x/net to v0.7.0

* chore: bump supported Go versions to 1.20.2 & 1.19.7 (launchdarkly#374)

go1.20.2 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the compiler, the covdata command, the linker, the runtime, and the crypto/ecdh, crypto/rsa, crypto/x509, os, and syscall packages.

go1.19.7 (released 2023-03-07) includes a security fix to the crypto/elliptic package, as well as bug fixes to the linker, the runtime, and the crypto/x509 and syscall packages.

* chore: update the LaunchDarkly REST API client to v12 (launchdarkly#375)

* chore: update api-client-go to v12.0.0

* chore: fix flaky autoconfig integration tests (launchdarkly#382)

* chore: modify testUpdatedSDKKeyWithExpiry to wait for healthy relay status

* increase statusPollTimeout and Interval for integration tests

* chore: update the integration test URL to properly account for prod environment (launchdarkly#384)

* chore: upgrade goreleaser to 1.16.1 (launchdarkly#396)

* chore: upgrade goreleaser to 1.16.1 and use conventional release artifact filenames

* chore: add tools.go to specify goreleaser version

---------

Co-authored-by: LaunchDarklyCI <[email protected]>
Co-authored-by: Eli Bishop <[email protected]>
Co-authored-by: hroederld <[email protected]>
Co-authored-by: LaunchDarklyReleaseBot <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Dan Richelson <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Ben Woskow <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Louis Chan <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Moshe Good <[email protected]>
Co-authored-by: Casey Waldren <[email protected]>

.circleci/config.yml

@@ -9,12 +9,12 @@ parameters:
   # override it in any parameterized builds, but just as a convenient shareable constant
   go-release-version:
     type: string
-    default: "1.20.1"
+    default: "1.20.2"
 
   # In addition to the most recent version of Go, we also support the previous version.
   go-previous-version:
     type: string
-    default: "1.19.6"
+    default: "1.19.7"
 
   # We use a remote Docker host in some CI jobs that need to run Docker containers.
   # As of 2022-04-15, the default Docker daemon version was 17.09.0-ce, which started
@@ -360,4 +360,3 @@ jobs:
           # after the time of the release). This is important because, if our build installs the
           # latest versions of things at the time that the build happens, a fresh build might be
           # getting patches that the released version did not have.
-

.goreleaser.yml

@@ -20,8 +20,8 @@ builds:
 
 nfpms:
   -
-    file_name_template: "{{ .ProjectName }}_{{ .Version }}.{{ .ShortCommit }}_{{ .Arch }}"
-
+    file_name_template: >-
+      {{ .ConventionalFileName }}
     homepage: https://launchdarkly.com/
     maintainer: LaunchDarkly <[email protected]>
     description: LaunchDarkly Stream Relay Proxy
@@ -32,23 +32,27 @@ nfpms:
     - deb
     - rpm
 
-    replacements:
-      386: i386
+    contents:
+      - src: linux/etc/ld-relay.conf
+        dst: /etc/ld-relay.conf
+        type: config
+
+      - src: linux/etc/init/ld-relay.conf
+        dst: /etc/init/ld-relay.conf
+        packager: deb
+
+      - src: linux/etc/system/ld-relay.service
+        dst: /usr/lib/systemd/system/ld-relay.service
+        packager: rpm
 
-    config_files:
-      "linux/etc/ld-relay.conf": "/etc/ld-relay.conf"
 
     overrides:
       deb:
         dependencies:
         - upstart
-        files:
-          "linux/etc/init/ld-relay.conf": "/etc/init/ld-relay.conf"
       rpm:
         dependencies:
         - systemd
-        files:
-          "linux/etc/system/ld-relay.service": "/usr/lib/systemd/system/ld-relay.service"
 
 release:
   disable: true # this disables releasing *to GitHub*; it will still push to Docker

.ldrelease/config.yml

@@ -38,7 +38,7 @@ repo:
 
 jobs:
   - docker:
-      image: cimg/go:1.20.1   # See "Runtime platform versions" in CONTRIBUTING.md
+      image: cimg/go:1.20.2   # See "Runtime platform versions" in CONTRIBUTING.md
       copyGitHistory: true
     template:
       name: go

Dockerfile

@@ -1,6 +1,6 @@
 # This is a standalone Dockerfile that does not depend on goreleaser building the binary
 # It is NOT the version that is pushed to dockerhub
-FROM golang:1.20.1-alpine3.16 as builder
+FROM golang:1.20.2-alpine3.16 as builder
 # See "Runtime platform versions" in CONTRIBUTING.md
 
 RUN apk --no-cache add \

Dockerfile.centos-test

@@ -1,8 +1,8 @@
 FROM centos
 
-COPY dist/ld-relay*amd64.rpm .
+COPY dist/ld-relay*x86_64.rpm .
 
-RUN rpm -Uvh ld-relay*amd64.rpm
+RUN rpm -Uvh ld-relay*x86_64.rpm
 
 RUN systemctl enable ld-relay.service
 

Makefile

@@ -4,8 +4,6 @@ GOLANGCI_LINT_VERSION=v1.51.2
 LINTER=./bin/golangci-lint
 LINTER_VERSION_FILE=./bin/.golangci-lint-version-$(GOLANGCI_LINT_VERSION)
 
-GORELEASER_VERSION=v0.141.0
-
 SHELL=/bin/bash
 
 LINTER=./bin/golangci-lint
@@ -63,17 +61,11 @@ RELEASE_NOTES=<(GIT_EXTERNAL_DIFF='bash -c "diff --unchanged-line-format=\"\" $$
 echo-release-notes:
 	@cat $(RELEASE_NOTES)
 
-RELEASE_CMD=curl -sL https://git.io/goreleaser | GOPATH=$(mktemp -d) VERSION=$(GORELEASER_VERSION) bash -s -- --rm-dist --release-notes $(RELEASE_NOTES)
-
-# Note that we're setting GOPATH to a temporary location when running goreleaser, because
-# we want it to start from a clean state even if we've previously run a build - and also
-# because during a release, we may need to run this command under another account and we
-# don't want to mess up file permissions in the regular GOPATH.
 publish:
-	./scripts/run-goreleaser.sh $(GORELEASER_VERSION)
+	./scripts/run-goreleaser.sh
 
 products-for-release:
-	./scripts/run-goreleaser.sh $(GORELEASER_VERSION) --skip-publish --skip-validate
+	./scripts/run-goreleaser.sh --skip-publish --skip-validate
 
 DOCKER_COMPOSE_TEST=docker-compose -f docker-compose.test.yml