self-hosted/woodpecker
1
0
Fork 0
mirror of https://github.com/woodpecker-ci/woodpecker.git synced 2024-11-30 08:06:52 +02:00
Code Issues Releases Activity
97a7438ab1
woodpecker/go.mod
renovate[bot] 97a7438ab1
fix(deps): update module github.com/golang-jwt/jwt/v4 to v5 (#2449) 
[![Mend
Renovate](https://app.renovatebot.com/images/banner.svg)](https://renovatebot.com)

This PR contains the following updates:

| Package | Type | Update | Change |
|---|---|---|---|
| [github.com/golang-jwt/jwt/v4](https://togithub.com/golang-jwt/jwt) |
require | major | `v4.5.0` -> `v5.0.0` |

---

### ⚠ Dependency Lookup Warnings ⚠

Warnings were logged while processing this repo. Please check the
Dependency Dashboard for more information.

---

### Release Notes

<details>
<summary>golang-jwt/jwt (github.com/golang-jwt/jwt/v4)</summary>

### [`v5.0.0`](https://togithub.com/golang-jwt/jwt/releases/tag/v5.0.0)

[Compare
Source](https://togithub.com/golang-jwt/jwt/compare/v4.5.0...v5.0.0)

### 🚀 New Major Version `v5` 🚀

It's finally here, the release you have been waiting for! We don't take
breaking changes lightly, but the changes outlined below were necessary
to address some of the challenges of the previous API. A big thanks for
[@&#8203;mfridman](https://togithub.com/mfridman) for all the reviews,
all contributors for their commits and of course
[@&#8203;dgrijalva](https://togithub.com/dgrijalva) for the original
code. I hope we kept some of the spirit of your original `v4` branch
alive in the approach we have taken here.
\~[@&#8203;oxisto](https://togithub.com/oxisto), on behalf of
[@&#8203;golang-jwt/maintainers](https://togithub.com/golang-jwt/maintainers)

Version `v5` contains a major rework of core functionalities in the
`jwt-go` library. This includes support for several validation options
as well as a re-design of the `Claims` interface. Lastly, we reworked
how errors work under the hood, which should provide a better overall
developer experience.

Starting from
[v5.0.0](https://togithub.com/golang-jwt/jwt/releases/tag/v5.0.0), the
import path will be:

    "github.com/golang-jwt/jwt/v5"

For most users, changing the import path *should* suffice. However,
since we intentionally changed and cleaned some of the public API,
existing programs might need to be updated. The following sections
describe significant changes and corresponding updates for existing
programs.

#### Parsing and Validation Options

Under the hood, a new `validator` struct takes care of validating the
claims. A long awaited feature has been the option to fine-tune the
validation of tokens. This is now possible with several `ParserOption`
functions that can be appended to most `Parse` functions, such as
`ParseWithClaims`. The most important options and changes are:

- Added `WithLeeway` to support specifying the leeway that is allowed
when validating time-based claims, such as `exp` or `nbf`.
- Changed default behavior to not check the `iat` claim. Usage of this
claim is OPTIONAL according to the JWT RFC. The claim itself is also
purely informational according to the RFC, so a strict validation
failure is not recommended. If you want to check for sensible values in
these claims, please use the `WithIssuedAt` parser option.
- Added `WithAudience`, `WithSubject` and `WithIssuer` to support
checking for expected `aud`, `sub` and `iss`.
- Added `WithStrictDecoding` and `WithPaddingAllowed` options to allow
previously global settings to enable base64 strict encoding and the
parsing of base64 strings with padding. The latter is strictly speaking
against the standard, but unfortunately some of the major identity
providers issue some of these incorrect tokens. Both options are
disabled by default.

#### Changes to the `Claims` interface

##### Complete Restructuring

Previously, the claims interface was satisfied with an implementation of
a `Valid() error` function. This had several issues:

- The different claim types (struct claims, map claims, etc.) then
contained similar (but not 100 % identical) code of how this validation
was done. This lead to a lot of (almost) duplicate code and was hard to
maintain
- It was not really semantically close to what a "claim" (or a set of
claims) really is; which is a list of defined key/value pairs with a
certain semantic meaning.

