chore: bump github.com/gobwas/glob from 0.2.3 to 1.0.0 in /authbridge/authlib - #829
Conversation
Bumps [github.com/gobwas/glob](https://github.com/gobwas/glob) from 0.2.3 to 1.0.0. - [Release notes](https://github.com/gobwas/glob/releases) - [Commits](gobwas/glob@v0.2.3...v1.0.0) --- updated-dependencies: - dependency-name: github.com/gobwas/glob dependency-version: 1.0.0 dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com>
dependabot
Bot
added
dependencies
dependabot
Bot
added
dependencies
Auto-tidied by dependabot-tidy workflow to keep cmd/* go.sum files in sync with authlib after a Dependabot bump. Signed-off-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
|
OK, I won't notify you again about this release, but will get in touch when a new version is available. If you'd rather skip all updates until the next major or minor version, let me know by commenting If you change your mind, just re-open this PR and I'll resolve any conflicts on it. |
|
Closing — glob v1.0.0 cannot be adopted yet, and the blocker is outside this repo. v1.0.0 is a breaking API change, not just the engine rewrite the release notes describe.
The CI run on this branch failed with 7× The harder blocker: OPA depends on On the matching-semantics risk, for the record: since "rewrite glob for a much simpler and correct engine" implied matching behavior could have changed under our
Separator semantics, brace alternation and nesting, character classes with negation, escaping, case sensitivity and trailing-dot FQDNs are all identical, as are the three patterns Dependabot will re-propose this on the next glob release; I'm adding an ignore for glob major bumps so it does not recur until the OPA blocker clears. Assisted-By: Claude Code |
github-project-automation
Bot
moved this from New/ToDo
to Done
in Rossoctl Issue Prioritization
Extends the skip_hosts guard to the other two consumers of host patterns,
and gives all three a single owner for the behaviour.
authlib/internal/hostglob is now the one place cortex compiles an
operator-supplied host pattern and decides whether one is dangerously broad.
Three packages each did this themselves — listener/skiphost, routing and
plugins/tokenbroker — which is precisely why skiphost's guard could compare
against the literal strings "*" and "**" and miss "***", "{**}", "{*,**}"
and "?*", and why the other two had no breadth check at all. It also means
the eventual glob v1 migration (blocked on OPA, see #829) lands in one file
instead of three.
The routers deliberately do NOT copy skip_hosts' blanket rejection. A
match-all there is not a bypass: as the final route it is a legitimate
explicit catch-all, equivalent to defaultAction. The hazard is
first-match-wins — a broad early pattern silently swallows every route
beneath it, and if that early route is a passthrough then token exchange or
brokering is off for hosts the operator explicitly listed.
So both routers now reject unreachable routes instead. hostglob.Shadows is
sound rather than complete: it reports only certain unreachability — the
earlier pattern is match-all, or the later pattern is a literal the earlier
one already matches. A later wildcard shadowed by a narrower earlier wildcard
is not reported, because deciding glob subsumption in general risks a false
positive, and a false positive fails the pod at boot.
Both routers also now reject an empty host pattern (a route whose `host:` key
is missing from routes.yaml matches only an empty Host header, never real
traffic), and both take the no-route path for an empty host rather than
offering it to the patterns — a bare "*" matches the empty string under
gobwas/glob, so an unset Host header would otherwise select a "*" route and
mint or broker a token for a destination we cannot identify.
OPERATIONAL NOTE: the production router is built from the authproxy-routes
ConfigMap, so a live config containing a duplicate or shadowed route will now
fail the pod at boot instead of silently ignoring that route. Traffic
behaviour is unchanged — a shadowed route was already dead — so this trades
availability on upgrade for a loud signal. Downgrading the shadowing check to
a warning is a one-line change if that trade is not wanted.
TestResolve_FirstMatchWins configured the host "service" twice, which is dead
config and now rejected; it was rewritten to prove the same property with two
genuinely overlapping patterns ("svc-*" and "*-prod") where neither route is
unreachable.
Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com>
Signed-off-by: Hai Huang <huang195@gmail.com>
Three packages compile operator-supplied host patterns identically — glob.Compile(pattern, '.') then Match(host): - listener/skiphost/skiphost.go (bypasses the whole outbound pipeline) - routing/router.go (token-exchange routing) - plugins/tokenbroker/plugin.go (broker routing) None of them owns that behaviour; gobwas/glob does. skiphost.New's doc comment then makes load-bearing claims about it — that "*" matches every single-label host, that "**" is match-all, and that "*.*", "*.svc.cluster.local" and "service-*" are safe to accept precisely because they are not. Those claims decide which patterns the boot-time guard rejects, so a wrong one means an operator pattern silently exempts traffic from enforcement. Nothing pinned those claims to the library, so a glob upgrade could quietly invalidate them. rossoctl#829 (glob v1.0.0) is exactly that shape: its release notes describe "rewrite glob for a much simpler and _correct_ engine". It turned out to be blocked on an unrelated API break, but the semantics risk was real and unguarded either way. These tests assert the contract against the library directly, so the next bump has to prove it still holds rather than assume it. Deliberately not covered: the empty host. It is the only input whose result differs between v0.2.3 and v1.0.0 ("?" matched "" in v0.2.3 and does not in v1.0.0; a run of three or more stars flipped the other way), both need a degenerate pattern to reach, and MatchPattern returns early on host == "" so skiphost never asks glob about it. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
glob v1 is a breaking API change, not just the engine rewrite its release notes describe: Compile went from returning the Glob interface to a concrete *Pattern, and the Glob interface was removed. authlib declares glob.Glob in three packages (listener/skiphost, routing, plugins/tokenbroker), and OPA declares it as well — v1/topdown/glob.go and v1/bundle/bundle.go, still true at 1.20.1 — so glob v1 cannot be adopted here until OPA migrates. That is outside this repo, so rossoctl#829 would be reopened on every glob release with no action available. Applied to the four gomod directories that require glob and have a Dependabot entry. storage/redis does not require it; cmd/authbridge-cpex and cmd/authbridge-praxis require it but have no Dependabot entry. Matching semantics are deliberately not cited as a reason: a v0.2.3-vs-v1.0.0 differential over the repo's real pattern corpus (36 patterns x 29 hosts) differed on two cells only, both on the empty host, which skiphost never passes to glob. The contract is pinned separately in rossoctl#837. Drop this ignore once OPA is on the glob v1 API. Assisted-By: Claude (Anthropic AI) <noreply@anthropic.com> Signed-off-by: Hai Huang <huang195@gmail.com>
2 participants
Bumps github.com/gobwas/glob from 0.2.3 to 1.0.0.
Release notes
Sourced from github.com/gobwas/glob's releases.
Commits
80c58b0bench.sh: fix the assignment and the benchstat args, ignore *.bench60a7c15readme: clarify**and escaping, make the regexp comparison exactc45ce1cremove parked files (but keep them in git history)dab909eall: split parse.go into parse.go/match.go, polish docs, fix U+FFFD12d7a23globtest: print out matchers tree and pretty syntax errorsae63730shape matchers: switch from <> to () and quote literalsa82038cpattern: String() and Separators() imple9b2193ci: migrate to github actionsc0ec127glob/v1: rewrite the matching enginee7a84e9Fix speed results table formatting.Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
@dependabot rebasewill rebase this PR@dependabot recreatewill recreate this PR, overwriting any edits that have been made to it@dependabot show <dependency name> ignore conditionswill show all of the ignore conditions of the specified dependency@dependabot ignore this major versionwill close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this minor versionwill close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)@dependabot ignore this dependencywill close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)