Skip to content

PEM-8858: Update forklift version to 2.9 vesion#22

Open
shphadnis wants to merge 620 commits intospectro-v2.7.0from
spectro-v2.9.2
Open

PEM-8858: Update forklift version to 2.9 vesion#22
shphadnis wants to merge 620 commits intospectro-v2.7.0from
spectro-v2.9.2

Conversation

@shphadnis
Copy link

No description provided.

red-hat-konflux bot and others added 30 commits June 10, 2025 13:21
Image created from 'https://github.com/kubev2v/forklift?rev=5af5fb43da71d874d884089728aae365507057b1'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=2a1f48099a6a7244a072757ac20ea9b69d7c2353'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=2a1f48099a6a7244a072757ac20ea9b69d7c2353'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift-must-gather?rev=026a474a8ea6c094ee0995fad12b6734e9b44c3f'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift-console-plugin?rev=8bf5f3e043b711abab51c0bf71c7926a8fa18bd4'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=5af5fb43da71d874d884089728aae365507057b1'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=5af5fb43da71d874d884089728aae365507057b1'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=5af5fb43da71d874d884089728aae365507057b1'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=5af5fb43da71d874d884089728aae365507057b1'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
)

When getting an error for single provider, we were returning an error
response status, which caused the UI to display an "inventory cannot be
reached" error rather than showing the information for the providers
that succeeded. Change this to log the error but still return partial
data to provide a better user experience.

Fixes https://issues.redhat.com/browse/MTV-2701

Signed-off-by: Jonathon Jongsma <jjongsma@redhat.com>
…with error "Running and RunStrategy are mutually exclusive" (kubev2v#1989)

Issue:
Creating a virtual machine with "Operating System" type "Linux" in RHV,
the inventory cache of forklift have other_linux as OS type. This will
not match any cluster preference and fallback to template selection, For
template selection, it will search for templates with label rhel8.1 .
That will be rhel8 templates and in OpenShift Virtualization < 4.18,
these templates have "running" in spec which shuld be deprecated but we
still need to backword compatible.

Fix:
Adding running to template and identify which methos is being used in
the template and update accordingly .

ref: https://issues.redhat.com/browse/MTV-2671

Signed-off-by: Elad <ehazan@redhat.com>
Co-authored-by: Yaacov Zamir <kobi.zamir@gmail.com>
Issue:
Template validation errors are not very helpful

Fix:
Add more information about template validation errors

Examples:
``` bash
14:50 $ oc mtv plan create bad-template-1 -S vmw --vms mtv-func-win2022 --pvc-name-template "pvc-{{ .FileName }}"
No target provider specified, using default OpenShift provider: host
NetworkMap 'bad-template-1-hc77x' created in namespace 'openshift-mtv'
StorageMap 'bad-template-1-f5dzv' created in namespace 'openshift-mtv'
No target namespace specified, using plan namespace: openshift-mtv
Plan 'bad-template-1' created in namespace 'openshift-mtv'

14:51 $ oc mtv plan create bad-template-2 -S vmw --vms mtv-func-win2022 --pvc-name-template "pvc-{{ .fileName }}"
No target provider specified, using default OpenShift provider: host
NetworkMap 'bad-template-2-4gq4x' created in namespace 'openshift-mtv'
StorageMap 'bad-template-2-6nzpp' created in namespace 'openshift-mtv'
No target namespace specified, using plan namespace: openshift-mtv
Plan 'bad-template-2' created in namespace 'openshift-mtv'
```

``` bash
15:09 $ oc logs forklift-controller-7c85686cf8-ldfbk | grep "template is invalid"
Defaulted container "main" out of: main, inventory
{"level":"info","ts":"2025-06-10 12:09:11.164","logger":"plan|9q8v8","msg":"Condition deleted.","plan":{"name":"bad-template-1","namespace":"openshift-mtv"},"condition":{"type":"NotValid","status":"True","category":"Critical","message":"PVC name template is invalid: Template output is not a valid k8s label [pvc-[test07_ds1] test_sp/test-000001.vmdk]","lastTransitionTime":"2025-06-10T11:51:13Z"}}
{"level":"debug","ts":"2025-06-10 12:09:11.165","logger":"events","msg":"PVC name template is invalid: Template output is not a valid k8s label [pvc-[test07_ds1] test_sp/test-000001.vmdk]","type":"Warning","object":{"kind":"Plan","namespace":"openshift-mtv","name":"bad-template-1","uid":"fc60121c-5e59-4d58-acd8-3a93f27547d8","apiVersion":"forklift.konveyor.io/v1beta1","resourceVersion":"2257841"},"reason":"NotValid"}
{"level":"info","ts":"2025-06-10 12:09:11.173","logger":"plan|sb6sk","msg":"Condition deleted.","plan":{"name":"bad-template-2","namespace":"openshift-mtv"},"condition":{"type":"NotValid","status":"True","category":"Critical","message":"PVC name template is invalid: Template execution failed caused by: 'Template execution failed' caused by: 'template: template:1:7: executing \"template\" at <.fileName>: can't evaluate field fileName in type v1beta1.PVCNameTemplateData'","lastTransitionTime":"2025-06-10T11:51:29Z"}}
```

