Demo app duplicated in 5 languages (Go/JavaScript/Python/Ruby/Rust) showing how to go from source code to container image using melange+apko

Chainguard

Last update: Jan 23, 2023

Related tags

Overview

hello-melange-apko 💫

This repo contains an example app duplicated across 5 languages showing how to:

Package source code into APKs using melange
Build and publish OCI images from APKs using apko

The app itself is a basic HTTP server that returns "Hello World!"

$ curl -s http://localhost:8080
Hello World!

Wondering what "APKs" are? They're OS packages with a .apk extension (similar to .rpm / .deb) that are compatible with apk.

Variations

Language	Repo Path	GitHub Action	Notes
Go	`go/`	`go.yml`	uses gin
JavaScript	`js/`	`js.yml`	uses express, vendors node_modules, depends on nodejs
Python	`py/`	`py.yml`	uses flask, vendors virtualenv, depends on python3
Ruby	`ruby/`	`ruby.yml`	uses sinatra, vendors bundle, depends on ruby
Rust	`rust/`	`rust.yml`	uses hyper, currently builds very slow cross-platform

Note: third-party server frameworks are used intentionally to validate the use of dependencies.

"The hard way"

This section shows how to run through each of the build stages locally and pushing an image to GHCR.

Requirements:

Note: these steps should also work without docker on an apk-based Linux distribution such as Alpine.

Change directory

All of the following steps in this section assume that from the root of this repository, you have changed directory to one of the variations:

cd go/   # for Go
cd js/   # for JavaScript
cd py/   # for Python
cd ruby/ # for Ruby
cd rust/ # for Rust

Build apks with melange

Make sure the packages/ directory is removed:

rm -rf ./packages/

Create a temporary melange keypair:

docker run --rm -v "${PWD}":/work cgr.dev/chainguard/melange keygen

Build an apk for all architectures using melange:

docker run --rm --privileged -v "${PWD}":/work \
    cgr.dev/chainguard/melange build melange.yaml \
    --arch amd64,aarch64,armv7 \
    --signing-key melange.rsa

To debug the above:

docker run --rm --privileged -it -v "${PWD}":/work \
    --entrypoint sh \
    cgr.dev/chainguard/melange

# Build apks (use just --arch amd64 to isolate issue)
melange build melange.yaml \
    --arch amd64,aarch64,armv7 \
    --signing-key melange.rsa

# Install an apk
apk add ./packages/x86_64/hello-server-*.apk --allow-untrusted --force-broken-world

# Delete an apk
apk del hello-server --force-broken-world

Build image with apko

Note: you could skip this step and go to "Push image with apko".

Build an apk for all architectures using melange:

# Your GitHub username
GITHUB_USERNAME="myuser"
REF="ghcr.io/${GITHUB_USERNAME}/hello-melange-apko/$(basename "${PWD}")"

docker run --rm -v "${PWD}":/work \
    cgr.dev/chainguard/apko build --debug apko.yaml \
    "${REF}" output.tar -k melange.rsa.pub \
    --arch amd64,aarch64,armv7

If you do not wish to push the image, you could load it directly:

ARCH_REF="$(docker load < output.tar | grep "Loaded image" | sed 's/^Loaded image: //' | head -1)"
docker run --rm --rm -p 8080:8080  "${ARCH_REF}"

Note: The output of docker load will print all architectures. The command above just picks the first one. You could also choose to run docker load < output.tar and manually copy the architecture that matches your system.

To debug the above:

docker run --rm -it -v "${PWD}":/work \
    -e REF="${REF}" \
    --entrypoint sh \
    cgr.dev/chainguard/apko

# Build image (use just --arch amd64 to isolate issue)
apko build --debug apko.yaml "${REF}" output.tar -k melange.rsa.pub --arch amd64,aarch64,armv7

Push image with apko

Build and push an image to, for example, GHCR:

# Your GitHub username
GITHUB_USERNAME="myuser"
REF="ghcr.io/${GITHUB_USERNAME}/hello-melange-apko/$(basename "${PWD}")"

# A personal access token with the "write:packages" scope
GITHUB_TOKEN="*****"

docker run --rm -v "${PWD}":/work \
    -e REF="${REF}" \
    -e GITHUB_USERNAME="${GITHUB_USERNAME}" \
    -e GITHUB_TOKEN="${GITHUB_TOKEN}" \
    --entrypoint sh \
    cgr.dev/chainguard/apko -c \
        'echo "${GITHUB_TOKEN}" | \
            apko login ghcr.io -u "${GITHUB_USERNAME}" --password-stdin && \
            apko publish --debug apko.yaml \
                "${REF}" -k melange.rsa.pub \
                --arch amd64,aarch64,armv7'

Sign image with cosign

After the image has been published, sign it recursively using cosign (2.0+):

# Your GitHub username
GITHUB_USERNAME="myuser"
REF="ghcr.io/${GITHUB_USERNAME}/hello-melange-apko/$(basename "${PWD}")"

cosign sign -r -y "${REF}"

This should use "keyless" mode and open a browser window for you to authenticate.

