Skip to content

Commit 451ac10

Browse files
arp242arp242
committed
Update dependencies for auth/kerberos module
GitHub lists a bunch of security alerts for golang.org/x/crypto. I'm not sure if any of these affect us, but doesn't hurt to update. It bumps the Go version for that module, which is okay as it doesn't affect the main github.com/lib/pq module. Also test Go 1.27 in CI while we're at it, and use PostgreSQL 19beta3.
1 parent 4cd6ec5 commit 451ac10

6 files changed

Lines changed: 13 additions & 38 deletions

File tree

‎.github/workflows/test.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -28,7 +28,7 @@ jobs:
2828
fail-fast: false
2929
matrix:
3030
pg: ['14', '15', '16', '17', '18', '19']
31-
go: ['1.23', '1.26']
31+
go: ['1.23', '1.27']
3232
steps:
3333
- uses: 'actions/checkout@v6'
3434
- uses: 'actions/setup-go@v6'

‎auth/kerberos/go.mod‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
module github.com/lib/pq/auth/kerberos
22

3-
go 1.21
3+
go 1.25.0
44

55
require (
66
github.com/alexbrainman/sspi v0.0.0-20250919150558-7d374ff0d59e
@@ -14,6 +14,6 @@ require (
1414
github.com/jcmturner/gofork v1.7.6 // indirect
1515
github.com/jcmturner/goidentity/v6 v6.0.1 // indirect
1616
github.com/jcmturner/rpc/v2 v2.0.3 // indirect
17-
golang.org/x/crypto v0.6.0 // indirect
18-
golang.org/x/net v0.7.0 // indirect
17+
golang.org/x/crypto v0.55.0 // indirect
18+
golang.org/x/net v0.57.0 // indirect
1919
)

‎auth/kerberos/go.sum‎

Lines changed: 4 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -35,16 +35,18 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
3535
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
3636
golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w=
3737
golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc=
38-
golang.org/x/crypto v0.6.0 h1:qfktjS5LUO+fFKeJXZ+ikTRijMmljikvG68fpMMruSc=
3938
golang.org/x/crypto v0.6.0/go.mod h1:OFC/31mSvZgRz0V1QTNCzfAI1aIRzbiufJtkMIlEp58=
39+
golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M=
40+
golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis=
4041
golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4/go.mod h1:jJ57K6gSWd91VN4djpZkiMVwK6gcyfeH4XE8wZrZaV4=
4142
golang.org/x/net v0.0.0-20190620200207-3b0461eec859/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
4243
golang.org/x/net v0.0.0-20200114155413-6afb5195e5aa/go.mod h1:z5CRVTTTmAJ677TzLLGU+0bjPO0LkuOLi4/5GtJWs/s=
4344
golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg=
4445
golang.org/x/net v0.0.0-20220722155237-a158d28d115b/go.mod h1:XRhObCWvk6IyKnWLug+ECip1KBveYUHfp+8e9klMJ9c=
4546
golang.org/x/net v0.6.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
46-
golang.org/x/net v0.7.0 h1:rJrUqqhjsgNp7KqAIc25s9pZnjU7TUcSY7HcVZjdn1g=
4747
golang.org/x/net v0.7.0/go.mod h1:2Tu9+aMcznHK/AK1HMvgo6xiTLG5rD5rZLDS+rp2Bjs=
48+
golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
49+
golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
4850
golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
4951
golang.org/x/sync v0.0.0-20220722155255-886fb9371eb4/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM=
5052
golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY=

‎auth/kerberos/krb_unix.go‎

Lines changed: 3 additions & 21 deletions
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,9 @@ type GSS struct {
2525
func NewGSS() (*GSS, error) {
2626
g := &GSS{}
2727
err := g.init()
28-
2928
if err != nil {
3029
return nil, err
3130
}
32-
3331
return g, nil
3432
}
3533

