Elgato_dark/fleet
1
0
Fork 0
mirror of https://github.com/fleetdm/fleet synced 2026-05-22 16:39:01 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 121
7113 commits 3323 branches 575 tags 2.3 GiB
Commit graph

136 commits

Author SHA1 Message Date
Benjamin Edwards
1a055d6cc3
add github actions role that manages dogfood deployment (#10470) 2023-03-14 12:41:32 -04:00
Benjamin Edwards
08bac6fb4d
reduce connection count in dogfood and sandbox environments (#10468) 
relates to https://github.com/fleetdm/confidential/issues/2126
 2023-03-14 11:45:22 -04:00
Zachary Winnerman
0ee617778a
Dogfood returns (#10345) 
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
 2023-03-08 16:38:53 -05:00
Robert Fairburn
e4803819a1
Update references from fleet-infra to confidential (#10388) 
Updates to support https://github.com/fleetdm/fleet/issues/10330
 2023-03-08 12:38:40 -06:00
Zachary Winnerman
23a494e291
Remove unused code in dogfood (#10249) 
```╷
│ Warning: Argument is deprecated
│ 
│   with aws_s3_bucket.osquery-results,
│   on firehose.tf line 7, in resource "aws_s3_bucket" "osquery-results":
│    7: resource "aws_s3_bucket" "osquery-results" { #tfsec:ignore:aws-s3-encryption-customer-key:exp:2022-07-01  #tfsec:ignore:aws-s3-enable-versioning #tfsec:ignore:aws-s3-enable-bucket-logging:exp:2022-06-15
│ 
│ Use the aws_s3_bucket_lifecycle_configuration resource instead
│ 
│ (and 9 more similar warnings elsewhere)
╵
Success! The configuration is valid, but there were some validation warnings as shown above.
```
 2023-03-02 11:02:59 -05:00
Zach Wasserman
c136b3bdfa
Update Fleet library versions used in Sandbox (#10230) 2023-03-01 15:22:14 -05:00
dependabot[bot]
37c9097ac0
Bump github.com/open-policy-agent/opa from 0.42.0 to 0.43.1 in /infrastructure/sandbox/JITProvisioner/lambda (#10225) 
Bumps
[github.com/open-policy-agent/opa](https://github.com/open-policy-agent/opa)
from 0.42.0 to 0.43.1.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/releases">github.com/open-policy-agent/opa's
releases</a>.</em></p>
<blockquote>
<h2>v0.43.1</h2>
<p>This is a security release fixing the following vulnerabilities:</p>
<ul>
<li>
<p>CVE-2022-36085: Respect unsafeBuiltinMap for 'with' replacements in
the compiler</p>
<p>See <a
href="https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr">https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr</a>
for all details.</p>
</li>
<li>
<p>CVE-2022-27664 and CVE-2022-32190.</p>
<p>Fixed by updating the Go version used in our builds to 1.18.6,
see <a
href="https://groups.google.com/g/golang-announce/c/x49AQzIVX-s">https://groups.google.com/g/golang-announce/c/x49AQzIVX-s</a>.
Note that CVE-2022-32190 is most likely not relevant for OPA's usage of
net/url.
But since these CVEs tend to come up in security assessment tooling
regardless,
it's better to get it out of the way.</p>
</li>
</ul>
<h2>v0.43.0</h2>
<p>This release contains a number of fixes, enhancements, and
performance improvements.</p>
<h3>Object Insertion Optimization</h3>
<p>Rego Object insertion operations did not scale linearly (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4625">#4625</a>)
in the past, and experienced noticeable reallocation/memory movement
overheads once the Object grew past 120k-150k keys in size.</p>
<p>This release introduces different handling of Object internals during
insert operations to avoid pathological reallocation behavior, and
allows linear performance scaling up into the 500k key range and
beyond.</p>
<h3>Tooling, SDK, and Runtime</h3>
<ul>
<li>Add lines covered/not covered counts to test coverage report
(authored by <a
href="https://github.com/FarisR99"><code>@​FarisR99</code></a>)</li>
<li>Plugins: Status and logs plugins now accept any HTTP 2xx status code
(authored by <a
href="https://github.com/lvisterin"><code>@​lvisterin</code></a>)</li>
<li>Runtime: Generalize OS check for MacOS to other Unix-likes (authored
by <a href="https://github.com/iamleot"><code>@​iamleot</code></a>)</li>
</ul>
<h4>Bundles Fixes</h4>
<p>The Bundles system received several bugfixes and performance
improvements in this release:</p>
<ul>
<li>Bundle: <code>opa bundle</code> command now supports
<code>.yml</code> files (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4859">#4859</a>)
authored by <a
href="https://github.com/Joffref"><code>@​Joffref</code></a> reported by
<a
href="https://github.com/rdrgmnzsakt"><code>@​rdrgmnzsakt</code></a></li>
