Skip to content

Commit fb563b2

Browse files
EdwardAngertEdwardAngert
committed
Merge remote-tracking branch 'origin/main' into 16634-networking-stack
2 parents d537022 + 101b62d commit fb563b2

File tree

503 files changed

+8363
-3184
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

503 files changed

+8363
-3184
lines changed

‎.github/ISSUE_TEMPLATE/1-bug.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
name: "🐞 Bug"
22
description: "File a bug report."
3-
title: "<title>"
3+
title: "bug: "
44
labels: ["needs-triage"]
55
body:
66
- type: checkboxes

‎.github/actions/setup-tf/action.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,5 +7,5 @@ runs:
77
- name: Install Terraform
88
uses: hashicorp/setup-terraform@b9cd54a3c349d3f38e8881555d616ced269862dd # v3.1.2
99
with:
10-
terraform_version: 1.10.5
10+
terraform_version: 1.11.0
1111
terraform_wrapper: false

‎.github/workflows/ci.yaml

Lines changed: 54 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -178,7 +178,7 @@ jobs:
178178
echo "LINT_CACHE_DIR=$dir" >> $GITHUB_ENV
179179
180180
- name: golangci-lint cache
181-
uses: actions/cache@0c907a75c2c80ebcb7f088228285e798b750cf8f # v4.2.1
181+
uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # v4.2.2
182182
with:
183183
path: |
184184
${{ env.LINT_CACHE_DIR }}
@@ -188,7 +188,7 @@ jobs:
188188
189189
# Check for any typos
190190
- name: Check for typos
191-
uses: crate-ci/typos@212923e4ff05b7fc2294a204405eec047b807138 # v1.29.9
191+
uses: crate-ci/typos@db35ee91e80fbb447f33b0e5fbddb24d2a1a884f # v1.29.10
192192
with:
193193
config: .github/workflows/typos.toml
194194

@@ -1021,7 +1021,10 @@ jobs:
10211021
if: github.ref == 'refs/heads/main' && needs.changes.outputs.docs-only == 'false' && !github.event.pull_request.head.repo.fork
10221022
runs-on: ${{ github.repository_owner == 'coder' && 'depot-ubuntu-22.04-8' || 'ubuntu-22.04' }}
10231023
permissions:
1024-
packages: write # Needed to push images to ghcr.io
1024+
# Necessary to push docker images to ghcr.io.
1025+
packages: write
1026+
# Necessary for GCP authentication (https://github.com/google-github-actions/setup-gcloud#usage)
1027+
id-token: write
10251028
env:
10261029
DOCKER_CLI_EXPERIMENTAL: "enabled"
10271030
outputs:
@@ -1050,14 +1053,46 @@ jobs:
10501053
- name: Setup Go
10511054
uses: ./.github/actions/setup-go
10521055

1056+
# Necessary for signing Windows binaries.
1057+
- name: Setup Java
1058+
uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
1059+
with:
1060+
distribution: "zulu"
1061+
java-version: "11.0"
1062+
1063+
- name: Install go-winres
1064+
run: go install github.com/tc-hib/go-winres@d743268d7ea168077ddd443c4240562d4f5e8c3e # v0.3.3
1065+
10531066
- name: Install nfpm
10541067
run: go install github.com/goreleaser/nfpm/v2/cmd/nfpm@v2.35.1
10551068

10561069
- name: Install zstd
10571070
run: sudo apt-get install -y zstd
10581071

1072+
- name: Setup Windows EV Signing Certificate
1073+
run: |
1074+
set -euo pipefail
1075+
touch /tmp/ev_cert.pem
1076+
chmod 600 /tmp/ev_cert.pem
1077+
echo "$EV_SIGNING_CERT" > /tmp/ev_cert.pem
1078+
wget https://github.com/ebourg/jsign/releases/download/6.0/jsign-6.0.jar -O /tmp/jsign-6.0.jar
1079+
env:
1080+
EV_SIGNING_CERT: ${{ secrets.EV_SIGNING_CERT }}
1081+
1082+
# Setup GCloud for signing Windows binaries.
1083+
- name: Authenticate to Google Cloud
1084+
id: gcloud_auth
1085+
uses: google-github-actions/auth@71f986410dfbc7added4569d411d040a91dc6935 # v2.1.8
1086+
with:
1087+
workload_identity_provider: ${{ secrets.GCP_CODE_SIGNING_WORKLOAD_ID_PROVIDER }}
1088+
service_account: ${{ secrets.GCP_CODE_SIGNING_SERVICE_ACCOUNT }}
1089+
token_format: "access_token"
1090+
1091+
- name: Setup GCloud SDK
1092+
uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
1093+
10591094
- name: Download dylibs
1060-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
1095+
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
10611096
with:
10621097
name: dylibs
10631098
path: ./build
@@ -1082,6 +1117,18 @@ jobs:
10821117
build/coder_linux_{amd64,arm64,armv7} \
10831118
build/coder_"$version"_windows_amd64.zip \
10841119
build/coder_"$version"_linux_amd64.{tar.gz,deb}
1120+
env:
1121+
# The Windows slim binary must be signed for Coder Desktop to accept
1122+
# it. The darwin executables don't need to be signed, but the dylibs
1123+
# do (see above).
1124+
CODER_SIGN_WINDOWS: "1"
1125+
CODER_WINDOWS_RESOURCES: "1"
1126+
EV_KEY: ${{ secrets.EV_KEY }}
1127+
EV_KEYSTORE: ${{ secrets.EV_KEYSTORE }}
1128+
EV_TSA_URL: ${{ secrets.EV_TSA_URL }}
1129+
EV_CERTIFICATE_PATH: /tmp/ev_cert.pem
1130+
GCLOUD_ACCESS_TOKEN: ${{ steps.gcloud_auth.outputs.access_token }}
1131+
JSIGN_PATH: /tmp/jsign-6.0.jar
10851132