Note: prior to running above, you may need to re-login to GHCR on the host using docker (or other tool):

# Your GitHub username
GITHUB_USERNAME="myuser"

# A personal access token with the "write:packages" scope
GITHUB_TOKEN="*****"

echo "${GITHUB_TOKEN}" | docker login ghcr.io -u "${GITHUB_USERNAME}" --password-stdin

Verify the signature

Verify that the image is signed using cosign:

# Your GitHub username
GITHUB_USERNAME="myuser"
REF="ghcr.io/${GITHUB_USERNAME}/hello-melange-apko/$(basename "${PWD}")"

cosign verify "${REF}" --certificate-identity-regexp=.* --certificate-oidc-issuer-regexp=.*

Run the hello server image

Finally, run the image using docker:

# Your GitHub username
GITHUB_USERNAME="myuser"
REF="ghcr.io/${GITHUB_USERNAME}/hello-melange-apko/$(basename "${PWD}")"

docker run --rm --rm -p 8080:8080 "${REF}"

Then in another terminal, try hitting the server using curl:

curl -s http://localhost:8080

Hello World!

Comments

Bump rack from 2.2.4 to 2.2.6.3 in /ruby
Bumps rack from 2.2.4 to 2.2.6.3.

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

[Unreleased]

SPEC Changes

rack.input is now optional. (#1997, [@ioquatix])

Changed

rack.input is now optional, and if missing, will raise an error. Use this to fail on multipart parsing a request without an input body. (#2018, [@ioquatix])

Introduce module Rack::BadRequest which is included in multipart and query parser errors. (#2019, [@ioquatix])

MIME type for JavaScript files (.js) changed from application/javascript to text/javascript (1bd0f15)

[3.0.4.1] - 2023-01-17

[CVE-2022-44571] Fix ReDoS vulnerability in multipart parser

[CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges

[CVE-2022-44572] Forbid control characters in attributes (also ReDoS)

[3.0.4] - 2023-01-17

Rack::Request#POST should consistently raise errors. Cache errors that occur when invoking Rack::Request#POST so they can be raised again later. (#2010, [@ioquatix])

Fix Rack::Lint error message for HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH. (#2007, @byroot)

Extend Rack::MethodOverride to handle QueryParser::ParamsTooDeepError error. (#2006, @byroot)

[3.0.3] - 2022-12-27

Fixed

Rack::URLMap uses non-deprecated form of Regexp.new. (#1998, @weizheheng)

[3.0.2] -2022-12-05

Fixed

Utils.build_nested_query URL-encodes nested field names including the square brackets.

Allow Rack::Response to pass through streaming bodies. (#1993, [@ioquatix])

[3.0.1] - 2022-11-18

Fixed

MethodOverride does not look for an override if a request does not include form/parseable data.

Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call and to_path, forwarding to the body. (#1981, [@ioquatix])

[3.0.0] - 2022-09-06

... (truncated)

Commits

d6b5b2b bump version

9aac375 Limit all multipart parts, not just files

2606ac5 bumping version

f6d4f52 Fix ReDoS in Rack::Utils.get_byte_ranges

20bc90c bump version

3677f17 Update changelog

ee25ab9 Fix ReDoS vulnerability in multipart parser

19e49f0 Forbid control characters in attributes

ea39e49 Bump patch version.

c0f9de4 Rack::MethodOverride handle QueryParser::ParamsTooDeepError (#2011)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 1
Bump rack from 2.2.4 to 2.2.6.2 in /ruby
Bumps rack from 2.2.4 to 2.2.6.2.

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

[3.0.3] - 2022-12-07

Fixed

Rack::URLMap uses non-deprecated form of Regexp.new. (#1998, @weizheheng)

[3.0.2] -2022-12-05

Fixed

Utils.build_nested_query URL-encodes nested field names including the square brackets.

Allow Rack::Response to pass through streaming bodies. (#1993, [@ioquatix])

[3.0.1] - 2022-11-18

Fixed

MethodOverride does not look for an override if a request does not include form/parseable data.

Rack::Lint::Wrapper correctly handles respond_to? with to_ary, each, call and to_path, forwarding to the body. (#1981, [@ioquatix])

[3.0.0] - 2022-09-06

No changes

[3.0.0.rc1] - 2022-09-04

SPEC Changes

Stream argument must implement << rack/rack#1959

close may be called on rack.input rack/rack#1956

rack.response_finished may be used for executing code after the response has been finished rack/rack#1952

[3.0.0.beta1] - 2022-08-08

Security

Do not use semicolon as GET parameter separator. (#1733, [@jeremyevans])

SPEC Changes

Response array must now be non-frozen.

Response status must now be an integer greater than or equal to 100.

Response headers must now be an unfrozen hash.

Response header keys can no longer include uppercase characters.

Response header values can be an Array to handle multiple values (and no longer supports \n encoded headers).

Response body can now respond to #call (streaming body) instead of #each (enumerable body), for the equivalent of response hijacking in previous versions.