<li>Plugins/Bundle: Use unique temporary files for persisting activated
bundles to disk (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4782">#4782</a>)
authored by <a
href="https://github.com/FredrikAppelros"><code>@​FredrikAppelros</code></a>
reported by <a
href="https://github.com/FredrikAppelros"><code>@​FredrikAppelros</code></a></li>
<li>Server: Old policy path is now checked for bundle ownership before
update (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4846">#4846</a>)</li>
<li>Storage+Bundle: Old bundle data is now cleaned before new bundle
activation (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4940">#4940</a>)</li>
<li>Bundle: Paths are now normalized before bundle root check occurs to
ensure checks are os-independent</li>
</ul>
<h4>Storage Fixes</h4>
<p>The Storage system received mostly bugfixes, with a notable
performance improvement for large bundles in this release:</p>
<ul>
<li>storage/inmem: Speed up bundle activation by avoiding unnecessary
read operations (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4898">#4898</a>)</li>
<li>storage/inmem: Paths are now created during truncate operations if
they did not exist before</li>
<li>storage/disk: Symlinks work with relative paths now (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4869">#4869</a>)</li>
</ul>
<h3>Rego and Topdown</h3>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Changelog</summary>
<p><em>Sourced from <a
href="https://github.com/open-policy-agent/opa/blob/main/CHANGELOG.md">github.com/open-policy-agent/opa's
changelog</a>.</em></p>
<blockquote>
<h2>0.43.1</h2>
<p>This is a security release fixing the following vulnerabilities:</p>
<ul>
<li>
<p>CVE-2022-36085: Respect unsafeBuiltinMap for 'with' replacements in
the compiler</p>
<p>See <a
href="https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr">https://github.com/open-policy-agent/opa/security/advisories/GHSA-f524-rf33-2jjr</a>
for all details.</p>
</li>
<li>
<p>CVE-2022-27664 and CVE-2022-32190.</p>
<p>Fixed by updating the Go version used in our builds to 1.18.6,
see <a
href="https://groups.google.com/g/golang-announce/c/x49AQzIVX-s">https://groups.google.com/g/golang-announce/c/x49AQzIVX-s</a>.
Note that CVE-2022-32190 is most likely not relevant for OPA's usage of
net/url.
But since these CVEs tend to come up in security assessment tooling
regardless,
it's better to get it out of the way.</p>
</li>
</ul>
<h2>0.43.0</h2>
<p>This release contains a number of fixes, enhancements, and
performance improvements.</p>
<h3>Object Insertion Optimization</h3>
<p>Rego Object insertion operations did not scale linearly (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4625">#4625</a>)
in the past, and experienced noticeable reallocation/memory movement
overheads once the Object grew past 120k-150k keys in size.</p>
<p>This release introduces different handling of Object internals during
insert
operations to avoid pathological reallocation behavior, and allows
linear
performance scaling up into the 500k key range and beyond.</p>
<h3>Tooling, SDK, and Runtime</h3>
<ul>
<li>Add lines covered/not covered counts to test coverage report
(authored by <a
href="https://github.com/FarisR99"><code>@​FarisR99</code></a>)</li>
<li>Plugins: Status and logs plugins now accept any HTTP 2xx status code
(authored by <a
href="https://github.com/lvisterin"><code>@​lvisterin</code></a>)</li>
<li>Runtime: Generalize OS check for MacOS to other Unix-likes (authored
by <a href="https://github.com/iamleot"><code>@​iamleot</code></a>)</li>
</ul>
<h4>Bundles Fixes</h4>
<p>The Bundles system received several bugfixes and performance
improvements in this release:</p>
<ul>
<li>Bundle: <code>opa bundle</code> command now supports
<code>.yml</code> files (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4859">#4859</a>)
authored by <a
href="https://github.com/Joffref"><code>@​Joffref</code></a> reported by
<a
href="https://github.com/rdrgmnzsakt"><code>@​rdrgmnzsakt</code></a></li>
<li>Plugins/Bundle: Use unique temporary files for persisting activated
bundles to disk (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4782">#4782</a>)
authored by <a
href="https://github.com/FredrikAppelros"><code>@​FredrikAppelros</code></a>
reported by <a
href="https://github.com/FredrikAppelros"><code>@​FredrikAppelros</code></a></li>
<li>Server: Old policy path is now checked for bundle ownership before