@@ -50,32 +48,25 @@ func (g *GSS) init() error {
5048
}
5149

5250
ccpath := "/tmp/krb5cc_" + u.Uid
53-
54-
ccname := os.Getenv("KRB5CCNAME")
55-
if strings.HasPrefix(ccname, "FILE:") {
51+
if ccname := os.Getenv("KRB5CCNAME"); strings.HasPrefix(ccname, "FILE:") {
5652
ccpath = strings.SplitN(ccname, ":", 2)[1]
5753
}
58-
5954
ccache, err := credentials.LoadCCache(ccpath)
6055
if err != nil {
6156
return err
6257
}
63-
6458
cl, err := client.NewFromCCache(ccache, cfg, client.DisablePAFXFAST(true))
6559
if err != nil {
6660
return err
6761
}
6862

6963
cl.Login()
70-
7164
g.cli = cl
72-
7365
return nil
7466
}
7567

7668
// GetInitToken implements the GSS interface.
7769
func (g *GSS) GetInitToken(host string, service string) ([]byte, error) {
78-
7970
// Resolve the hostname down to an 'A' record, if required (usually, it is)
8071
if g.cli.Config.LibDefaults.DNSCanonicalizeHostname {
8172
var err error
@@ -84,26 +75,19 @@ func (g *GSS) GetInitToken(host string, service string) ([]byte, error) {
8475
return nil, err
8576
}
8677
}
87-
88-
spn := service + "/" + host
89-
90-
return g.GetInitTokenFromSpn(spn)
78+
return g.GetInitTokenFromSpn(service + "/" + host)
9179
}
9280

9381
// GetInitTokenFromSpn implements the GSS interface.
9482
func (g *GSS) GetInitTokenFromSpn(spn string) ([]byte, error) {
95-
s := spnego.SPNEGOClient(g.cli, spn)
96-
97-
st, err := s.InitSecContext()
83+
st, err := spnego.SPNEGOClient(g.cli, spn).InitSecContext()
9884
if err != nil {
9985
return nil, fmt.Errorf("kerberos error (InitSecContext): %w", err)
10086
}
101-
10287
b, err := st.Marshal()
10388
if err != nil {
10489
return nil, fmt.Errorf("kerberos error (Marshaling token): %w", err)
10590
}
106-
10791
return b, nil
10892
}
10993

@@ -114,11 +98,9 @@ func (g *GSS) Continue(inToken []byte) (done bool, outToken []byte, err error) {
11498
if err != nil {
11599
return true, nil, fmt.Errorf("kerberos error (Unmarshaling token): %w", err)
116100
}
117-
118101
state := t.NegTokenResp.State()
119102
if state != spnego.NegStateAcceptCompleted {
120103
return true, nil, fmt.Errorf("kerberos: expected state 'Completed' - got %d", state)
121104
}
122-
123105
return true, nil, nil
124106
}

‎auth/kerberos/krb_windows.go‎

Lines changed: 1 addition & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -17,11 +17,9 @@ type GSS struct {
1717
func NewGSS() (*GSS, error) {
1818
g := &GSS{}
1919
err := g.init()
20-
2120
if err != nil {
2221
return nil, err
2322
}
24-
2523
return g, nil
2624
}
2725

@@ -30,22 +28,17 @@ func (g *GSS) init() error {
3028
if err != nil {
3129
return err
3230
}
33-
3431
g.creds = creds
3532
return nil
3633
}
3734

3835
// GetInitToken implements the GSS interface.
3936
func (g *GSS) GetInitToken(host string, service string) ([]byte, error) {
40-
4137
host, err := canonicalizeHostname(host)
4238
if err != nil {
4339
return nil, err
4440
}
45-
46-
spn := service + "/" + host
47-
48-
return g.GetInitTokenFromSpn(spn)
41+
return g.GetInitTokenFromSpn(service + "/" + host)
4942
}
5043

5144
// GetInitTokenFromSpn implements the GSS interface.
@@ -54,9 +47,7 @@ func (g *GSS) GetInitTokenFromSpn(spn string) ([]byte, error) {
5447
if err != nil {
5548
return nil, err
5649
}
57-
5850
g.ctx = ctx
59-
6051
return token, nil
6152
}
6253

‎compose.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -30,7 +30,7 @@ services:
3030

3131
pg19:
3232
profiles: ['pg19']
33-
image: 'postgres:19beta2'
33+
image: 'postgres:19beta3'
3434
ports: ['127.0.0.1:5432:5432']
3535
entrypoint: '/init/entry.sh'
3636
volumes: ['./testdata/postgres:/init', './testdata/ssl:/ssl']

0 commit comments

Comments
 (0)