SECCOMP-27660: Fix vulnerabilities with upstream repo changes

.circleci/config.yml

@@ -2,27 +2,28 @@
 version: 2.1
 
 orbs:
-  prometheus: prometheus/prometheus@0.16.0
+  prometheus: prometheus/prometheus@0.17.1
 
 executors:
   # This must match .promu.yml.
   golang:
     docker:
-    - image: cimg/go:1.18
+    - image: cimg/go:1.21
 
 jobs:
   test:
     executor: golang
 
     steps:
     - prometheus/setup_environment
+    - run: GOHOSTARCH=386 GOARCH=386 make test
     - run: make
     - prometheus/store_artifact:
         file: postgres_exporter
 
   integration:
     docker:
-    - image: cimg/go:1.18
+    - image: cimg/go:1.20
     - image: << parameters.postgres_image >>
       environment:
         POSTGRES_DB: circle_test
@@ -56,11 +57,12 @@ workflows:
         matrix:
           parameters:
             postgres_image:
-            - circleci/postgres:10
             - circleci/postgres:11
             - circleci/postgres:12
             - circleci/postgres:13
-            - cimg/postgres:14.1
+            - cimg/postgres:14.9
+            - cimg/postgres:15.4
+            - cimg/postgres:16.0
     - prometheus/build:
         name: build
         parallelism: 3

.github/workflows/golangci-lint.yml

@@ -1,3 +1,5 @@
+---
+# This action is synced from https://github.com/prometheus/prometheus
 name: golangci-lint
 on:
   push:
@@ -16,15 +18,15 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Checkout repository
-        uses: actions/checkout@v3
+        uses: actions/checkout@b4ffde65f46336ab88eb53be808477a3936bae11 # v4.1.1
       - name: install Go
-        uses: actions/setup-go@v4
+        uses: actions/setup-go@6edd4406fa81c3da01a34fa6f6343087c207a568 # v3.5.0
         with:
-          go-version: 1.18.x
+          go-version: 1.21.x
       - name: Install snmp_exporter/generator dependencies
         run: sudo apt-get update && sudo apt-get -y install libsnmp-dev
         if: github.repository == 'prometheus/snmp_exporter'
       - name: Lint
-        uses: golangci/golangci-lint-action@v3.4.0
+        uses: golangci/golangci-lint-action@3a919529898de77ec3da873e3063ca4b10e7f5cc # v3.7.0
         with:
-          version: v1.52.2
+          version: v1.54.2

.golangci.yml

@@ -1,4 +1,9 @@
 ---
+linters:
+  enable:
+  - misspell
+  - revive
+
 issues:
   exclude-rules:
   - path: _test.go
@@ -7,4 +12,12 @@ issues:
 
 linters-settings:
   errcheck:
-    exclude: scripts/errcheck_excludes.txt
+    exclude-functions:
+      # Never check for logger errors.
+      - (github.com/go-kit/log.Logger).Log
+  revive:
+    rules:
+      # https://github.com/mgechev/revive/blob/master/RULES_DESCRIPTIONS.md#unused-parameter
+      - name: unused-parameter
+        severity: warning
+        disabled: true

.promu.yml

@@ -1,13 +1,12 @@
 go:
     # This must match .circle/config.yml.
-    version: 1.18
+    version: 1.21
 repository:
     path: github.com/prometheus-community/postgres_exporter
 build:
     binaries:
         - name: postgres_exporter
           path: ./cmd/postgres_exporter
-    flags: -a -tags 'netgo static_build'
     ldflags: |
         -X github.com/prometheus/common/version.Version={{.Version}}
         -X github.com/prometheus/common/version.Revision={{.Revision}}

.yamllint

@@ -20,9 +20,4 @@ rules:
       config/testdata/section_key_dup.bad.yml
   line-length: disable
   truthy:
-    ignore: |
-      .github/workflows/codeql-analysis.yml
-      .github/workflows/funcbench.yml
-      .github/workflows/fuzzing.yml
-      .github/workflows/prombench.yml
-      .github/workflows/golangci-lint.yml
+    check-keys: false