update (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4846">#4846</a>)</li>
<li>Storage+Bundle: Old bundle data is now cleaned before new bundle
activation (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4940">#4940</a>)</li>
<li>Bundle: Paths are now normalized before bundle root check occurs to
ensure checks are os-independent</li>
</ul>
<h4>Storage Fixes</h4>
<p>The Storage system received mostly bugfixes, with a notable
performance improvement for large bundles in this release:</p>
<ul>
<li>storage/inmem: Speed up bundle activation by avoiding unnecessary
read operations (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4898">#4898</a>)</li>
</ul>
<!-- raw HTML omitted -->
</blockquote>
<p>... (truncated)</p>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="196c92df8b"><code>196c92d</code></a>
Release v0.43.1</li>
<li><a
href="3e8c754ed0"><code>3e8c754</code></a>
ast/compile: respect unsafeBuiltinMap for 'with' replacements</li>
<li><a
href="b78756fa64"><code>b78756f</code></a>
build: bump golang: 1.18 -&gt; 1.18.6</li>
<li><a
href="d75bbdd0f9"><code>d75bbdd</code></a>
Prepare v0.43.0 release (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4949">#4949</a>)</li>
<li><a
href="a99e5a9aa6"><code>a99e5a9</code></a>
docs: add warning about importing 'future.keywords' (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4947">#4947</a>)</li>
<li><a
href="8f63046fb9"><code>8f63046</code></a>
storage+bundle: Clean old bundle data before new activation (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4944">#4944</a>)</li>
<li><a
href="462d51850c"><code>462d518</code></a>
docs: Add note about counter_server_query_cache_hit metric (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4946">#4946</a>)</li>
<li><a
href="eff91f755c"><code>eff91f7</code></a>
build(deps): bump aquasecurity/trivy-action from 0.6.0 to 0.6.1 (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4941">#4941</a>)</li>
<li><a
href="1c1957c57b"><code>1c1957c</code></a>
topdown/copypropagation: keep refs into livevars (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4936">#4936</a>)</li>
<li><a
href="7f78653f9c"><code>7f78653</code></a>
build: run 'make generate' in release container (<a
href="https://github-redirect.dependabot.com/open-policy-agent/opa/issues/4934">#4934</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/open-policy-agent/opa/compare/v0.42.0...v0.43.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/open-policy-agent/opa&package-manager=go_modules&previous-version=0.42.0&new-version=0.43.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-03-01 11:43:58 -08:00
dependabot[bot]
1a73517a7f
Bump github.com/russellhaering/goxmldsig from 1.1.0 to 1.1.1 in /infrastructure/sandbox/JITProvisioner/lambda (#10224) 
Bumps
[github.com/russellhaering/goxmldsig](https://github.com/russellhaering/goxmldsig)
from 1.1.0 to 1.1.1.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="dfbd95396a"><code>dfbd953</code></a>
Bump Go versions in Travis</li>
<li><a
href="65601c817d"><code>65601c8</code></a>
Update dependencies</li>
<li><a
href="fb23e0af61"><code>fb23e0a</code></a>
Merge pull request <a
href="https://github-redirect.dependabot.com/russellhaering/goxmldsig/issues/71">#71</a>
from aporcupine/patch-1</li>
<li><a
href="ca2b448c7d"><code>ca2b448</code></a>
Explicitly check for case where SignatureValue is nil</li>
<li><a
href="3541f5e554"><code>3541f5e</code></a>
Merge pull request <a
href="https://github-redirect.dependabot.com/russellhaering/goxmldsig/issues/67">#67</a>
from santosh653/master</li>
<li><a
href="735e3c720c"><code>735e3c7</code></a>
Update .travis.yml</li>
<li><a
href="d6a59c7d76"><code>d6a59c7</code></a>
Update .travis.yml</li>
<li><a
href="add80e26e1"><code>add80e2</code></a>
Update .travis.yml</li>
<li><a
href="0bf1c10130"><code>0bf1c10</code></a>
Merge pull request <a
href="https://github-redirect.dependabot.com/russellhaering/goxmldsig/issues/61">#61</a>
from pboyd04/UseCanonicalizationFromSigInfo</li>
<li><a
href="d396ec6179"><code>d396ec6</code></a>
Merge pull request <a
href="https://github-redirect.dependabot.com/russellhaering/goxmldsig/issues/39">#39</a>
from aykevl/fixes</li>
<li>Additional commits viewable in <a
href="https://github.com/russellhaering/goxmldsig/compare/v1.1.0...v1.1.1">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/russellhaering/goxmldsig&package-manager=go_modules&previous-version=1.1.0&new-version=1.1.1)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-03-01 11:43:35 -08:00