... (truncated)

Commits

2606ac5 bumping version

f6d4f52 Fix ReDoS in Rack::Utils.get_byte_ranges

20bc90c bump version

3677f17 Update changelog

ee25ab9 Fix ReDoS vulnerability in multipart parser

19e49f0 Forbid control characters in attributes

ea39e49 Bump patch version.

c0f9de4 Rack::MethodOverride handle QueryParser::ParamsTooDeepError (#2011)

8312a2f Remove leading dot to fix compatibility with latest cgi gem. (#1988)

2a82c88 Update tests to work on latest Rubies. (#1999)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 1
Bump tokio from 1.19.2 to 1.20.3 in /rust
Bumps tokio from 1.19.2 to 1.20.3.

Release notes

Sourced from tokio's releases.

Tokio v1.20.2

1.20.2 (September 27, 2022)

This release removes the dependency on the once_cell crate to restore the MSRV of the 1.20.x LTS release. (#5048)

#5048: tokio-rs/tokio#5048

Tokio v1.20.1

1.20.1 (July 25, 2022)

Fixed

chore: fix version detection in build script (#4860)

#4860: tokio-rs/tokio#4860

Tokio v1.20.0

1.20.0 (July 12, 2022)

Added

tokio: add track_caller to public APIs (#4772, #4791, #4793, #4806, #4808)

sync: Add has_changed method to watch::Ref (#4758)

Changed

time: remove src/time/driver/wheel/stack.rs (#4766)

rt: clean up arguments passed to basic scheduler (#4767)

net: be more specific about winapi features (#4764)

tokio: use const initialized thread locals where possible (#4677)

task: various small improvements to LocalKey (#4795)

Fixed

Documented

fs: warn about performance pitfall (#4762)

chore: fix spelling (#4769)

sync: document spurious failures in oneshot (#4777)

sync: add warning for watch in non-Send futures (#4741)

chore: fix typo (#4798)

Unstable

joinset: rename join_one to join_next (#4755)

rt: unhandled panic config for current thread rt (#4770)

#4677: tokio-rs/tokio#4677 #4741: tokio-rs/tokio#4741 #4755: tokio-rs/tokio#4755 #4758: tokio-rs/tokio#4758 #4762: tokio-rs/tokio#4762

... (truncated)

Commits

ba81945 chore: prepare Tokio 1.20.3 release

763bdc9 ci: run WASI tasks using latest Rust

9f98535 Merge remote-tracking branch 'origin/tokio-1.18.x' into fix-named-pipes-1.20

9241c3e chore: prepare Tokio v1.18.4 release

699573d net: fix named pipes server configuration builder

3d95a46 chore: prepare Tokio v1.20.2 (#5055)

2063d66 Merge 'tokio-1.18.3' into 'tokio-1.20.x' (#5054)

5c76d07 chore: prepare Tokio v1.18.3 (#5051)

05e6614 chore: don't use once_cell for 1.18.x LTS release (#5048)

c0746b6 chore: prepare Tokio v1.20.1 (#4861)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies rust
opened by dependabot[bot] 1

Python build error: fatal error: Python.h: No such file or directory

This doesn't cause the build to actually fail, but makes the melange output noisy. maybe solved by adding the python-dev package