Since all the validation functionality is now extracted into the
validator, all `VerifyXXX` and `Valid` functions have been removed from
the `Claims` interface. Instead, the interface now represents a list of
getters to retrieve values with a specific meaning. This allows us to
completely decouple the validation logic with the underlying storage
representation of the claim, which could be a struct, a map or even
something stored in a database.

```go
type Claims interface {
	GetExpirationTime() (*NumericDate, error)
	GetIssuedAt() (*NumericDate, error)
	GetNotBefore() (*NumericDate, error)
	GetIssuer() (string, error)
	GetSubject() (string, error)
	GetAudience() (ClaimStrings, error)
}
```

##### Supported Claim Types and Removal of `StandardClaims`

The two standard claim types supported by this library, `MapClaims` and
`RegisteredClaims` both implement the necessary functions of this
interface. The old `StandardClaims` struct, which has already been
deprecated in `v4` is now removed.

Users using custom claims, in most cases, will not experience any
changes in the behavior as long as they embedded `RegisteredClaims`. If
they created a new claim type from scratch, they now need to implemented
the proper getter functions.

##### Migrating Application Specific Logic of the old `Valid`

Previously, users could override the `Valid` method in a custom claim,
for example to extend the validation with application-specific claims.
However, this was always very dangerous, since once could easily disable
the standard validation and signature checking.

In order to avoid that, while still supporting the use-case, a new
`ClaimsValidator` interface has been introduced. This interface consists
of the `Validate() error` function. If the validator sees, that a
`Claims` struct implements this interface, the errors returned to the
`Validate` function will be *appended* to the regular standard
validation. It is not possible to disable the standard validation
anymore (even only by accident).

Usage examples can be found in [example_test.go](./example_test.go), to
build claims structs like the following.

```go
// MyCustomClaims includes all registered claims, plus Foo.
type MyCustomClaims struct {
	Foo string `json:"foo"`
	jwt.RegisteredClaims
}

// Validate can be used to execute additional application-specific claims
// validation.
func (m MyCustomClaims) Validate() error {
	if m.Foo != "bar" {
		return errors.New("must be foobar")
	}

	return nil
}
```

#### Changes to the `Token` and `Parser` struct

The previously global functions `DecodeSegment` and `EncodeSegment` were
moved to the `Parser` and `Token` struct respectively. This will allow
us in the future to configure the behavior of these two based on options
supplied on the parser or the token (creation). This also removes two
previously global variables and moves them to parser options
`WithStrictDecoding` and `WithPaddingAllowed`.

In order to do that, we had to adjust the way signing methods work.
Previously they were given a base64 encoded signature in `Verify` and
were expected to return a base64 encoded version of the signature in
`Sign`, both as a `string`. However, this made it necessary to have
`DecodeSegment` and `EncodeSegment` global and was a less than perfect
design because we were repeating encoding/decoding steps for all signing
methods. Now, `Sign` and `Verify` operate on a decoded signature as a
`[]byte`, which feels more natural for a cryptographic operation anyway.
Lastly, `Parse` and `SignedString` take care of the final
encoding/decoding part.

In addition to that, we also changed the `Signature` field on `Token`
from a `string` to `[]byte` and this is also now populated with the
decoded form. This is also more consistent, because the other parts of
the JWT, mainly `Header` and `Claims` were already stored in decoded
form in `Token`. Only the signature was stored in base64 encoded form,
which was redundant with the information in the `Raw` field, which
contains the complete token as base64.

```go
type Token struct {
	Raw       string                 // Raw contains the raw token
	Method    SigningMethod          // Method is the signing method used or to be used
	Header    map[string]interface{} // Header is the first segment of the token in decoded form
	Claims    Claims                 // Claims is the second segment of the token in decoded form
	Signature []byte                 // Signature is the third segment of the token in decoded form
	Valid     bool                   // Valid specifies if the token is valid
}
```

Most (if not all) of these changes should not impact the normal usage of
this library. Only users directly accessing the `Signature` field as
well as developers of custom signing methods should be affected.

