From 8b2fae71f4b860ca02fc04bd9a59642371aaf916 Mon Sep 17 00:00:00 2001 From: Mike Haller Date: Wed, 27 Mar 2024 10:51:28 +0000 Subject: [PATCH 1/3] Update packages in ORT config, resolutions. --- .ort.yml | 18 +++++++++++++++--- 1 file changed, 15 insertions(+), 3 deletions(-) diff --git a/.ort.yml b/.ort.yml index 7edf0d92..99e2eadf 100644 --- a/.ort.yml +++ b/.ort.yml @@ -18,7 +18,11 @@ curations: curations: comment: "Proper license is defined in package repository https://pypi.org/project/identify/" concluded_license: "MIT" - - id: "Conan::c-ares:1.18.1" + - id: "PyPI::setuptools:69.2.0" + curations: + comment: "Proper license is defined in package repository https://pypi.org/project/setuptools/" + concluded_license: "MIT" + - id: "Conan::c-ares:1.19.1" curations: comment: "Proper license is defined in package repository https://conan.io/center/c-ares" concluded_license: "MIT" @@ -30,11 +34,11 @@ curations: curations: comment: "Proper license is defined in package repository https://conan.io/center/googleapis?version=cci.20221108" concluded_license: "Apache-2.0" - - id: "Conan::libcurl:7.87.0" + - id: "Conan::libcurl:8.12.0" curations: comment: "Proper license is defined in package repository https://conan.io/center/libcurl?version=7.87.0" concluded_license: "curl" - - id: "Conan::openssl:1.1.1t" + - id: "Conan::openssl:1.1.1u" curations: comment: "Proper license is defined in package repository https://conan.io/center/openssl?version=1.1.1t" concluded_license: "OpenSSL" @@ -42,3 +46,11 @@ curations: curations: comment: "Proper license is defined in package repository https://conan.io/center/paho-mqtt-c?version=1.3.9" concluded_license: "EPL-2.0" +resolutions: + vulnerabilities: + - id: "CVE-2023-3817" + reason: WILL_NOT_FIX_VULNERABILITY + comment: "Checking excessively long DH keys or parameters may be very slow. Low severity, the OpenSSL SSL/TLS implementation is not affected by this issue." + - id: "CVE-2023-32001" + reason: WILL_NOT_FIX_VULNERABILITY + comment: "Vulnerability has been rejected by CVE. As of August 2023, the curl security team has retracted this issue." \ No newline at end of file From 3cd2baa55c56e312f105739ba067c02b499d576c Mon Sep 17 00:00:00 2001 From: Mike Haller Date: Wed, 27 Mar 2024 12:26:51 +0000 Subject: [PATCH 2/3] Remove temporary workaround --- .devcontainer/scripts/onCreateCommand.sh | 7 ------- 1 file changed, 7 deletions(-) diff --git a/.devcontainer/scripts/onCreateCommand.sh b/.devcontainer/scripts/onCreateCommand.sh index 432ebbcc..8c9a5659 100755 --- a/.devcontainer/scripts/onCreateCommand.sh +++ b/.devcontainer/scripts/onCreateCommand.sh @@ -17,13 +17,6 @@ # exit when any command fails set -e -# restart Docker connection if in Codespaces -# Workaround according to https://github.com/devcontainers/features/issues/671#issuecomment-1701754897 -if [ "${CODESPACES}" = "true" ]; then - sudo pkill dockerd && sudo pkill containerd - /usr/local/share/docker-init.sh -fi - echo "#######################################################" echo "### Run VADF Lifecycle Management ###" echo "#######################################################" From 64a6cb6daa9f623ba6aca8a9b75a3e92d124b8f8 Mon Sep 17 00:00:00 2001 From: Mike Haller Date: Wed, 27 Mar 2024 12:42:20 +0000 Subject: [PATCH 3/3] Removing temporary workaround --- .devcontainer/scripts/onCreateCommand.sh | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/.devcontainer/scripts/onCreateCommand.sh b/.devcontainer/scripts/onCreateCommand.sh index 8c9a5659..432ebbcc 100755 --- a/.devcontainer/scripts/onCreateCommand.sh +++ b/.devcontainer/scripts/onCreateCommand.sh @@ -17,6 +17,13 @@ # exit when any command fails set -e +# restart Docker connection if in Codespaces +# Workaround according to https://github.com/devcontainers/features/issues/671#issuecomment-1701754897 +if [ "${CODESPACES}" = "true" ]; then + sudo pkill dockerd && sudo pkill containerd + /usr/local/share/docker-init.sh +fi + echo "#######################################################" echo "### Run VADF Lifecycle Management ###" echo "#######################################################"