dependabot[bot]
74e01c36ae
Bump github.com/theupdateframework/go-tuf from 0.3.0 to 0.3.2 in /infrastructure/sandbox/PreProvisioner/lambda (#10223) 
Bumps
[github.com/theupdateframework/go-tuf](https://github.com/theupdateframework/go-tuf)
from 0.3.0 to 0.3.2.
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/theupdateframework/go-tuf/releases">github.com/theupdateframework/go-tuf's
releases</a>.</em></p>
<blockquote>
<h2>v0.3.2</h2>
<h2>Changelog</h2>
<h3>Bug fixes</h3>
<ul>
<li>b6695e4ba6d0b98beb851054c0f187df8d54a639: fix(verify): backport
&quot;Fix a vulnerability in the verification of threshold si… (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/375">#375</a>)
(<a
href="https://github.com/znewman01"><code>@​znewman01</code></a>)</li>
</ul>
<h2>v0.3.1</h2>
<h2>Changelog</h2>
<h3>Features</h3>
<ul>
<li>4bf58eb096f99647e7fd30447396c7a57202982f: feat: add
<code>payload</code> and <code>add-signature</code> commands. (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/214">#214</a>)
(<a
href="https://github.com/znewman01"><code>@​znewman01</code></a>)</li>
<li>39c23cb5043ad2c0d873f7cc7191a7256f6a3cb6: feat: add workflow
responsible for notifying of new TUF spec release (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/287">#287</a>)
(<a
href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a>)</li>
<li>355e39cb2df220fc3961396a6d0e30bcf2c9ac12: feat: Implement TAP-12
support (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/310">#310</a>)
(<a
href="https://github.com/znewman01"><code>@​znewman01</code></a>)</li>
</ul>
<h3>Bug fixes</h3>
<ul>
<li>9a41055b8eee0fee60650c43037f35b919d72d7c: fix: check root metadata
verification before snapshotting (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/293">#293</a>)
(<a href="https://github.com/asraa"><code>@​asraa</code></a>)</li>
<li>e3efe988f0371d41c83686204dc6ae23285bf33c: fix: verify length and
hashes of fetched bytes before parsing (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/325">#325</a>)
(<a href="https://github.com/joshuagl"><code>@​joshuagl</code></a>)</li>
</ul>
<h3>Others</h3>
<ul>
<li>ea0f98a4e1b72d7486e4e86baf7fd9a3ec1fc844: chore(deps): bump
arnested/go-version-action from 1.0.67 to 1.0.69 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/288">#288</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>6722937104a3178b2b899c5ce1799de129ddb294: chore(deps): bump
golangci/golangci-lint-action from 2.5.2 to 3.2.0 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/289">#289</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>e2594e68bf2239a0b60c576c47b5ede7ac8c8fe4: chore(deps): bump
actions/setup-go from 3.0.0 to 3.1.0 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/290">#290</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>580db1958c1e16ee73d53055eb9793fde1110d8e: chore(deps): bump
goreleaser/goreleaser-action from 2.9.1 to 3 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/294">#294</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>5884dab97151c7fd314ee34ac71bf0cf6167e21c: chore(deps): bump
actions/setup-go from 3.1.0 to 3.2.0 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/295">#295</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>3b26aedfe985198bc88a9dda7525938c575ca046: chore(deps): bump
arnested/go-version-action from 1.0.69 to 1.0.70 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/297">#297</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>041e818016131ec500c78ed8eb20fed9a5668861: chore(deps): bump
github.com/secure-systems-lab/go-securesystemslib (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/298">#298</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>ad96eca0239ec2cc9b6e408fbe42b2f9e9d6b1dd: chore(deps): bump
github.com/stretchr/testify from 1.7.1 to 1.7.2 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/299">#299</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>36633af8d7a2162664a58f3fb1fe36a74e10428e: chore(deps): bump
arnested/go-version-action from 1.0.70 to 1.1.0 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/300">#300</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>e24b175b00960136ecacb8111d9887d15ce47c6d: chore(deps): bump
actions/setup-python from 3.1.2 to 4 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/311">#311</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>1684c680105f90a054f04e05b0f8ac540c4ef885: docs: Update