#### What's Changed

- Added GitHub Actions Markdown by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/260](https://togithub.com/golang-jwt/jwt/pull/260)
- Remove `StandardClaims` in favor of `RegisteredClaims` by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[#&#8203;235](https://togithub.com/golang-jwt/jwt/issues/235)
- Adding more coverage by [@&#8203;oxisto](https://togithub.com/oxisto)
in [#&#8203;268](https://togithub.com/golang-jwt/jwt/issues/268)
- More consistent way of handling validation errors by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[#&#8203;274](https://togithub.com/golang-jwt/jwt/issues/274)
- New Validation API by [@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/236](https://togithub.com/golang-jwt/jwt/pull/236)
- `v5` Pre-Release by [@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/234](https://togithub.com/golang-jwt/jwt/pull/234)
- no need for string slice and call to strings.join by
[@&#8203;moneszarrugh](https://togithub.com/moneszarrugh) in
[https://github.com/golang-jwt/jwt/pull/115](https://togithub.com/golang-jwt/jwt/pull/115)
- Update MIGRATION_GUIDE.md by
[@&#8203;liam-verta](https://togithub.com/liam-verta) in
[https://github.com/golang-jwt/jwt/pull/289](https://togithub.com/golang-jwt/jwt/pull/289)
- Moving `DecodeSegement` to `Parser` by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/278](https://togithub.com/golang-jwt/jwt/pull/278)
- Adjusting the error checking example by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/270](https://togithub.com/golang-jwt/jwt/pull/270)
- add documentation to hmac `Verify` & `Sign` to detail why string is
not an advisable input for key by
[@&#8203;dillonstreator](https://togithub.com/dillonstreator) in
[https://github.com/golang-jwt/jwt/pull/249](https://togithub.com/golang-jwt/jwt/pull/249)
- Add golangci-lint by [@&#8203;mfridman](https://togithub.com/mfridman)
in
[https://github.com/golang-jwt/jwt/pull/279](https://togithub.com/golang-jwt/jwt/pull/279)
- Added dependabot updates for GitHub actions by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/298](https://togithub.com/golang-jwt/jwt/pull/298)
- Bump actions/checkout from 2 to 3 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/golang-jwt/jwt/pull/299](https://togithub.com/golang-jwt/jwt/pull/299)
- Bump actions/setup-go from 3 to 4 by
[@&#8203;dependabot](https://togithub.com/dependabot) in
[https://github.com/golang-jwt/jwt/pull/300](https://togithub.com/golang-jwt/jwt/pull/300)
- Added coverage reporting by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/304](https://togithub.com/golang-jwt/jwt/pull/304)
- Last Documentation cleanups for `v5` release by
[@&#8203;oxisto](https://togithub.com/oxisto) in
[https://github.com/golang-jwt/jwt/pull/291](https://togithub.com/golang-jwt/jwt/pull/291)
- enable jwt.ParsePublicKeyFromPEM to parse PKCS1 Public Key by
[@&#8203;twocs](https://togithub.com/twocs) in
[https://github.com/golang-jwt/jwt/pull/120](https://togithub.com/golang-jwt/jwt/pull/120)

#### New Contributors

- [@&#8203;moneszarrugh](https://togithub.com/moneszarrugh) made their
first contribution in
[https://github.com/golang-jwt/jwt/pull/115](https://togithub.com/golang-jwt/jwt/pull/115)
- [@&#8203;liam-verta](https://togithub.com/liam-verta) made their first
contribution in
[https://github.com/golang-jwt/jwt/pull/289](https://togithub.com/golang-jwt/jwt/pull/289)
- [@&#8203;dillonstreator](https://togithub.com/dillonstreator) made
their first contribution in
[https://github.com/golang-jwt/jwt/pull/249](https://togithub.com/golang-jwt/jwt/pull/249)
- [@&#8203;dependabot](https://togithub.com/dependabot) made their first
contribution in
[https://github.com/golang-jwt/jwt/pull/299](https://togithub.com/golang-jwt/jwt/pull/299)
- [@&#8203;twocs](https://togithub.com/twocs) made their first
contribution in
[https://github.com/golang-jwt/jwt/pull/120](https://togithub.com/golang-jwt/jwt/pull/120)

**Full Changelog**:
https://github.com/golang-jwt/jwt/compare/v4.5.0...v5.0.0

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined),
Automerge - At any time (no schedule defined).

🚦 **Automerge**: Disabled by config. Please merge this manually once you
are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the
rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update
again.

---

- [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check
this box

---

This PR has been generated by [Mend
Renovate](https://www.mend.io/free-developer-tools/renovate/). View
repository job log
[here](https://developer.mend.io/github/woodpecker-ci/woodpecker).