10861133
- name: Build Linux Docker images
10871134
id: build-docker
@@ -1183,13 +1230,13 @@ jobs:
11831230
uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
11841231

11851232
- name: Set up Flux CLI
1186-
uses: fluxcd/flux2/action@af67405ee43a6cd66e0b73f4b3802e8583f9d961 # v2.5.0
1233+
uses: fluxcd/flux2/action@8d5f40dca5aa5d3c0fc3414457dda15a0ac92fa4 # v2.5.1
11871234
with:
11881235
# Keep this and the github action up to date with the version of flux installed in dogfood cluster
1189-
version: "2.2.1"
1236+
version: "2.5.1"
11901237

11911238
- name: Get Cluster Credentials
1192-
uses: google-github-actions/get-gke-credentials@7a108e64ed8546fe38316b4086e91da13f4785e1 # v2.3.1
1239+
uses: google-github-actions/get-gke-credentials@d0cee45012069b163a631894b98904a9e6723729 # v2.3.3
11931240
with:
11941241
cluster_name: dogfood-v2
11951242
location: us-central1-a

‎.github/workflows/dogfood.yaml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -53,7 +53,7 @@ jobs:
5353
uses: depot/setup-action@b0b1ea4f69e92ebf5dea3f8713a1b0c37b2126a5 # v1.6.0
5454

5555
- name: Set up Docker Buildx
56-
uses: docker/setup-buildx-action@f7ce87c1d6bead3e36075b2ce75da1f6cc28aaca # v3.9.0
56+
uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # v3.10.0
5757

5858
- name: Login to DockerHub
5959
if: github.ref == 'refs/heads/main'

‎.github/workflows/nightly-gauntlet.yaml

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@ jobs:
2020
# even if some of the preceding steps are slow.
2121
timeout-minutes: 25
2222
strategy:
23+
fail-fast: false
2324
matrix:
2425
os:
2526
- macos-latest

‎.github/workflows/release.yaml

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -223,21 +223,12 @@ jobs:
223223
distribution: "zulu"
224224
java-version: "11.0"
225225

226+
- name: Install go-winres
227+
run: go install github.com/tc-hib/go-winres@d743268d7ea168077ddd443c4240562d4f5e8c3e # v0.3.3
228+
226229
- name: Install nsis and zstd
227230
run: sudo apt-get install -y nsis zstd
228231

229-
- name: Download dylibs
230-
uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
231-
with:
232-
name: dylibs
233-
path: ./build
234-
235-
- name: Insert dylibs
236-
run: |
237-
mv ./build/*amd64.dylib ./site/out/bin/coder-vpn-darwin-amd64.dylib
238-
mv ./build/*arm64.dylib ./site/out/bin/coder-vpn-darwin-arm64.dylib
239-
mv ./build/*arm64.h ./site/out/bin/coder-vpn-darwin-dylib.h
240-
241232
- name: Install nfpm
242233
run: |
243234
set -euo pipefail
@@ -294,6 +285,18 @@ jobs:
294285
- name: Setup GCloud SDK
295286
uses: google-github-actions/setup-gcloud@77e7a554d41e2ee56fc945c52dfd3f33d12def9a # v2.1.4
296287