2022/07/14 17:33:32 melange (hello-server/armv7):   Preparing metadata (setup.py): still running...
2022/07/14 17:33:32 melange (hello-server/armv7):   Preparing metadata (setup.py): finished with status 'done'
2022/07/14 17:33:32 melange (hello-server/armv7): Building wheels for collected packages: MarkupSafe
2022/07/14 17:33:32 melange (hello-server/armv7):   Building wheel for MarkupSafe (setup.py): started
2022/07/14 17:34:36 melange (hello-server/armv7):   Building wheel for MarkupSafe (setup.py): still running...
2022/07/14 17:34:47 melange (hello-server/armv7):   Building wheel for MarkupSafe (setup.py): finished with status 'error'
2022/07/14 17:34:48 melange (hello-server/armv7):   error: subprocess-exited-with-error
2022/07/14 17:34:48 melange (hello-server/armv7):   
2022/07/14 17:34:48 melange (hello-server/armv7):   × python setup.py bdist_wheel did not run successfully.
2022/07/14 17:34:48 melange (hello-server/armv7):   │ exit code: 1
2022/07/14 17:34:48 melange (hello-server/armv7):   ╰─> [178 lines of output]
2022/07/14 17:34:48 melange (hello-server/armv7):       running bdist_wheel
2022/07/14 17:34:48 melange (hello-server/armv7):       running build
2022/07/14 17:34:48 melange (hello-server/armv7):       running build_py
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/lib.linux-armv7l-cpython-310
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/lib.linux-armv7l-cpython-310/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/_native.py -> build/lib.linux-armv7l-cpython-310/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/__init__.py -> build/lib.linux-armv7l-cpython-310/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       running egg_info
2022/07/14 17:34:48 melange (hello-server/armv7):       writing src/MarkupSafe.egg-info/PKG-INFO
2022/07/14 17:34:48 melange (hello-server/armv7):       writing dependency_links to src/MarkupSafe.egg-info/dependency_links.txt
2022/07/14 17:34:48 melange (hello-server/armv7):       writing top-level names to src/MarkupSafe.egg-info/top_level.txt
2022/07/14 17:34:48 melange (hello-server/armv7):       reading manifest file 'src/MarkupSafe.egg-info/SOURCES.txt'
2022/07/14 17:34:48 melange (hello-server/armv7):       reading manifest template 'MANIFEST.in'
2022/07/14 17:34:48 melange (hello-server/armv7):       no previously-included directories found matching 'docs/_build'
2022/07/14 17:34:48 melange (hello-server/armv7):       warning: no previously-included files matching '*.pyc' found anywhere in distribution
2022/07/14 17:34:48 melange (hello-server/armv7):       adding license file 'LICENSE.rst'
2022/07/14 17:34:48 melange (hello-server/armv7):       writing manifest file 'src/MarkupSafe.egg-info/SOURCES.txt'
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/_speedups.c -> build/lib.linux-armv7l-cpython-310/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/_speedups.pyi -> build/lib.linux-armv7l-cpython-310/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/py.typed -> build/lib.linux-armv7l-cpython-310/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       running build_ext
2022/07/14 17:34:48 melange (hello-server/armv7):       building 'markupsafe._speedups' extension
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/temp.linux-armv7l-cpython-310
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/temp.linux-armv7l-cpython-310/src
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/temp.linux-armv7l-cpython-310/src/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       gcc -Wno-unused-result -Wsign-compare -DNDEBUG -g -fwrapv -O3 -Wall -fomit-frame-pointer -g -fomit-frame-pointer -g -fomit-frame-pointer -g -DTHREAD_STACK_SIZE=0x100000 -fPIC -I/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/include -I/usr/include/python3.10 -c src/markupsafe/_speedups.c -o build/temp.linux-armv7l-cpython-310/src/markupsafe/_speedups.o
2022/07/14 17:34:48 melange (hello-server/armv7):       src/markupsafe/_speedups.c:1:10: fatal error: Python.h: No such file or directory
2022/07/14 17:34:48 melange (hello-server/armv7):           1 | #include <Python.h>
2022/07/14 17:34:48 melange (hello-server/armv7):             |          ^~~~~~~~~~
2022/07/14 17:34:48 melange (hello-server/armv7):       compilation terminated.
2022/07/14 17:34:48 melange (hello-server/armv7):       ==========================================================================
2022/07/14 17:34:48 melange (hello-server/armv7):       WARNING: The C extension could not be compiled, speedups are not enabled.
2022/07/14 17:34:48 melange (hello-server/armv7):       Failure information, if any, is above.
2022/07/14 17:34:48 melange (hello-server/armv7):       Retrying the build without the C extension now.
2022/07/14 17:34:48 melange (hello-server/armv7):       ==========================================================================
2022/07/14 17:34:48 melange (hello-server/armv7):       running bdist_wheel
2022/07/14 17:34:48 melange (hello-server/armv7):       running build
2022/07/14 17:34:48 melange (hello-server/armv7):       running build_py
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/lib
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/lib/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/_native.py -> build/lib/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/__init__.py -> build/lib/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       running egg_info
2022/07/14 17:34:48 melange (hello-server/armv7):       writing src/MarkupSafe.egg-info/PKG-INFO
2022/07/14 17:34:48 melange (hello-server/armv7):       writing dependency_links to src/MarkupSafe.egg-info/dependency_links.txt
2022/07/14 17:34:48 melange (hello-server/armv7):       writing top-level names to src/MarkupSafe.egg-info/top_level.txt
2022/07/14 17:34:48 melange (hello-server/armv7):       reading manifest file 'src/MarkupSafe.egg-info/SOURCES.txt'
2022/07/14 17:34:48 melange (hello-server/armv7):       reading manifest template 'MANIFEST.in'
2022/07/14 17:34:48 melange (hello-server/armv7):       no previously-included directories found matching 'docs/_build'
2022/07/14 17:34:48 melange (hello-server/armv7):       warning: no previously-included files matching '*.pyc' found anywhere in distribution
2022/07/14 17:34:48 melange (hello-server/armv7):       adding license file 'LICENSE.rst'
2022/07/14 17:34:48 melange (hello-server/armv7):       writing manifest file 'src/MarkupSafe.egg-info/SOURCES.txt'
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/_speedups.c -> build/lib/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/_speedups.pyi -> build/lib/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying src/markupsafe/py.typed -> build/lib/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       /home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/command/install.py:34: SetuptoolsDeprecationWarning: setup.py install is deprecated. Use build and pip and other standards-based tools.
2022/07/14 17:34:48 melange (hello-server/armv7):         warnings.warn(
2022/07/14 17:34:48 melange (hello-server/armv7):       installing to build/bdist.linux-armv7l/wheel
2022/07/14 17:34:48 melange (hello-server/armv7):       running install