CONTRIBUTING.md, add MAINTAINERS.md (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/309">#309</a>)
(<a
href="https://github.com/znewman01"><code>@​znewman01</code></a>)</li>
<li>4139c85cd7632c659bf00f4b2810c37eb8d71a2c: chore(deps): bump
arnested/go-version-action from 1.1.0 to 1.1.3 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/316">#316</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>36a29309b2531255fc7d374c4055dcfab0fd04e8: build: update go version
to 1.18 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/314">#314</a>)
(<a href="https://github.com/asraa"><code>@​asraa</code></a>)</li>
<li>ae904d2bb977a54e6a5527513c4d398c8d9cc285: docs: Add DCO instructions
(<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/319">#319</a>)
(<a
href="https://github.com/znewman01"><code>@​znewman01</code></a>)</li>
<li>81cd9b36a8023d6e943f0f3cacfe664603fa3177: chore(deps): bump Python
from 3.6 to 3.10 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/318">#318</a>)
(<a
href="https://github.com/rdimitrov"><code>@​rdimitrov</code></a>)</li>
<li>986a4c5a492be020d0ab16a5ea13b9963bf7af1f: chore(deps): bump requests
from 2.27.1 to 2.28.0 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/317">#317</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>439ce47c43c772ad225101494db8307e97f869c3: chore(deps): bump
github.com/stretchr/testify from 1.7.2 to 1.7.4 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/324">#324</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>3bb077e8c246429db8acafc78761de71cc4d6b62: chore(deps): bump requests
from 2.28.0 to 2.28.1 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/332">#332</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>eed9e6c4d8eac821593800fd053d8cca5ee56137: chore(deps): bump
github.com/stretchr/testify from 1.7.4 to 1.8.0 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/331">#331</a>)
(<a
href="https://github.com/dependabot"><code>@​dependabot</code></a>[bot])</li>
<li>0d40b25637fa35e4e546a0bafebaa7ee4591e172: test: fix flakey util test
(<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/333">#333</a>)
(<a href="https://github.com/asraa"><code>@​asraa</code></a>)</li>
</ul>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="b6695e4ba6"><code>b6695e4</code></a>
fix(verify): backport &quot;Fix a vulnerability in the verification of
threshold s...</li>
<li><a
href="0d40b25637"><code>0d40b25</code></a>
test: fix flakey util test (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/333">#333</a>)</li>
<li><a
href="eed9e6c4d8"><code>eed9e6c</code></a>
chore(deps): bump github.com/stretchr/testify from 1.7.4 to 1.8.0 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/331">#331</a>)</li>
<li><a
href="3bb077e8c2"><code>3bb077e</code></a>
chore(deps): bump requests from 2.28.0 to 2.28.1 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/332">#332</a>)</li>
<li><a
href="e3efe988f0"><code>e3efe98</code></a>
fix: verify length and hashes of fetched bytes before parsing (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/325">#325</a>)</li>
<li><a
href="439ce47c43"><code>439ce47</code></a>
chore(deps): bump github.com/stretchr/testify from 1.7.2 to 1.7.4 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/324">#324</a>)</li>
<li><a
href="986a4c5a49"><code>986a4c5</code></a>
chore(deps): bump requests from 2.27.1 to 2.28.0 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/317">#317</a>)</li>
<li><a
href="81cd9b36a8"><code>81cd9b3</code></a>
chore(deps): bump Python from 3.6 to 3.10 (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/318">#318</a>)</li>
<li><a
href="355e39cb2d"><code>355e39c</code></a>
feat: Implement TAP-12 support (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/310">#310</a>)</li>
<li><a
href="ae904d2bb9"><code>ae904d2</code></a>
docs: Add DCO instructions (<a
href="https://github-redirect.dependabot.com/theupdateframework/go-tuf/issues/319">#319</a>)</li>
<li>Additional commits viewable in <a
href="https://github.com/theupdateframework/go-tuf/compare/v0.3.0...v0.3.2">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=github.com/theupdateframework/go-tuf&package-manager=go_modules&previous-version=0.3.0&new-version=0.3.2)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-03-01 11:42:48 -08:00
StepSecurity Bot
fb152b9114
Pin image SHA in Dockerfiles (#10205) 
## Summary