---------

Signed-off-by: yaacov <kobi.zamir@gmail.com>
Issue:
We moved out of the konveyor to a new life as kubev2v
  - We are no longer part of konveyor
  - We are no longer hosted in the konveyor github namespace
  - Links and pkg names in our project still link to konveyor

Fix:
 - [x] Update our package name to use kubev2v
- [x] Fix broken links to use the new github kubev2v namespace and
project name

Signed-off-by: yaacov <kobi.zamir@gmail.com>
Issue:
kubev2v#1662 was overridden and got
lost after it was merged

Fix:
This PR re-intruduce the changes from
kubev2v#1662

Signed-off-by: yaacov <kobi.zamir@gmail.com>
AccessMode is required for PVC, and when a
StorageMap.Map[].Destination.AccessMode doesn't specify
what accessMode to set, the migration fails on creating the PVC.

Signed-off-by: Roy Golan <rgolan@redhat.com>
Signed-off-by: Stefan Olenocin <solenoci@redhat.com>
…le binding

The generated pv-reader role needs to be bounded to new subjects
whenever there is a new target namespace. To solve it the binding is
patched to include the current subject

https://issues.redhat.com/browse/MTV-2708

Signed-off-by: Roy Golan <rgolan@redhat.com>
Issue:
Connection failed when create OCP Provider with "Fetch certificate from URL"

Fix:
The validate connection status was added by mistake to ocp provider as part of a conclustive tls issues fixes.

Ref: https://issues.redhat.com/browse/MTV-2715
Signed-off-by: Elad <ehazan@redhat.com>
Image created from 'https://github.com/kubev2v/forklift?rev=d4a26036171eecae1c964e22a5a7ceb8a20a37cb'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=d4a26036171eecae1c964e22a5a7ceb8a20a37cb'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=d4a26036171eecae1c964e22a5a7ceb8a20a37cb'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift-console-plugin?rev=a59d66d8749721353206228adb04240fea1e4dfe'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=c810643129b38d65f2846246a9dfa5e4d15daca3'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=d4a26036171eecae1c964e22a5a7ceb8a20a37cb'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=d4a26036171eecae1c964e22a5a7ceb8a20a37cb'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=d4a26036171eecae1c964e22a5a7ceb8a20a37cb'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Image created from 'https://github.com/kubev2v/forklift?rev=d4a26036171eecae1c964e22a5a7ceb8a20a37cb'

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: Martin Necas <mnecas@redhat.com>
…ubev2v#2006)

Image created from
'https://github.com/kubev2v/forklift-console-plugin?rev=3551533127babd3c9cba84e26bc996e9698440fa'

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
|
quay.io/redhat-user-workloads/rh-mtv-1-tenant/forklift-operator-dev-preview/forklift-console-plugin-dev-preview
| digest | `afd3b17` -> `07eda05` |

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the
rebase/retry checkbox.