2022/07/14 17:34:48 melange (hello-server/armv7):       running install_lib
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/bdist.linux-armv7l
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/bdist.linux-armv7l/wheel
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/bdist.linux-armv7l/wheel/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying build/lib/markupsafe/_native.py -> build/bdist.linux-armv7l/wheel/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying build/lib/markupsafe/_speedups.c -> build/bdist.linux-armv7l/wheel/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying build/lib/markupsafe/_speedups.pyi -> build/bdist.linux-armv7l/wheel/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying build/lib/markupsafe/__init__.py -> build/bdist.linux-armv7l/wheel/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       copying build/lib/markupsafe/py.typed -> build/bdist.linux-armv7l/wheel/markupsafe
2022/07/14 17:34:48 melange (hello-server/armv7):       running install_egg_info
2022/07/14 17:34:48 melange (hello-server/armv7):       Copying src/MarkupSafe.egg-info to build/bdist.linux-armv7l/wheel/MarkupSafe-2.1.1-py3.10.egg-info
2022/07/14 17:34:48 melange (hello-server/armv7):       running install_scripts
2022/07/14 17:34:48 melange (hello-server/armv7):       adding license file "LICENSE.rst" (matched pattern "LICENSE.rst")
2022/07/14 17:34:48 melange (hello-server/armv7):       creating build/bdist.linux-armv7l/wheel/MarkupSafe-2.1.1.dist-info/WHEEL
2022/07/14 17:34:48 melange (hello-server/armv7):       creating '/tmp/pip-wheel-c_1ujt3m/MarkupSafe-2.1.1-py3-none-any.whl' and adding 'build/bdist.linux-armv7l/wheel' to it
2022/07/14 17:34:48 melange (hello-server/armv7):       Traceback (most recent call last):
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/unixccompiler.py", line 173, in _compile
2022/07/14 17:34:48 melange (hello-server/armv7):           self.spawn(compiler_so + cc_args + [src, '-o', obj] +
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/ccompiler.py", line 917, in spawn
2022/07/14 17:34:48 melange (hello-server/armv7):           spawn(cmd, dry_run=self.dry_run, **kwargs)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/spawn.py", line 68, in spawn
2022/07/14 17:34:48 melange (hello-server/armv7):           raise DistutilsExecError(
2022/07/14 17:34:48 melange (hello-server/armv7):       distutils.errors.DistutilsExecError: command '/usr/bin/gcc' failed with exit code 1
2022/07/14 17:34:48 melange (hello-server/armv7):       
2022/07/14 17:34:48 melange (hello-server/armv7):       During handling of the above exception, another exception occurred:
2022/07/14 17:34:48 melange (hello-server/armv7):       
2022/07/14 17:34:48 melange (hello-server/armv7):       Traceback (most recent call last):
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/tmp/pip-install-rqehg8ix/markupsafe_8083186d4ec54b6f925891cb09818f77/setup.py", line 30, in build_extension
2022/07/14 17:34:48 melange (hello-server/armv7):           build_ext.build_extension(self, ext)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/command/build_ext.py", line 202, in build_extension
2022/07/14 17:34:48 melange (hello-server/armv7):           _build_ext.build_extension(self, ext)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/command/build_ext.py", line 528, in build_extension
2022/07/14 17:34:48 melange (hello-server/armv7):           objects = self.compiler.compile(sources,
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/ccompiler.py", line 574, in compile
2022/07/14 17:34:48 melange (hello-server/armv7):           self._compile(obj, src, ext, cc_args, extra_postargs, pp_opts)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/unixccompiler.py", line 176, in _compile
2022/07/14 17:34:48 melange (hello-server/armv7):           raise CompileError(msg)
2022/07/14 17:34:48 melange (hello-server/armv7):       distutils.errors.CompileError: command '/usr/bin/gcc' failed with exit code 1
2022/07/14 17:34:48 melange (hello-server/armv7):       
2022/07/14 17:34:48 melange (hello-server/armv7):       The above exception was the direct cause of the following exception:
2022/07/14 17:34:48 melange (hello-server/armv7):       
2022/07/14 17:34:48 melange (hello-server/armv7):       Traceback (most recent call last):
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/tmp/pip-install-rqehg8ix/markupsafe_8083186d4ec54b6f925891cb09818f77/setup.py", line 65, in <module>
2022/07/14 17:34:48 melange (hello-server/armv7):           run_setup(True)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/tmp/pip-install-rqehg8ix/markupsafe_8083186d4ec54b6f925891cb09818f77/setup.py", line 41, in run_setup
2022/07/14 17:34:48 melange (hello-server/armv7):           setup(
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/__init__.py", line 87, in setup
2022/07/14 17:34:48 melange (hello-server/armv7):           return distutils.core.setup(**attrs)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/core.py", line 148, in setup
2022/07/14 17:34:48 melange (hello-server/armv7):           return run_commands(dist)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/core.py", line 163, in run_commands
2022/07/14 17:34:48 melange (hello-server/armv7):           dist.run_commands()
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/dist.py", line 967, in run_commands
2022/07/14 17:34:48 melange (hello-server/armv7):           self.run_command(cmd)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/dist.py", line 1214, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           super().run_command(command)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/dist.py", line 986, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           cmd_obj.run()
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/wheel/bdist_wheel.py", line 299, in run
2022/07/14 17:34:48 melange (hello-server/armv7):           self.run_command('build')
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/cmd.py", line 313, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           self.distribution.run_command(command)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/dist.py", line 1214, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           super().run_command(command)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/dist.py", line 986, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           cmd_obj.run()
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/command/build.py", line 136, in run
2022/07/14 17:34:48 melange (hello-server/armv7):           self.run_command(cmd_name)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/cmd.py", line 313, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           self.distribution.run_command(command)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/dist.py", line 1214, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           super().run_command(command)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/dist.py", line 986, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           cmd_obj.run()
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/tmp/pip-install-rqehg8ix/markupsafe_8083186d4ec54b6f925891cb09818f77/setup.py", line 24, in run
