Skip to content

WIP: OCPBUGS-85367: Set UserAgentSuffix for cert-recovery-controller #940

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
tchap wants to merge 2 commits into
base: main
Choose a base branch
from
Open

WIP: OCPBUGS-85367: Set UserAgentSuffix for cert-recovery-controller #940

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6496d5b
deps: Update library-go
tchap Jun 3, 2026
170c032
Set UserAgentSuffix on cert-recovery controller
tchap Jun 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 4 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,9 +9,9 @@ require (
github.com/onsi/ginkgo/v2 v2.27.2
github.com/onsi/gomega v1.38.2
github.com/openshift-eng/openshift-tests-extension v0.0.0-20251113163031-356b66aa5c24
github.com/openshift/api v0.0.0-20260408160412-464776f95207
github.com/openshift/api v0.0.0-20260521125114-09730f85d883
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee
github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a
Comment on lines +12 to +14

@coderabbitai coderabbitai Bot Jun 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟡 Minor | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
set -euo pipefail

# Read-only CVE checks against OSV for exact module@version pairs
curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' -d '{
  "package": {"name": "github.com/openshift/api", "ecosystem": "Go"},
  "version": "v0.0.0-20260521125114-09730f85d883"
}' | jq .

curl -s https://api.osv.dev/v1/query -H 'Content-Type: application/json' -d '{
  "package": {"name": "github.com/openshift/client-go", "ecosystem": "Go"},
  "version": "v0.0.0-20260512113608-deb4dc54551a"
}' | jq .

Repository: openshift/cluster-kube-controller-manager-operator

Length of output: 100

Update go.mod supply-chain check for OpenShift bumps

OSV lookups for the exact bumped versions in go.mod (github.com/openshift/api@v0.0.0-20260521125114-09730f85d883 and github.com/openshift/client-go@v0.0.0-20260512113608-deb4dc54551a) return no vulnerability entries. License/provenance compatibility isn’t evidenced by go.mod alone—add PR notes with license compatibility (and any required provenance/SBOM/signing evidence per your prodsec guidelines).

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` around lines 12 - 14, go.mod was updated with OpenShift module bumps
(github.com/openshift/api@v0.0.0-20260521125114-09730f85d883 and
github.com/openshift/client-go@v0.0.0-20260512113608-deb4dc54551a) but the PR
lacks supply-chain notes: update the PR description (or add a dedicated
CHANGELOG/SECURITY note) to state the license compatibility for each bumped
module and attach any required provenance/SBOM/signing evidence per prodsec
guidelines (e.g., link to upstream license files, verification of
hashes/signatures, SBOM or source provenance) so reviewers can validate
supply-chain compliance for those two dependencies.

github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720
github.com/prometheus/client_golang v1.23.2
github.com/prometheus/common v0.66.1
Expand Down Expand Up @@ -133,3 +133,5 @@ require (
// openshift-tests-extension (oteginkgo.BuildExtensionTestSpecsFromOpenShiftGinkgoSuite).
// Upstream ginkgo does not export these symbols (e.g. `Suite`); see https://github.com/openshift/onsi-ginkgo.
replace github.com/onsi/ginkgo/v2 => github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1

replace github.com/openshift/library-go => github.com/tchap/library-go v0.0.0-20260603115914-0690a6474e6d

@coderabbitai coderabbitai Bot Jun 3, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

Avoid unguarded long-lived fork replacement for library-go in go.mod.

go.mod (line 137) replaces github.com/openshift/library-go with github.com/tchap/library-go v0.0.0-20260603115914-0690a6474e6d (pseudo-version pinned to a specific commit), but this introduces broader supply-chain/behavior risk across all transitive library-go imports. Add an explicit temporary guardrail/expiry (upstream PR/commit target + removal condition/timeline) and include the verification note expected by your guidelines for provenance/license compatibility and your SBOM/provenance + Sigstore/cosign signing expectations for the build artifacts.

🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@go.mod` at line 137, The replace directive swapping
github.com/openshift/library-go to github.com/tchap/library-go at a specific
pseudo-version is unguarded; update the replace entry’s surrounding comment and
repository governance by adding an explicit temporary guardrail: state the
reason (e.g., critical bug/security fix), reference the upstream PR/commit that
this fork is intended to be replaced by (include the PR number or commit hash),
set a clear removal condition or timeline (e.g., "remove after upstream PR
merged and vendor updated, target date YYYY-MM-DD or within N weeks"), and add a
verification note that the fork was validated for provenance/license
compatibility and that SBOM/Sigstore/cosign signing will be applied to built
artifacts; ensure this metadata is adjacent to the replace directive in go.mod
so future maintainers see the justification and removal criteria for the
library-go replacement.