👻 **Immortal**: This PR will be recreated if closed unmerged. Get
[config
help](https://redirect.github.com/renovatebot/renovate/discussions) if
that's undesired.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

To execute skipped test pipelines write comment `/ok-to-test`

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzOC4xMzIuMC1ycG0iLCJ1cGRhdGVkSW5WZXIiOiIzOC4xMzIuMC1ycG0iLCJ0YXJnZXRCcmFuY2giOiJtYWluIiwibGFiZWxzIjpbImtvbmZsdXgtbnVkZ2UiXX0=-->

Signed-off-by: red-hat-konflux <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Co-authored-by: red-hat-konflux[bot] <126015336+red-hat-konflux[bot]@users.noreply.github.com>
Signed-off-by: Stefan Olenocin <solenoci@redhat.com>
Signed-off-by: Stefan Olenocin <solenoci@redhat.com>
lokesh-guduruS and others added 15 commits February 11, 2026 17:39
…t conditions. The lint job is commented out, and the coverage report now runs only after tests complete, improving workflow clarity and execution.
…eps to continue on error, improving resilience in the absence of baseline data or SonarQube configuration.
…sed on the presence of SONAR_TOKEN, enhancing flexibility in configuration.
…coverage results to Codecov, streamlining the coverage reporting process.
Removes 111 newly added test files (26,086 LOC) to make the PR
more manageable for review. Modified test files are kept intact.
…anner cleanup

- Fix blocking: consolidate duplicate imports in validation_test.go
  (condition/libcnd, core/v1, meta/metav1) to single aliases
- Fix important: uncomment lint job in pull-request.yml CI workflow
- Fix important: add comment explaining metrics_test.go sum threshold (1.0)
- Fix nit: remove 'Merged from' banner comments in 6 test files
- Note: newKubevirtFakeClientWithFieldIndexes IS used (5 call sites in same file)
PVM-6: Upgrade golang version in VMO to fix critical vulnerability
Copy link

@bulwark-spectrocloud bulwark-spectrocloud bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2024-2955
    • Module: github.com/gin-contrib/cors
    • Found in: v1.3.1
    • Fixed in: v1.6.0
    • Example Traces:
      1. pkg/lib/inventory/web/web.go:45:21: web.Start calls cors.New, which eventually calls web.Start

Please review these findings and fix the issues before merging.

spectrosanjana and others added 2 commits March 3, 2026 09:19
PVM-6: Upgrade golang version in VMO to fix critical vulnerability
Copy link

@bulwark-spectrocloud bulwark-spectrocloud bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2024-2955
    • Module: github.com/gin-contrib/cors
    • Found in: v1.3.1
    • Fixed in: v1.6.0
    • Example Traces:
      1. pkg/lib/inventory/web/web.go:45:21: web.Start calls cors.New, which eventually calls web.Start

Please review these findings and fix the issues before merging.

Copy link

@bulwark-spectrocloud bulwark-spectrocloud bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoSec scan found code issues:

  1. G115: integer overflow conversion uint64 -> int64, Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/filebacked/file.go:330:12
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:531:8
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:126:13
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/kubevirt.go:2359:15
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/vsphere/builder.go:880:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/vsphere/builder.go:879:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ova/builder.go:354:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ova/builder.go:353:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:378:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:377:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:376:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:115:23
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encoder.go:77:34
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:371:25
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:338:25
    • ... (truncated), run gosec locally to capture all failure for the rule G115
  2. G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/vm_name_handler.go:112:16
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/kubevirt.go:1779:10
  3. G402: TLS InsecureSkipVerify set to true., Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/client/openstack/client.go:180:48
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib-volume-populator/populator-machinery/controller.go:1071:52
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/validation/policy/client.go:204:24
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/web/base/client.go:313:24
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/ovirt/client.go:66:53
  4. G401: Use of weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/util/util.go:99:9
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/inventory/model/table.go:667:7
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/vsphere/utils.go:12:10
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/validation.go:1231:9
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/client.go:264:14
  5. G505: Blocklisted import crypto/sha1: weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/util/util.go:5:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/inventory/model/table.go:5:2
  6. G501: Blocklisted import crypto/md5: weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/vsphere/utils.go:4:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/validation.go:5:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/client.go:4:2

Please review these findings and fix the issues before merging.