This pull request is created by [Secure
Repo](https://app.stepsecurity.io/securerepo) at the request of @zwass.
Please merge the Pull Request to incorporate the requested changes.
Please tag @zwass on your message if you have any questions related to
the PR. You can also engage with the
[StepSecurity](https://github.com/step-security) team by tagging
@step-security-bot.

## Security Fixes

### Secure Dockerfiles

Pin image tags to digests in Dockerfiles. With the Docker v2 API
release, it became possible to use digests in place of tags when pulling
images or to use them in FROM lines in Dockerfiles.

- [The Open Source Security Foundation (OpenSSF) Security
Guide](https://github.com/ossf/scorecard/blob/main/docs/checks.md#pinned-dependencies)


## Feedback
For bug reports, feature requests, and general feedback; please create
an issue in
[step-security/secure-repo](https://github.com/step-security/secure-repo).
To create such PRs, please visit https://app.stepsecurity.io/securerepo.


Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>

---------

Signed-off-by: StepSecurity Bot <bot@stepsecurity.io>
Co-authored-by: Zach Wasserman <zach@fleetdm.com>
 2023-03-01 11:37:00 -08:00
Zachary Winnerman
4b6da3dd62
bump version (#10216) 
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
 2023-03-01 13:03:03 -05:00
Martin Angers
e3ddb5f3ce
Support matching a host in orbit enrollment using the serial number (#9612) 2023-02-28 12:55:04 -05:00
dependabot[bot]
9addac9f8e
Bump golang.org/x/net from 0.0.0-20220225172249-27dd8689420f to 0.7.0 in /infrastructure/sandbox/PreProvisioner/lambda (#10173) 
Bumps [golang.org/x/net](https://github.com/golang/net) from
0.0.0-20220225172249-27dd8689420f to 0.7.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/golang/net/commits/v0.7.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/net&package-manager=go_modules&previous-version=0.0.0-20220225172249-27dd8689420f&new-version=0.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-28 09:44:26 -08:00
dependabot[bot]
8dc9c15bc6
Bump golang.org/x/net from 0.0.0-20220722155237-a158d28d115b to 0.7.0 in /infrastructure/sandbox/JITProvisioner/lambda (#10154) 
Bumps [golang.org/x/net](https://github.com/golang/net) from
0.0.0-20220722155237-a158d28d115b to 0.7.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/golang/net/commits/v0.7.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/net&package-manager=go_modules&previous-version=0.0.0-20220722155237-a158d28d115b&new-version=0.7.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-28 09:39:28 -08:00
dependabot[bot]
4ae5d9ba2f
Bump golang.org/x/sys from 0.0.0-20211216021012-1d35b9e2eb4e to 0.1.0 in /infrastructure/sandbox/Monitoring/lambda (#10108) 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from
0.0.0-20211216021012-1d35b9e2eb4e to 0.1.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/golang/sys/commits/v0.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/sys&package-manager=go_modules&previous-version=0.0.0-20211216021012-1d35b9e2eb4e&new-version=0.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-27 18:11:48 -08:00
dependabot[bot]
c067302c2c
Bump golang.org/x/sys from 0.0.0-20220227234510-4e6760a101f9 to 0.1.0 in /infrastructure/sandbox/JITProvisioner/deprovisioner (#10109) 
Bumps [golang.org/x/sys](https://github.com/golang/sys) from
0.0.0-20220227234510-4e6760a101f9 to 0.1.0.
<details>
<summary>Commits</summary>
<ul>
<li>See full diff in <a
href="https://github.com/golang/sys/commits/v0.1.0">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/sys&package-manager=go_modules&previous-version=0.0.0-20220227234510-4e6760a101f9&new-version=0.1.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-27 18:11:30 -08:00
dependabot[bot]
6bf80ef23e
Bump golang.org/x/text from 0.3.7 to 0.3.8 in /infrastructure/sandbox/JITProvisioner/lambda (#10049) 
[//]: # (dependabot-start)
⚠️  **Dependabot is rebasing this PR** ⚠️ 

Rebasing might not happen immediately, so don't worry if this takes some
time.

Note: if you make any changes to this PR yourself, they will take
precedence over the rebase.

---

[//]: # (dependabot-end)