288+
- name: Download dylibs
289+
uses: actions/download-artifact@cc203385981b70ca67e1cc392babf9cc229d5806 # v4.1.9
290+
with:
291+
name: dylibs
292+
path: ./build
293+
294+
- name: Insert dylibs
295+
run: |
296+
mv ./build/*amd64.dylib ./site/out/bin/coder-vpn-darwin-amd64.dylib
297+
mv ./build/*arm64.dylib ./site/out/bin/coder-vpn-darwin-arm64.dylib
298+
mv ./build/*arm64.h ./site/out/bin/coder-vpn-darwin-dylib.h
299+
297300
- name: Build binaries
298301
run: |
299302
set -euo pipefail
@@ -310,6 +313,7 @@ jobs:
310313
env:
311314
CODER_SIGN_WINDOWS: "1"
312315
CODER_SIGN_DARWIN: "1"
316+
CODER_WINDOWS_RESOURCES: "1"
313317
AC_CERTIFICATE_FILE: /tmp/apple_cert.p12
314318
AC_CERTIFICATE_PASSWORD_FILE: /tmp/apple_cert_password.txt
315319
AC_APIKEY_ISSUER_ID: ${{ secrets.AC_APIKEY_ISSUER_ID }}

‎.github/workflows/scorecard.yml

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -47,6 +47,6 @@ jobs:
4747

4848
# Upload the results to GitHub's code scanning dashboard.
4949
- name: "Upload to code-scanning"
50-
uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
50+
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
5151
with:
5252
sarif_file: results.sarif

‎.github/workflows/security.yaml

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -38,7 +38,7 @@ jobs:
3838
uses: ./.github/actions/setup-go
3939

4040
- name: Initialize CodeQL
41-
uses: github/codeql-action/init@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
41+
uses: github/codeql-action/init@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
4242
with:
4343
languages: go, javascript
4444

@@ -48,7 +48,7 @@ jobs:
4848
rm Makefile
4949
5050
- name: Perform CodeQL Analysis
51-
uses: github/codeql-action/analyze@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
51+
uses: github/codeql-action/analyze@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
5252

5353
- name: Send Slack notification on failure
5454
if: ${{ failure() }}
@@ -144,7 +144,7 @@ jobs:
144144
severity: "CRITICAL,HIGH"
145145

146146
- name: Upload Trivy scan results to GitHub Security tab
147-
uses: github/codeql-action/upload-sarif@b56ba49b26e50535fa1e7f7db0f4f7b4bf65d80d # v3.28.10
147+
uses: github/codeql-action/upload-sarif@6bb031afdd8eb862ea3fc1848194185e076637e5 # v3.28.11
148148
with:
149149
sarif_file: trivy-results.sarif
150150
category: "Trivy"

‎.vscode/markdown.code-snippets

Lines changed: 8 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,14 @@
11
{
22
// For info about snippets, visit https://code.visualstudio.com/docs/editor/userdefinedsnippets
3+
// https://docs.github.com/en/get-started/writing-on-github/getting-started-with-writing-and-formatting-on-github/basic-writing-and-formatting-syntax#alerts
34

4-
"admonition": {
5-
"prefix": "#callout",
5+
"alert": {
6+
"prefix": "#alert",
67
"body": [
7-
"<blockquote class=\"admonition ${1|caution,important,note,tip,warning|}\">\n",
8-
"${TM_SELECTED_TEXT:${2:add info here}}\n",
9-
"</blockquote>\n"
8+
"> [!${1|CAUTION,IMPORTANT,NOTE,TIP,WARNING|}]",
9+
"> ${TM_SELECTED_TEXT:${2:add info here}}\n"
1010
],
11-
"description": "callout admonition caution info note tip warning"
11+
"description": "callout admonition caution important note tip warning"
1212
},
1313
"fenced code block": {
1414
"prefix": "#codeblock",
@@ -23,9 +23,8 @@
2323
"premium-feature": {
2424
"prefix": "#premium-feature",
2525
"body": [
26-
"<blockquote class=\"info\">\n",
27-
"${1:feature} ${2|is,are|} an Enterprise and Premium feature. [Learn more](https://coder.com/pricing#compare-plans).\n",
28-
"</blockquote>"
26+
"> [!NOTE]\n",
27+
"> ${1:feature} ${2|is,are|} an Enterprise and Premium feature. [Learn more](https://coder.com/pricing#compare-plans).\n"
2928
]
3029
},
3130
"tabs": {

‎agent/agent.go

Lines changed: 21 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@ import (
1414
"os"
1515
"os/user"
1616
"path/filepath"
17+
"slices"
1718
"sort"
1819
"strconv"
1920
"strings"
@@ -26,7 +27,6 @@ import (
2627
"github.com/prometheus/common/expfmt"
2728
"github.com/spf13/afero"
2829
"go.uber.org/atomic"
29-
"golang.org/x/exp/slices"
3030
"golang.org/x/sync/errgroup"
3131
"golang.org/x/xerrors"
3232
"google.golang.org/protobuf/types/known/timestamppb"
@@ -91,8 +91,7 @@ type Options struct {
9191
Execer agentexec.Execer
9292
ContainerLister agentcontainers.Lister
9393

94-
ExperimentalContainersEnabled bool
95-
ExperimentalConnectionReports bool
94+
ExperimentalDevcontainersEnabled bool
9695
}
9796