<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiIzNi44My4wIiwidXBkYXRlZEluVmVyIjoiMzYuODMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4ifQ==-->

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: qwerty287 <ndev@web.de>
2023-09-13 09:01:01 +02:00

163 lines
6.9 KiB
Modula-2
Raw Blame History

module github.com/woodpecker-ci/woodpecker
go 1.20
require (
code.gitea.io/sdk/gitea v0.15.1-0.20221016183512-2d9ee57af1e0
codeberg.org/6543/go-yaml2json v1.0.0
codeberg.org/6543/xyaml v1.1.0
github.com/6543/logfile-open v1.2.1
github.com/alessio/shellescape v1.4.2
github.com/antonmedv/expr v1.15.1
github.com/bmatcuk/doublestar/v4 v4.6.0
github.com/caddyserver/certmagic v0.19.2
github.com/cenkalti/backoff/v4 v4.2.1
github.com/docker/cli v20.10.25+incompatible
github.com/docker/distribution v2.8.2+incompatible
github.com/docker/docker v20.10.25+incompatible
github.com/docker/go-connections v0.4.0
github.com/docker/go-units v0.5.0
github.com/drone/envsubst v1.0.3
github.com/franela/goblin v0.0.0-20211003143422-0a4f594942bf
github.com/fsnotify/fsnotify v1.6.0
github.com/gin-gonic/gin v1.9.1
github.com/go-ap/httpsig v0.0.0-20221203064646-3647b4d88fdf
github.com/go-sql-driver/mysql v1.7.1
github.com/golang-jwt/jwt/v5 v5.0.0
github.com/google/go-github/v39 v39.2.0
github.com/google/tink/go v1.7.0
github.com/google/uuid v1.3.1
github.com/gorilla/securecookie v1.1.1
github.com/jellydator/ttlcache/v3 v3.1.0
github.com/joho/godotenv v1.5.1
github.com/lib/pq v1.10.9
github.com/mattn/go-sqlite3 v1.14.17
github.com/melbahja/goph v1.3.1
github.com/moby/moby v20.10.25+incompatible
github.com/moby/term v0.5.0
github.com/oklog/ulid/v2 v2.1.0
github.com/pkg/errors v0.9.1
github.com/prometheus/client_golang v1.16.0
github.com/robfig/cron v1.2.0
github.com/rs/zerolog v1.30.0
github.com/stretchr/testify v1.8.4
github.com/swaggo/files v1.0.1
github.com/swaggo/gin-swagger v1.6.0
github.com/swaggo/swag v1.16.2
github.com/tevino/abool v1.2.0
github.com/urfave/cli/v2 v2.25.7
github.com/xanzy/go-gitlab v0.91.1
github.com/xeipuuv/gojsonschema v1.2.0
golang.org/x/crypto v0.13.0
golang.org/x/exp v0.0.0-20230905200255-921286631fa9
golang.org/x/net v0.15.0
golang.org/x/oauth2 v0.12.0
golang.org/x/sync v0.3.0
golang.org/x/term v0.12.0
google.golang.org/grpc v1.58.0
google.golang.org/protobuf v1.31.0
gopkg.in/yaml.v3 v3.0.1
k8s.io/api v0.28.1
k8s.io/apimachinery v0.28.1
k8s.io/client-go v0.28.1
xorm.io/builder v0.3.13
xorm.io/xorm v1.3.3
)
require (
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
github.com/KyleBanks/depth v1.2.1 // indirect
github.com/Microsoft/go-winio v0.6.1 // indirect
github.com/beorn7/perks v1.0.1 // indirect
github.com/bytedance/sonic v1.9.1 // indirect
github.com/cespare/xxhash/v2 v2.2.0 // indirect
github.com/chenzhuoyu/base64x v0.0.0-20221115062448-fe3a3abad311 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.2 // indirect
github.com/davecgh/go-spew v1.1.1 // indirect
github.com/davidmz/go-pageant v1.0.2 // indirect
github.com/docker/docker-credential-helpers v0.7.0 // indirect
github.com/emicklei/go-restful/v3 v3.9.0 // indirect
github.com/fatih/color v1.13.0 // indirect
github.com/gabriel-vasile/mimetype v1.4.2 // indirect
github.com/gin-contrib/sse v0.1.0 // indirect
github.com/go-fed/httpsig v1.1.0 // indirect
github.com/go-logr/logr v1.2.4 // indirect
github.com/go-openapi/jsonpointer v0.19.6 // indirect
github.com/go-openapi/jsonreference v0.20.2 // indirect
github.com/go-openapi/spec v0.20.8 // indirect
github.com/go-openapi/swag v0.22.3 // indirect