12 changes: 6 additions & 6 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -156,14 +156,12 @@ github.com/onsi/gomega v1.38.2 h1:eZCjf2xjZAqe+LeWvKb5weQ+NcPwX84kqJ0cZNxok2A=
github.com/onsi/gomega v1.38.2/go.mod h1:W2MJcYxRGV63b418Ai34Ud0hEdTVXq9NW9+Sx6uXf3k=
github.com/openshift-eng/openshift-tests-extension v0.0.0-20251113163031-356b66aa5c24 h1:bwmjtFaipakIwAyZxnDLgtkLY1Nf1nK9lRCmADvHirE=
github.com/openshift-eng/openshift-tests-extension v0.0.0-20251113163031-356b66aa5c24/go.mod h1:6gkP5f2HL0meusT0Aim8icAspcD1cG055xxBZ9yC68M=
github.com/openshift/api v0.0.0-20260408160412-464776f95207 h1:56S2U6pUgD3uYe8cQMsaBxQmUWIBpFw9YHOPFvfdfN4=
github.com/openshift/api v0.0.0-20260408160412-464776f95207/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/api v0.0.0-20260521125114-09730f85d883 h1:So9yxVJRY+F1aVBjcDw6N3M4h30wyH/GpkazK8xT4TI=
github.com/openshift/api v0.0.0-20260521125114-09730f85d883/go.mod h1:pyVjK0nZ4sRs4fuQVQ4rubsJdahI1PB94LnQ8sGdvxo=
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee h1:+Sp5GGnjHDhT/a/nQ1xdp43UscBMr7G5wxsYotyhzJ4=
github.com/openshift/build-machinery-go v0.0.0-20250530140348-dc5b2804eeee/go.mod h1:8jcm8UPtg2mCAsxfqKil1xrmRMI3a+XU2TZ9fF8A7TE=
github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7 h1:5GSoQlywIwYsRCw3qN+ZDmN6HrXTMZfI33bdRNm2jRQ=
github.com/openshift/client-go v0.0.0-20260330134249-7e1499aaacd7/go.mod h1:HhXTUIMhgzxR3Ln/zEkr4QjTL0NN7A+t9Py/we9j2ug=
github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720 h1:ljxETzJc/vDgMJlaSB8GRryBHZOAIENA2Wo5arD8avM=
github.com/openshift/library-go v0.0.0-20260409165127-c57da2bf5720/go.mod h1:3bi4pLpYRdVd1aEhsHfRTJkwxwPLfRZ+ZePn3RmJd2k=
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a h1:EKx2XhOKehd1C5ptY7IrLl4WV35E8kP0pRPnG5BUZXk=
github.com/openshift/client-go v0.0.0-20260512113608-deb4dc54551a/go.mod h1:V933kvY/cb/Un7UCEOhXHUySNX327u7Epe8g9KNqg2Q=
github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1 h1:PMTgifBcBRLJJiM+LgSzPDTk9/Rx4qS09OUrfpY6GBQ=
github.com/openshift/onsi-ginkgo/v2 v2.6.1-0.20251001123353-fd5b1fb35db1/go.mod h1:7Du3c42kxCUegi0IImZ1wUQzMBVecgIHjR1C+NkhLQo=
github.com/orisano/pixelmatch v0.0.0-20220722002657-fb0b55479cde/go.mod h1:nZgzbfBr3hhjoZnS66nKrHmduYNpc34ny7RK4z5/HM0=
Expand Down Expand Up @@ -212,6 +210,8 @@ github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO
github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o6fzry7u4=
github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U=
github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U=
github.com/tchap/library-go v0.0.0-20260603115914-0690a6474e6d h1:KyQ4YFHt7OXlEuEQFSjEldk4BkCUJShraW6ADeTNj0Y=
github.com/tchap/library-go v0.0.0-20260603115914-0690a6474e6d/go.mod h1:/HBhy6jm/igWI3Y1vYFwFG3ZCcXmnNsKUT6VBpPyM9A=
github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75 h1:6fotK7otjonDflCTK0BCfls4SPy3NcCVb5dqqmbRknE=
github.com/tmc/grpc-websocket-proxy v0.0.0-20220101234140-673ab2c3ae75/go.mod h1:KO6IkyS8Y3j8OdNO85qEYBsRPuteD+YciPomcXdrMnk=
github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
Expand Down
1 change: 1 addition & 0 deletions pkg/cmd/recoverycontroller/cmd.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -57,6 +57,7 @@ func NewCertRecoveryControllerCommand(ctx context.Context) *cobra.Command {
// TODO: Remove when the internal logic can start serving without extension-apiserver-authentication
// and live reload extension-apiserver-authentication after it is available
ccc.DisableServing = true
ccc.UserAgentSuffix = "cert-recovery"

cmd := ccc.NewCommandWithContext(ctx)
cmd.Use = "cert-recovery-controller"
Expand Down
7 changes: 3 additions & 4 deletions vendor/github.com/openshift/api/config/v1/types_apiserver.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions vendor/github.com/openshift/api/config/v1/types_authentication.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

5 changes: 3 additions & 2 deletions vendor/github.com/openshift/api/config/v1/types_cluster_operator.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

30 changes: 30 additions & 0 deletions vendor/github.com/openshift/api/config/v1/types_image.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

18 changes: 11 additions & 7 deletions vendor/github.com/openshift/api/config/v1/types_infrastructure.go
View file
Open in desktop

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading