bump go to 1.22.6

[BergCyrill]

Due to unfixed CVEs in go <1.22.4 bump the used go version to build the provider to 1.22.6

The CVE (CVE-2024-24790) scores a 9.8 in the national vulnerability database.

[vmwclabot]

@BergCyrill, you must sign every commit in this pull request acknowledging our Developer Certificate of Origin before your changes are merged. This can be done by adding Signed-off-by: John Doe <[email protected]> to the last line of each Git commit message. The e-mail address used to sign must match the e-mail address of the Git author. Click here to view the Developer Certificate of Origin agreement.

• Commit d226ff0 must be signed by [email protected]

[BergCyrill]

All commits are signed & signoff was made according to the dco. I don't unterstand why the vmwclabot doesn't recognize this, I think it is a false behaviour.

[vmwclabot]

@BergCyrill, you must sign every commit in this pull request acknowledging our Developer Certificate of Origin before your changes are merged. This can be done by adding Signed-off-by: John Doe <[email protected]> to the last line of each Git commit message. The e-mail address used to sign must match the e-mail address of the Git author. Click here to view the Developer Certificate of Origin agreement.

• Commit afe29cd must be signed by [email protected]

[vmwclabot]

@BergCyrill, you must sign every commit in this pull request acknowledging our Developer Certificate of Origin before your changes are merged. This can be done by adding Signed-off-by: John Doe <[email protected]> to the last line of each Git commit message. The e-mail address used to sign must match the e-mail address of the Git author. Click here to view the Developer Certificate of Origin agreement.

• Commit b83c418 must be signed by [email protected]

[BergCyrill]

Ok tried to fix the dco-required label-issue. Worked for me on the terraform-provider-nsxt github project but not here.

[vmwclabot]

@BergCyrill, you must sign every commit in this pull request acknowledging our Developer Certificate of Origin before your changes are merged. This can be done by adding Signed-off-by: John Doe <[email protected]> to the last line of each Git commit message. The e-mail address used to sign must match the e-mail address of the Git author. Click here to view the Developer Certificate of Origin agreement.

• Commit b83c418 must be signed by [email protected]

[vmwclabot]

@BergCyrill, you must sign every commit in this pull request acknowledging our Developer Certificate of Origin before your changes are merged. This can be done by adding Signed-off-by: John Doe <[email protected]> to the last line of each Git commit message. The e-mail address used to sign must match the e-mail address of the Git author. Click here to view the Developer Certificate of Origin agreement.

• Commit f930556 must be signed by [email protected]

[BergCyrill]

Linting should now work with selected go toolchain version. The clabot still behaves weird.

[BergCyrill]

Is there anything that prevents this PR from being merged? The provider is currently unusable for me since it will not pass vulnerability checks.

[tenthirtyam]

The DCO issue is related to the author mismatch in f930556 where [email protected] is using instead of [email protected].

commit dc48680d554cde221465f7baab18c728697947f7 (HEAD -> bump-go-1.22.6, origin/bump-go-1.22.6)
Author: Cyrill Berg <[email protected]>
Date:   Tue Aug 27 20:44:16 2024 +0200

    build: seperate toolchain version definition
    
    Signed-off-by: Cyrill Berg <[email protected]>

commit 819aea41da34d5709f5f0aa5dc1d8675f44306ac
Author: Cyrill Berg <[email protected]>
Date:   Tue Aug 27 20:40:43 2024 +0200

    ci: bump used golangci lint to supported version
    
    Signed-off-by: Cyrill Berg <[email protected]>

commit f9305564d2cc69d041add802de4a23bb55c69daf
Author: Cyrill Berg <[email protected]>
Date:   Tue Aug 20 08:56:59 2024 +0200

    bump go to 1.22.6
    
    Signed-off-by: Cyrill Berg <[email protected]>

Try:

git checkout f9305564d2cc69d041add802de4a23bb55c69daf

git commit --amend --author="Cyrill Berg <[email protected]>"

git push --force

[BergCyrill]

Thank you, I have totally overlooked this little detail in the commit author field. Should be better now.

[tenthirtyam]

Thank you, I have totally overlooked this little detail in the commit author field. Should be better now.

Looks good!

[BergCyrill]

@tenthirtyam is there anything I could do to get this PR merged and released?

[BergCyrill]

Anyone who can give an update on this? It gives a bad feeling if high severity CVE are not fixed for such a long time even when someone tries to contribute. I'm willing to help just give me a hint what is missing?!

[tenthirtyam]

I'll ping the PM tomorrow.

[tenthirtyam]

PMs have been informed.