github.com/go-playground/locales v0.14.1 // indirect
github.com/go-playground/universal-translator v0.18.1 // indirect
github.com/go-playground/validator/v10 v10.14.0 // indirect
github.com/goccy/go-json v0.10.2 // indirect
github.com/gogo/protobuf v1.3.2 // indirect
github.com/golang/protobuf v1.5.3 // indirect
github.com/golang/snappy v0.0.4 // indirect
github.com/google/gnostic v0.5.7-v3refs // indirect
github.com/google/gnostic-models v0.6.8 // indirect
github.com/google/go-cmp v0.5.9 // indirect
github.com/google/go-querystring v1.1.0 // indirect
github.com/google/gofuzz v1.2.0 // indirect
github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
github.com/hashicorp/go-hclog v1.2.0 // indirect
github.com/hashicorp/go-retryablehttp v0.7.2 // indirect
github.com/hashicorp/go-version v1.5.0 // indirect
github.com/imdario/mergo v0.3.12 // indirect
github.com/josharian/intern v1.0.0 // indirect
github.com/json-iterator/go v1.1.12 // indirect
github.com/klauspost/cpuid/v2 v2.2.5 // indirect
github.com/kr/fs v0.1.0 // indirect
github.com/leodido/go-urn v1.2.4 // indirect
github.com/libdns/libdns v0.2.1 // indirect
github.com/mailru/easyjson v0.7.7 // indirect
github.com/mattn/go-colorable v0.1.12 // indirect
github.com/mattn/go-isatty v0.0.19 // indirect
github.com/matttproud/golang_protobuf_extensions v1.0.4 // indirect
github.com/mholt/acmez v1.2.0 // indirect
github.com/miekg/dns v1.1.55 // indirect
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
github.com/modern-go/reflect2 v1.0.2 // indirect
github.com/morikuni/aec v1.0.0 // indirect
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
github.com/opencontainers/go-digest v1.0.0 // indirect
github.com/opencontainers/image-spec v1.0.2 // indirect
github.com/pelletier/go-toml/v2 v2.0.8 // indirect
github.com/pkg/sftp v1.13.5 // indirect
github.com/pmezard/go-difflib v1.0.0 // indirect
github.com/prometheus/client_model v0.3.0 // indirect
github.com/prometheus/common v0.42.0 // indirect
github.com/prometheus/procfs v0.10.1 // indirect
github.com/russross/blackfriday/v2 v2.1.0 // indirect
github.com/sirupsen/logrus v1.9.0 // indirect
github.com/spf13/pflag v1.0.5 // indirect
github.com/stretchr/objx v0.5.0 // indirect
github.com/syndtr/goleveldb v1.0.0 // indirect
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
github.com/ugorji/go/codec v1.2.11 // indirect
github.com/xeipuuv/gojsonpointer v0.0.0-20180127040702-4e3ac2762d5f // indirect
github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673 // indirect
github.com/zeebo/blake3 v0.2.3 // indirect
go.uber.org/atomic v1.11.0 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.24.0 // indirect
golang.org/x/arch v0.3.0 // indirect
golang.org/x/mod v0.12.0 // indirect
golang.org/x/sys v0.12.0 // indirect
golang.org/x/text v0.13.0 // indirect
golang.org/x/time v0.3.0 // indirect
golang.org/x/tools v0.13.0 // indirect
google.golang.org/appengine v1.6.7 // indirect
google.golang.org/genproto v0.0.0-20230711160842-782d3b101e98 // indirect
google.golang.org/genproto/googleapis/rpc v0.0.0-20230711160842-782d3b101e98 // indirect
gopkg.in/inf.v0 v0.9.1 // indirect
gopkg.in/yaml.v2 v2.4.0 // indirect
gotest.tools/v3 v3.4.0 // indirect
k8s.io/klog/v2 v2.100.1 // indirect
k8s.io/kube-openapi v0.0.0-20230717233707-2695361300d9 // indirect
k8s.io/utils v0.0.0-20230406110748-d93618cff8a2 // indirect
sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
sigs.k8s.io/structured-merge-diff/v4 v4.2.3 // indirect
sigs.k8s.io/yaml v1.3.0 // indirect
)
Reference in New Issue View Git Blame Copy Permalink