2022/07/14 17:34:48 melange (hello-server/armv7):           build_ext.run(self)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/command/build_ext.py", line 79, in run
2022/07/14 17:34:48 melange (hello-server/armv7):           _build_ext.run(self)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/command/build_ext.py", line 339, in run
2022/07/14 17:34:48 melange (hello-server/armv7):           self.build_extensions()
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/command/build_ext.py", line 448, in build_extensions
2022/07/14 17:34:48 melange (hello-server/armv7):           self._build_extensions_serial()
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/command/build_ext.py", line 473, in _build_extensions_serial
2022/07/14 17:34:48 melange (hello-server/armv7):           self.build_extension(ext)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/tmp/pip-install-rqehg8ix/markupsafe_8083186d4ec54b6f925891cb09818f77/setup.py", line 32, in build_extension
2022/07/14 17:34:48 melange (hello-server/armv7):           raise BuildFailed() from e
2022/07/14 17:34:48 melange (hello-server/armv7):       __main__.BuildFailed
2022/07/14 17:34:48 melange (hello-server/armv7):       
2022/07/14 17:34:48 melange (hello-server/armv7):       During handling of the above exception, another exception occurred:
2022/07/14 17:34:48 melange (hello-server/armv7):       
2022/07/14 17:34:48 melange (hello-server/armv7):       Traceback (most recent call last):
2022/07/14 17:34:48 melange (hello-server/armv7):         File "<string>", line 2, in <module>
2022/07/14 17:34:48 melange (hello-server/armv7):         File "<pip-setuptools-caller>", line 34, in <module>
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/tmp/pip-install-rqehg8ix/markupsafe_8083186d4ec54b6f925891cb09818f77/setup.py", line 73, in <module>
2022/07/14 17:34:48 melange (hello-server/armv7):           run_setup(False)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/tmp/pip-install-rqehg8ix/markupsafe_8083186d4ec54b6f925891cb09818f77/setup.py", line 41, in run_setup
2022/07/14 17:34:48 melange (hello-server/armv7):           setup(
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/__init__.py", line 87, in setup
2022/07/14 17:34:48 melange (hello-server/armv7):           return distutils.core.setup(**attrs)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/core.py", line 148, in setup
2022/07/14 17:34:48 melange (hello-server/armv7):           return run_commands(dist)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/core.py", line 163, in run_commands
2022/07/14 17:34:48 melange (hello-server/armv7):           dist.run_commands()
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/dist.py", line 967, in run_commands
2022/07/14 17:34:48 melange (hello-server/armv7):           self.run_command(cmd)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/dist.py", line 1214, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           super().run_command(command)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/setuptools/_distutils/dist.py", line 986, in run_command
2022/07/14 17:34:48 melange (hello-server/armv7):           cmd_obj.run()
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/wheel/bdist_wheel.py", line 361, in run
2022/07/14 17:34:48 melange (hello-server/armv7):           wf.write_files(archive_root)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/wheel/wheelfile.py", line 136, in write_files
2022/07/14 17:34:48 melange (hello-server/armv7):           self.write(path, arcname)
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/lib/python3.10/site-packages/wheel/wheelfile.py", line 147, in write
2022/07/14 17:34:48 melange (hello-server/armv7):           zinfo = ZipInfo(arcname or filename, date_time=get_zipinfo_datetime(st.st_mtime))
2022/07/14 17:34:48 melange (hello-server/armv7):         File "/usr/lib/python3.10/zipfile.py", line 362, in __init__
2022/07/14 17:34:48 melange (hello-server/armv7):           raise ValueError('ZIP does not support timestamps before 1980')
2022/07/14 17:34:48 melange (hello-server/armv7):       ValueError: ZIP does not support timestamps before 1980
2022/07/14 17:34:48 melange (hello-server/armv7):       [end of output]
2022/07/14 17:34:48 melange (hello-server/armv7):   
2022/07/14 17:34:48 melange (hello-server/armv7):   note: This error originates from a subprocess, and is likely not a problem with pip.
2022/07/14 17:34:48 melange (hello-server/armv7):   ERROR: Failed building wheel for MarkupSafe
2022/07/14 17:34:48 melange (hello-server/armv7):   Running setup.py clean for MarkupSafe
2022/07/14 17:34:59 melange (hello-server/armv7): Failed to build MarkupSafe
2022/07/14 17:35:00 melange (hello-server/armv7): Installing collected packages: Werkzeug, MarkupSafe, itsdangerous, click, Jinja2, Flask
2022/07/14 17:35:03 melange (hello-server/armv7):   Running setup.py install for MarkupSafe: started
2022/07/14 17:36:04 melange (hello-server/armv7):   Running setup.py install for MarkupSafe: still running...
2022/07/14 17:36:11 melange (hello-server/armv7):   Running setup.py install for MarkupSafe: finished with status 'done'
2022/07/14 17:36:11 melange (hello-server/armv7):   DEPRECATION: MarkupSafe was installed using the legacy 'setup.py install' method, because a wheel could not be built for it. A possible replacement is to fix the wheel build issue reported above. Discussion can be found at https://github.com/pypa/pip/issues/8368
2022/07/14 17:36:15 melange (hello-server/armv7): Successfully installed Flask-2.1.2 Jinja2-3.1.2 MarkupSafe-2.1.1 Werkzeug-2.1.2 click-8.1.3 itsdangerous-2.1.2
2022/07/14 17:36:17 melange (hello-server/armv7): WARNING: You are using pip version 22.0.4; however, version 22.1.2 is available.
2022/07/14 17:36:17 melange (hello-server/armv7): You should consider upgrading via the '/home/build/melange-out/hello-server/usr/share/webapps/hello-server/venv/bin/python -m pip install --upgrade pip' command.
2022/07/14 17:36:18 melange (hello-server/armv7): warning: read |0: file already closed
2022/07/14 17:36:18 melange (hello-server/armv7): warning: read |0: file already closed
2022/07/14 17:36:18 melange (hello-server/armv7): generating package hello-server-0.1.0-r0
2022/07/14 17:36:18 melange (hello-server/armv7): scanning for shared object dependencies...
2022/07/14 17:36:18 melange (hello-server/armv7): scanning for commands...
2022/07/14 17:36:18 melange (hello-server/armv7):   runtime:
2022/07/14 17:36:18 melange (hello-server/armv7):     python3
2022/07/14 17:36:18 melange (hello-server/armv7):   provides:
2022/07/14 17:36:18 melange (hello-server/armv7):     cmd:hello-server=0.1.0-r0
2022/07/14 17:36:18 melange (hello-server/armv7):   installed-size: 2[1435](https://github.com/chainguard-dev/hello-melange-apko/runs/7344995367?check_suite_focus=true#step:3:1472)686
2022/07/14 17:36:19 melange (hello-server/armv7):   data.tar.gz digest: a627616ff0eaad2c011e0fee1f42eeef7a526db63100309188f80bfcd3bd8133
2022/07/14 17:36:19 melange (hello-server/armv7):   control.tar.gz digest: 770a15256e36600233ac0a74c2638ca248b0e6e6
2022/07/14 17:36:19 melange (hello-server/armv7): wrote /home/runner/work/hello-melange-apko/hello-melange-apko/packages/armv7/hello-server-0.1.0-r0.apk