Bumps [golang.org/x/text](https://github.com/golang/text) from 0.3.7 to
0.3.8.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="434eadcdbc"><code>434eadc</code></a>
language: reject excessively large Accept-Language strings</li>
<li><a
href="23407e72ed"><code>23407e7</code></a>
go.mod: ignore cyclic dependency for tagging</li>
<li><a
href="b18d3dd8a4"><code>b18d3dd</code></a>
secure/precis: replace bytes.Compare with bytes.Equal</li>
<li><a
href="795e854ff3"><code>795e854</code></a>
all: replace io/ioutil with io and os package</li>
<li><a
href="b0ca10ff35"><code>b0ca10f</code></a>
internal/language: bump script types to uint16 and update registry</li>
<li><a
href="ba9b0e1d4b"><code>ba9b0e1</code></a>
go.mod: update x/tools to HEAD</li>
<li><a
href="d03b418000"><code>d03b418</code></a>
A+C: delete AUTHORS and CONTRIBUTORS</li>
<li><a
href="b4bca84b03"><code>b4bca84</code></a>
language/display: fix Tag method comment</li>
<li><a
href="ea49e3e2d5"><code>ea49e3e</code></a>
go.mod: update x/tools to HEAD</li>
<li><a
href="78819d01d0"><code>78819d0</code></a>
go.mod: update to golang.org/x/text v0.1.10</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/text/compare/v0.3.7...v0.3.8">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/text&package-manager=go_modules&previous-version=0.3.7&new-version=0.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-27 18:10:29 -08:00
dependabot[bot]
57feba63dd
Bump golang.org/x/text from 0.3.7 to 0.3.8 in /infrastructure/sandbox/PreProvisioner/lambda (#10050) 
Bumps [golang.org/x/text](https://github.com/golang/text) from 0.3.7 to
0.3.8.
<details>
<summary>Commits</summary>
<ul>
<li><a
href="434eadcdbc"><code>434eadc</code></a>
language: reject excessively large Accept-Language strings</li>
<li><a
href="23407e72ed"><code>23407e7</code></a>
go.mod: ignore cyclic dependency for tagging</li>
<li><a
href="b18d3dd8a4"><code>b18d3dd</code></a>
secure/precis: replace bytes.Compare with bytes.Equal</li>
<li><a
href="795e854ff3"><code>795e854</code></a>
all: replace io/ioutil with io and os package</li>
<li><a
href="b0ca10ff35"><code>b0ca10f</code></a>
internal/language: bump script types to uint16 and update registry</li>
<li><a
href="ba9b0e1d4b"><code>ba9b0e1</code></a>
go.mod: update x/tools to HEAD</li>
<li><a
href="d03b418000"><code>d03b418</code></a>
A+C: delete AUTHORS and CONTRIBUTORS</li>
<li><a
href="b4bca84b03"><code>b4bca84</code></a>
language/display: fix Tag method comment</li>
<li><a
href="ea49e3e2d5"><code>ea49e3e</code></a>
go.mod: update x/tools to HEAD</li>
<li><a
href="78819d01d0"><code>78819d0</code></a>
go.mod: update to golang.org/x/text v0.1.10</li>
<li>Additional commits viewable in <a
href="https://github.com/golang/text/compare/v0.3.7...v0.3.8">compare
view</a></li>
</ul>
</details>
<br />


[![Dependabot compatibility
score](https://dependabot-badges.githubapp.com/badges/compatibility_score?dependency-name=golang.org/x/text&package-manager=go_modules&previous-version=0.3.7&new-version=0.3.8)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)

Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop
Dependabot creating any more for this major version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop
Dependabot creating any more for this minor version (unless you reopen
the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop
Dependabot creating any more for this dependency (unless you reopen the
PR or upgrade to it yourself)
You can disable automated security fix PRs for this repo from the
[Security Alerts page](https://github.com/fleetdm/fleet/network/alerts).

</details>

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2023-02-27 18:09:44 -08:00
Luke Heath
71f2a62b4c
Prepare for 4.28.0 (#10103) 2023-02-27 15:19:15 -08:00
Zachary Winnerman
99b9c24b0a
Vulnerabilities run via crontab job (#9938) 
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).

---------

Co-authored-by: Benjamin Edwards <edwards.benw@gmail.com>
 2023-02-22 12:35:40 -05:00
Luke Heath
13e821d059
Prepare for 4.27.1 (#9885) 2023-02-17 19:19:02 -08:00
Lucas Manuel Rodriguez
c6ab010833
Amend the loadtesting README.md (#9650) 
Amending some parts of the README.md after following the guide to load
test #9559.

PS: Great documentation we have here!
 2023-02-06 06:54:44 -03:00
Luke Heath
b3daf3d715
Prepare for 4.27.0 (#9683) 2023-02-03 17:03:06 -08:00
KanchiMoe
a864c52e8f
Fix s3 bucket "installers" has deprecated argument (#8051) 2023-02-02 13:21:53 -05:00
Zachary Winnerman
3ba801a43b
Quick fixup (#9614) 
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
 2023-02-01 12:40:12 -05:00
Robert Fairburn
68673cfa6a
Initial osquery-perf terraform module addon (#9556) 
Added some outputs to re-use the execution and other iam roles in terraform module.
Added osquery-perf addon terraform module
 2023-01-31 15:28:57 -06:00
Zachary Winnerman
ef92b6beca
Add fleet-cloud to the remote state bucket (#9412) 
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
 2023-01-18 15:18:08 -05:00
Robert Fairburn
3bdbce10c6
Reduce queued instances and improve update_unclaimed script (#9343) 
Reduce queued instances to 10 for sandbox from 20 and make the
update_unclaimed script aware of it and improve checking.
 2023-01-16 14:09:37 -06:00
Luke Heath
b6a6ac454f
Prepare for 4.26.0 (#9326) 2023-01-13 16:26:22 -08:00
Robert Fairburn
bc142b57e3
Update sandbox tool scripts to work right with sandcastle-style tags (#9298) 
We want the sandcastle branch as a source (but it could be anything we
choose), but a vX.Y.Z-A version tag over in the sandbox, so split those
into 2 asked variables.
 2023-01-12 10:25:50 -06:00
Robert Fairburn
4a2b3ef5c9
Sandbox to 1 replica (#9276) 
This should be the configurations to limit this to 1.
 2023-01-11 21:49:06 -06:00
Zachary Winnerman
06a17c35cd
Decrease software inventory time for sandbox (#9225) 
https://fleetdm.com/docs/deploying/configuration#periodicity

# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
 2023-01-11 14:11:35 -05:00
Zachary Winnerman
fa7e8f3d49
Use new image (#9211) 
# Checklist for submitter

If some of the following don't apply, delete the relevant line.