9897
type Client interface {
@@ -156,7 +155,7 @@ func New(options Options) Agent {
156155
options.Execer = agentexec.DefaultExecer
157156
}
158157
if options.ContainerLister == nil {
159-
options.ContainerLister = agentcontainers.NewDocker(options.Execer)
158+
options.ContainerLister = agentcontainers.NoopLister{}
160159
}
161160

162161
hardCtx, hardCancel := context.WithCancel(context.Background())
@@ -195,8 +194,7 @@ func New(options Options) Agent {
195194
execer: options.Execer,
196195
lister: options.ContainerLister,
197196

198-
experimentalDevcontainersEnabled: options.ExperimentalContainersEnabled,
199-
experimentalConnectionReports: options.ExperimentalConnectionReports,
197+
experimentalDevcontainersEnabled: options.ExperimentalDevcontainersEnabled,
200198
}
201199
// Initially, we have a closed channel, reflecting the fact that we are not initially connected.
202200
// Each time we connect we replace the channel (while holding the closeMutex) with a new one
@@ -273,7 +271,6 @@ type agent struct {
273271
lister agentcontainers.Lister
274272

275273
experimentalDevcontainersEnabled bool
276-
experimentalConnectionReports bool
277274
}
278275

279276
func (a *agent) TailnetConn() *tailnet.Conn {
@@ -307,6 +304,8 @@ func (a *agent) init() {
307304

308305
return a.reportConnection(id, connectionType, ip)
309306
},
307+
308+
ExperimentalDevContainersEnabled: a.experimentalDevcontainersEnabled,
310309
})
311310
if err != nil {
312311
panic(err)
@@ -335,7 +334,7 @@ func (a *agent) init() {
335334
a.metrics.connectionsTotal, a.metrics.reconnectingPTYErrors,
336335
a.reconnectingPTYTimeout,
337336
func(s *reconnectingpty.Server) {
338-
s.ExperimentalContainersEnabled = a.experimentalDevcontainersEnabled
337+
s.ExperimentalDevcontainersEnabled = a.experimentalDevcontainersEnabled
339338
},
340339
)
341340
go a.runLoop()
@@ -795,11 +794,6 @@ const (
795794
)
796795

797796
func (a *agent) reportConnection(id uuid.UUID, connectionType proto.Connection_Type, ip string) (disconnected func(code int, reason string)) {
798-
// If the experiment hasn't been enabled, we don't report connections.
799-
if !a.experimentalConnectionReports {
800-
return func(int, string) {} // Noop.
801-
}
802-
803797
// Remove the port from the IP because ports are not supported in coderd.
804798
if host, _, err := net.SplitHostPort(ip); err != nil {
805799
a.logger.Error(a.hardCtx, "split host and port for connection report failed", slog.F("ip", ip), slog.Error(err))
@@ -1360,19 +1354,22 @@ func (a *agent) createTailnet(
13601354
return nil, xerrors.Errorf("update host signer: %w", err)
13611355
}
13621356

1363-
sshListener, err := network.Listen("tcp", ":"+strconv.Itoa(workspacesdk.AgentSSHPort))
1364-
if err != nil {
1365-
return nil, xerrors.Errorf("listen on the ssh port: %w", err)
1366-
}
1367-
defer func() {
1357+
for _, port := range []int{workspacesdk.AgentSSHPort, workspacesdk.AgentStandardSSHPort} {
1358+
sshListener, err := network.Listen("tcp", ":"+strconv.Itoa(port))
13681359
if err != nil {
1369-
_ = sshListener.Close()
1360+
return nil, xerrors.Errorf("listen on the ssh port (%v): %w", port, err)
1361+
}
1362+
// nolint:revive // We do want to run the deferred functions when createTailnet returns.
1363+
defer func() {
1364+
if err != nil {
1365+
_ = sshListener.Close()
1366+
}
1367+
}()
1368+
if err = a.trackGoroutine(func() {
1369+
_ = a.sshServer.Serve(sshListener)
1370+
}); err != nil {
1371+
return nil, err
13701372
}
1371-
}()
1372-
if err = a.trackGoroutine(func() {
1373-
_ = a.sshServer.Serve(sshListener)
1374-
}); err != nil {
1375-
return nil, err
13761373
}
13771374

13781375
reconnectingPTYListener, err := network.Listen("tcp", ":"+strconv.Itoa(workspacesdk.AgentReconnectingPTYPort))

0 commit comments

Comments
 (0)
pFad - Phonifier reborn

Pfad - The Proxy pFad of © 2024 Garber Painting. All rights reserved.

Note: This service is not intended for secure transactions such as banking, social media, email, or purchasing. Use at your own risk. We assume no liability whatsoever for broken pages.


Alternative Proxies:

Alternative Proxy

pFad Proxy

pFad v3 Proxy

pFad v4 Proxy