mirror of
https://github.com/milvus-io/milvus.git
synced 2026-07-21 02:05:41 +00:00
Li LiuandGitHub
c819a2c5e1
## What - Upgrade the root, pkg, client, test, and telemetry example modules from Go 1.26.4 to Go 1.26.5. - Upgrade CPU/GPU builder Dockerfiles, macOS CI Go setup, KRTE build arg, rpm setup, meta-migration builder, and go-client test image to Go 1.26.5. - Point CPU and GPU builder consumption in `.env` to the successful build-env tag `20260714-c135601`. ## Why - Latest direct Trivy scan of `milvusdb/milvus:master-20260711-1993feae-amd64` reports CVE-2026-39822 in Go stdlib 1.26.4, fixed in 1.26.5. - The normal daily image scan is currently blocked through Jenkins `milvus_scan_image_daily` #540 with `exec format error`; last successful scan is #508 from 2026-06-10, so this was verified by direct image scan. ## Image coverage - Go toolchain fixes are shared by all Milvus runtime images; no per-OS runtime Dockerfile package change is required. - Builder definitions are updated for CPU ubuntu22.04, ubuntu20.04, ubuntu24.04, amazonlinux2023, rockylinux9 and GPU ubuntu22.04, ubuntu20.04. - No runtime image variant is deliberately skipped; this is not an OS-package CVE. ## Verification - `go.dev/dl/?mode=json&include=all` confirms go1.26.5 is stable and linux amd64/arm64 tarballs exist. - `go env GOTOOLCHAIN GOVERSION` selects `auto` / `go1.26.5` after the module update. - `go list -m` succeeds for root, pkg, client, tests/go_client, and both telemetry examples. - `cd pkg && go test -tags dynamic,test -gcflags="all=-N -l" -count=1 ./util/typeutil` passes after rebasing onto the latest upstream master. - Jenkins build-env #40 succeeded and published builder tag `20260714-c135601`; `.env` now selects that tag for CPU and GPU CI builds. - A repo-wide audit found no remaining Go 1.26.4 toolchain pins. Note: full root `go mod tidy` is not included because this checkout has a root-owned `deployments/docker/dev/volumes/etcd/member` directory that makes `go mod tidy` fail with permission errors; `go mod tidy -e` subsequently OOMed locally. No go.sum changes were produced by the successful module tidies. Generated by autonomous CVE maintenance. --------- Signed-off-by: Li Liu <li.liu@zilliz.com>
41 lines
1.5 KiB
Docker
41 lines
1.5 KiB
Docker
FROM golang:1.26.5 as builder
|
|
|
|
# Define a build argument with an empty default value
|
|
ARG CUSTOM_GOPROXY=""
|
|
|
|
# Set the GOPROXY environment variable, using the specified value if provided, or a default if not
|
|
ENV GOPROXY=${CUSTOM_GOPROXY:-https://proxy.golang.org}
|
|
|
|
RUN go install gotest.tools/gotestsum@v1.13.0
|
|
|
|
# Install Python3 (3.13 in Debian Trixie) for external table test data generation.
|
|
RUN apt-get update && apt-get install -y --no-install-recommends \
|
|
python3 python3-pip && \
|
|
rm -rf /var/lib/apt/lists/*
|
|
# Required packages for external table tests (must succeed)
|
|
RUN pip3 install --no-cache-dir --break-system-packages \
|
|
pyarrow==23.0.1 pylance==0.35.0 obstore==0.9.1 substrait==0.26.0 \
|
|
'pyiceberg[sql-sqlite]==0.8.1'
|
|
# Optional: vortex-data has Rust native deps that may not build on all platforms.
|
|
# Version must match the Rust vortex crate version in milvus-storage.
|
|
RUN pip3 install --no-cache-dir --break-system-packages \
|
|
vortex-data==0.56.0 || true
|
|
|
|
# Set the Current Working Directory inside the container
|
|
WORKDIR /milvus
|
|
|
|
# Copy go mod and sum files
|
|
COPY client/go.mod client/go.mod
|
|
COPY client/go.sum client/go.sum
|
|
COPY tests/go_client/go.mod tests/go_client/
|
|
COPY tests/go_client/go.sum tests/go_client/
|
|
|
|
# Download all dependencies. Dependencies will be cached if the go.mod and go.sum files are not changed
|
|
RUN cd tests/go_client && go mod download
|
|
|
|
# Copy the source code into the container
|
|
COPY client client
|
|
COPY tests/go_client tests/go_client
|
|
|
|
WORKDIR /milvus/tests/go_client
|