Copy link

@bulwark-spectrocloud bulwark-spectrocloud bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2024-2955
    • Module: github.com/gin-contrib/cors
    • Found in: v1.3.1
    • Fixed in: v1.6.0
    • Example Traces:
      1. pkg/lib/inventory/web/web.go:45:21: web.Start calls cors.New, which eventually calls web.Start

Please review these findings and fix the issues before merging.

Copy link

@bulwark-spectrocloud bulwark-spectrocloud bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoSec scan found code issues:

  1. G115: integer overflow conversion uint64 -> int64, Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/filebacked/file.go:330:12
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:531:8
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:126:13
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/kubevirt.go:2359:15
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/vsphere/builder.go:880:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/vsphere/builder.go:879:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ova/builder.go:354:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ova/builder.go:353:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:378:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:377:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:376:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:115:23
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encoder.go:77:34
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:371:25
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:338:25
    • ... (truncated), run gosec locally to capture all failure for the rule G115
  2. G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/vm_name_handler.go:112:16
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/kubevirt.go:1779:10
  3. G402: TLS InsecureSkipVerify set to true., Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/client/openstack/client.go:180:48
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib-volume-populator/populator-machinery/controller.go:1071:52
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/validation/policy/client.go:204:24
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/web/base/client.go:313:24
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/ovirt/client.go:66:53
  4. G401: Use of weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/util/util.go:99:9
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/inventory/model/table.go:667:7
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/vsphere/utils.go:12:10
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/validation.go:1231:9
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/client.go:264:14
  5. G505: Blocklisted import crypto/sha1: weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/util/util.go:5:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/inventory/model/table.go:5:2
  6. G501: Blocklisted import crypto/md5: weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/vsphere/utils.go:4:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/validation.go:5:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/client.go:4:2

Please review these findings and fix the issues before merging.

Copy link

@bulwark-spectrocloud bulwark-spectrocloud bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoVulnCheck scan found vulnerabilities:

  1. GO-2024-2955
    • Module: github.com/gin-contrib/cors
    • Found in: v1.3.1
    • Fixed in: v1.6.0
    • Example Traces:
      1. pkg/lib/inventory/web/web.go:45:21: web.Start calls cors.New, which eventually calls web.Start

Please review these findings and fix the issues before merging.

Copy link

@bulwark-spectrocloud bulwark-spectrocloud bot left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ GoSec scan found code issues:

  1. G115: integer overflow conversion uint64 -> int64, Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/filebacked/file.go:330:12
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:531:8
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:126:13
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/kubevirt.go:2359:15
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/vsphere/builder.go:880:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/vsphere/builder.go:879:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ova/builder.go:354:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ova/builder.go:353:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:378:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:377:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/builder.go:376:18
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:115:23
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encoder.go:77:34
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:371:25
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/gob/encode.go:338:25
    • ... (truncated), run gosec locally to capture all failure for the rule G115
  2. G404: Use of weak random number generator (math/rand or math/rand/v2 instead of crypto/rand), Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/vm_name_handler.go:112:16
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/kubevirt.go:1779:10
  3. G402: TLS InsecureSkipVerify set to true., Severity: HIGH
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/client/openstack/client.go:180:48
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib-volume-populator/populator-machinery/controller.go:1071:52
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/validation/policy/client.go:204:24
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/web/base/client.go:313:24
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/ovirt/client.go:66:53
  4. G401: Use of weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/util/util.go:99:9
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/inventory/model/table.go:667:7
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/vsphere/utils.go:12:10
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/validation.go:1231:9
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/client.go:264:14
  5. G505: Blocklisted import crypto/sha1: weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/util/util.go:5:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/lib/inventory/model/table.go:5:2
  6. G501: Blocklisted import crypto/md5: weak cryptographic primitive, Severity: MEDIUM
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/provider/container/vsphere/utils.go:4:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/validation.go:5:2
      1. File: /home/runner/_work/bulwark/bulwark/target-repo/pkg/controller/plan/adapter/ovirt/client.go:4:2

Please review these findings and fix the issues before merging.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.