- [ ] Changes file added for user-visible changes in `changes/` or
`orbit/changes/`.
See [Changes
files](https://fleetdm.com/docs/contributing/committing-changes#changes-files)
for more information.
- [ ] Documented any API changes (docs/Using-Fleet/REST-API.md or
docs/Contributing/API-for-contributors.md)
- [ ] Documented any permissions changes
- [ ] Input data is properly validated, `SELECT *` is avoided, SQL
injection is prevented (using placeholders for values in statements)
- [ ] Added support on fleet's osquery simulator `cmd/osquery-perf` for
new osquery data ingestion features.
- [ ] Added/updated tests
- [ ] Manual QA for all new/changed functionality
  - For Orbit and Fleet Desktop changes:
- [ ] Manual QA must be performed in the three main OSs, macOS, Windows
and Linux.
- [ ] Auto-update manual QA, from released version of component to new
version (see [tools/tuf/test](../tools/tuf/test/README.md)).
 2023-01-10 13:22:02 -05:00
Zachary Winnerman
f858186a17
Bump module versions (#9170) 2023-01-03 19:58:13 -05:00
Zachary Winnerman
114e97ba6c
Make code match what we are running in prod for sandbox timeout (#9169) 2023-01-03 19:37:19 -05:00
Zachary Winnerman
9ff51fdce8
Bump provider version and module versions (#9168) 
* Bump provider version and module versions

* fixup
 2023-01-03 19:27:20 -05:00
Zachary Winnerman
da7329cbcd
Add fix for destroying loadtesting ECR (#9154) 2023-01-02 16:07:37 -05:00
Robert Fairburn
b19233e21d
Loadtesting db size (#9152) 
* Allow for customizable DB instance type loadtesting
 2023-01-02 14:33:30 -06:00
Zachary Winnerman
d64728a5b1
Fix tags for loadtesting (#9151) 2023-01-02 15:21:10 -05:00
Zachary Winnerman
8687136c91
Allow workspace delete to work (#9150) 2023-01-02 15:04:05 -05:00
Zachary Winnerman
aedb0424a2
Add prevent destroy to rds via null resource (#9126) 
* Add prevent destroy to rds via null resource

* fixup

* fixup2
 2022-12-28 04:12:03 -05:00
Robert Fairburn
75ea8b8b88
Allow loadtests to separate git branch from dockerhub tag (#9130) 2022-12-27 15:48:54 -06:00
Luke Heath
dd29a4e718
Bump loadtest aurora version to latest (#9120) 2022-12-23 15:59:30 -06:00
Luke Heath
54e8b3e250
Prepare for 4.25.0 (#9113) 2022-12-22 15:13:24 -08:00
Tomas Touceda
71dbb71df4
Update go to 1.19.4 (#8945) 
* Update go to 1.19.4

* Comment out failing package test

* Comment out ALL the packaging tests for windows for the moment

* Update go to 1.19.4

* Comment out failing package test

* Comment out ALL the packaging tests for windows for the moment

* Update changelog

* Bump versions

* Update changelog to reflect this being a security release
 2022-12-09 11:47:17 -03:00
Luke Heath
934f8cf734
Prepare for 4.24.0 (#8902) 2022-12-01 13:03:55 -06:00
Robert Fairburn
44609419b2
arm64 Mac support for loadtesting. Quickly expire loadtesting secrets on destroy (#8889) 2022-12-01 07:35:10 -06:00
Roberto Dip
665cac41f6
enable a reader replica in load testing RDS (#8805) 
We discussed in the @fleetdm/g-platform weekly meeting that it would be good to have a read replica enabled by default in load testing, as it matches what we would recommend to customers for deployments of the size we use to load test with.

This is just what I did to get it working in the past, but I'm happy to adjust as you consider appropriate.
 2022-11-23 16:13:57 -03:00
Robert Fairburn
5d7900b388
Add scripts to update sandbox easier (#8700) 
* Add scripts to update sandbox easier

* Sort unclaimed instances in cleanup tool

* Sandbox readme update
 2022-11-16 13:30:01 -06:00
Luke Heath
af0c75e08b
Prepare for 4.23.0 (#8663) 2022-11-14 14:42:21 -08:00