opened by jdolitsky 0

Bump h2 from 0.3.13 to 0.3.17 in /rust
Bumps h2 from 0.3.13 to 0.3.17.

Release notes

Sourced from h2's releases.

v0.3.17

What's Changed

Add Error::is_library() method to check if the originated inside h2.

Add max_pending_accept_reset_streams(usize) option to client and server builders.

Fix theoretical memory growth when receiving too many HEADERS and then RST_STREAM frames faster than an application can accept them off the queue. (CVE-2023-26964)

v0.3.16

What's Changed

Set Protocol extension on requests when received Extended CONNECT requests.

Remove B: Unpin + 'static bound requiremented of bufs

Fix releasing of frames when stream is finished, reducing memory usage.

Fix panic when trying to send data and connection window is available, but stream window is not.

Fix spurious wakeups when stream capacity is not available.

New Contributors

@vi made their first contribution in hyperium/h2#646

@silence-coding made their first contribution in hyperium/h2#651

@gtsiam made their first contribution in hyperium/h2#649

@howardjohn made their first contribution in hyperium/h2#658

@cloneable made their first contribution in hyperium/h2#655

@aftersnow made their first contribution in hyperium/h2#657

@vadim-eg made their first contribution in hyperium/h2#661

v0.3.15

What's Changed

Remove B: Buf bound on SendStream's parameter by @djkoloski in hyperium/h2#614

add accessor for StreamId u32 by @ehaydenr in hyperium/h2#639

New Contributors

@ehaydenr made their first contribution in hyperium/h2#639

v0.3.14

Add Error::is_reset function.

Bump MSRV to Rust 1.56.

Return RST_STREAM(NO_ERROR) when the server early responds.

New Contributors

@djkoloski made their first contribution in hyperium/h2#616

@bruceg made their first contribution in hyperium/h2#618

@ryanrussell made their first contribution in hyperium/h2#620

@kckeiks made their first contribution in hyperium/h2#625

@erebe made their first contribution in hyperium/h2#634

Changelog

Sourced from h2's changelog.

0.3.17 (April 13, 2023)

Add Error::is_library() method to check if the originated inside h2.

Add max_pending_accept_reset_streams(usize) option to client and server builders.

Fix theoretical memory growth when receiving too many HEADERS and then RST_STREAM frames faster than an application can accept them off the queue. (CVE-2023-26964)

0.3.16 (February 27, 2023)

Set Protocol extension on requests when received Extended CONNECT requests.

Remove B: Unpin + 'static bound requiremented of bufs

Fix releasing of frames when stream is finished, reducing memory usage.

Fix panic when trying to send data and connection window is available, but stream window is not.

Fix spurious wakeups when stream capacity is not available.

0.3.15 (October 21, 2022)

Remove B: Buf bound on SendStream's parameter

add accessor for StreamId u32

0.3.14 (August 16, 2022)

Add Error::is_reset function.

Bump MSRV to Rust 1.56.

Return RST_STREAM(NO_ERROR) when the server early responds.

Commits

af4bcac v0.3.17

d3f37e9 feat: add max_pending_accept_reset_streams(n) options

5bc8e72 fix: limit the amount of pending-accept reset streams

8088ca6 feat: add Error::is_library method

481c31d chore: Use Cargo metadata for the MSRV build job

d3d50ef chore: Replace unmaintained/outdated GitHub Actions

45b9bcc chore: set rust-version in Cargo.toml (#664)

b9dcd39 v0.3.16

96caf4f Add a message for EOF-related broken pipe errors (#615)

7323190 Avoid spurious wakeups when stream capacity is not available (#661)

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself) You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies rust
opened by dependabot[bot] 0
Bump rack from 2.2.4 to 2.2.6.4 in /ruby
Bumps rack from 2.2.4 to 2.2.6.4.

Changelog

Sourced from rack's changelog.

Changelog

All notable changes to this project will be documented in this file. For info on how to format all future additions to this file please reference Keep A Changelog.

[3.0.7] - 2023-03-16

Make query parameters without = have nil values. (#2059, [@jeremyevans])

[3.0.6.1] - 2023-03-13

[CVE-2023-27539] Avoid ReDoS in header parsing

[3.0.6] - 2023-03-13

Add QueryParser#missing_value for handling missing values + tests. (#2052, [@ioquatix])

[3.0.5] - 2023-03-13

Split form/query parsing into two steps. (#2038, @matthewd)

[3.0.4.1] - 2023-03-02

SPEC Changes

rack.input is now optional. (#1997, [@ioquatix])

Changed

rack.input is now optional, and if missing, will raise an error. Use this to fail on multipart parsing a request without an input body. (#2018, [@ioquatix])

Introduce module Rack::BadRequest which is included in multipart and query parser errors. (#2019, [@ioquatix])

MIME type for JavaScript files (.js) changed from application/javascript to text/javascript (1bd0f15)

Add .mjs MIME type (#2057, [@axilleas])

[3.0.4.1] - 2023-01-17

[CVE-2022-44571] Fix ReDoS vulnerability in multipart parser

[CVE-2022-44570] Fix ReDoS in Rack::Utils.get_byte_ranges

[CVE-2022-44572] Forbid control characters in attributes (also ReDoS)

[3.0.4] - 2023-01-17

Rack::Request#POST should consistently raise errors. Cache errors that occur when invoking Rack::Request#POST so they can be raised again later. (#2010, [@ioquatix])

Fix Rack::Lint error message for HTTP_CONTENT_TYPE and HTTP_CONTENT_LENGTH. (#2007, @byroot)

Extend Rack::MethodOverride to handle QueryParser::ParamsTooDeepError error. (#2006, @byroot)

[3.0.3] - 2022-12-27

Fixed

Rack::URLMap uses non-deprecated form of Regexp.new. (#1998, @weizheheng)

... (truncated)

Commits

27addc7 bump version

ee7919e Avoid ReDoS problem

d6b5b2b bump version

9aac375 Limit all multipart parts, not just files

2606ac5 bumping version

f6d4f52 Fix ReDoS in Rack::Utils.get_byte_ranges

20bc90c bump version

3677f17 Update changelog

ee25ab9 Fix ReDoS vulnerability in multipart parser

19e49f0 Forbid control characters in attributes

Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies ruby
opened by dependabot[bot] 0
Bump golang.org/x/crypto from 0.0.0-20210711020723-a769d52b0f97 to 0.1.0 in /go
Bumps golang.org/x/crypto from 0.0.0-20210711020723-a769d52b0f97 to 0.1.0.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies go
opened by dependabot[bot] 0
Bump golang.org/x/sys from 0.0.0-20210806184541-e5e7981a1069 to 0.1.0 in /go
Bumps golang.org/x/sys from 0.0.0-20210806184541-e5e7981a1069 to 0.1.0.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies go
opened by dependabot[bot] 0
Bump golang.org/x/net from 0.0.0-20210226172049-e18ecbb05110 to 0.7.0 in /go
Bumps golang.org/x/net from 0.0.0-20210226172049-e18ecbb05110 to 0.7.0.

Commits

See full diff in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR

@dependabot recreate will recreate this PR, overwriting any edits that have been made to it

@dependabot merge will merge this PR after your CI passes on it

@dependabot squash and merge will squash and merge this PR after your CI passes on it

@dependabot cancel merge will cancel a previously requested merge and block automerging

@dependabot reopen will reopen this PR if it is closed

@dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually

@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)

@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

@dependabot use these labels will set the current labels as the default for future PRs for this repo and language

@dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language

@dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language

@dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language

You can disable automated security fix PRs for this repo from the Security Alerts page.

dependencies go
opened by dependabot[bot] 0