CHANGELOG.md

@@ -1,6 +1,66 @@
-## master / unreleased
+## 0.15.0 / 2023-10-27
 
-## 0.12.0-rc.0 / 2022-08-26
+* [ENHANCEMENT] Add 1kB and 2kB units #915
+* [BUGFIX] Add error log when probe collector creation fails #918
+* [BUGFIX] Fix test build failures on 32-bit arch #919
+* [BUGFIX] Adjust collector to use separate connection per scrape #936
+
+## 0.14.0 / 2023-09-11
+
+* [CHANGE] Add `state` label to pg_process_idle_seconds #862
+* [CHANGE] Change database connections to one per scrape #882 #902
+* [ENHANCEMENT] Add wal collector #858
+* [ENHANCEMENT] Add database_wraparound collector #834
+* [ENHANCEMENT] Add stat_activity_autovacuum collector #840
+* [ENHANCEMENT] Add stat_wal_receiver collector #844
+* [ENHANCEMENT] Add xlog_location collector #849
+* [ENHANCEMENT] Add statio_user_indexes collector #845
+* [ENHANCEMENT] Add long_running_transactions collector #836
+* [ENHANCEMENT] Add pg_stat_user_tables_size_bytes metric #904
+* [BUGFIX] Fix tests on 32-bit systems #857
+* [BUGFIX] Fix pg_stat_statements metrics on Postgres 13+ #874 #876
+* [BUGFIX] Fix pg_stat_database metrics for NULL stats_reset #877
+* [BUGFIX] Fix pg_replication_lag_seconds on Postgres 10+ when master is idle #895
+
+## 0.13.2 / 2023-07-21
+
+* [BUGFIX] Fix type issues on pg_postmaster metrics #828
+* [BUGFIX] Fix pg_replication collector instantiation #854
+* [BUGFIX] Fix pg_process_idle metrics #855
+
+## 0.13.1 / 2023-06-27
+
+* [BUGFIX] Make collectors not fail on null values #823
+
+## 0.13.0 / 2023-06-21
+
+BREAKING CHANGES:
+
+Please note, the following features are deprecated and may be removed in a future release:
+- `auto-discover-databases`
+- `extend.query-path`
+- `constantLabels`
+- `exclude-databases`
+- `include-databases`
+
+This exporter is meant to monitor PostgresSQL servers, not the user data/databases. If
+you need a generic SQL report exporter https://github.com/burningalchemist/sql_exporter
+is recommended.
+
+* [CHANGE] Adjust log level for collector startup #784
+* [CHANGE] Move queries from queries.yaml to collectors #801
+* [CHANGE] Deprecate extend queries feature #811
+* [CHANGE] Deprecate additional database features #815
+* [CHANGE] Convert pg_stat_database to new collector #685
+* [ENHANCEMENT] Supports alternate postgres:// prefix in URLs #787
+* [BUGFIX] Fix pg_setting different help values #771
+* [BUGFIX] Fix column type for pg_replication_slots #777
+* [BUGFIX] Fix pg_stat_database collector #809
+
+## 0.12.1 / 2023-06-12
+* [BUGFIX] Fix column type for pg_replication_slots #777
+
+## 0.12.0 / 2023-03-21
 
 BREAKING CHANGES:
 
@@ -10,7 +70,11 @@ PostgreSQL servers from a single exporter by passing the target via URL
 params. See the Multi-Target Support section of the README.
 
 * [CHANGE] Add multi-target support #618
+* [CHANGE] Add usename and application_name to pg_stat_activity metrics #673
+* [FEATURE] Add replication metrics from pg_replication_slots #747
 * [BUGFIX] Add dsn type for handling datasources #678
+* [BUGFIX] Add 64kB unit for postgres 15 #740
+* [BUGFIX] Add 4kB unit for postgres compiled with small blocks #699
 
 ## 0.11.1 / 2022-08-01
 

Makefile.common

@@ -49,19 +49,19 @@ endif
 GOTEST := $(GO) test
 GOTEST_DIR :=
 ifneq ($(CIRCLE_JOB),)
-ifneq ($(shell which gotestsum),)
+ifneq ($(shell command -v gotestsum > /dev/null),)
 	GOTEST_DIR := test-results
 	GOTEST := gotestsum --junitfile $(GOTEST_DIR)/unit-tests.xml --
 endif
 endif
 
-PROMU_VERSION ?= 0.13.0
+PROMU_VERSION ?= 0.15.0
 PROMU_URL     := https://github.com/prometheus/promu/releases/download/v$(PROMU_VERSION)/promu-$(PROMU_VERSION).$(GO_BUILD_PLATFORM).tar.gz
 
 SKIP_GOLANGCI_LINT :=
 GOLANGCI_LINT :=
 GOLANGCI_LINT_OPTS ?=
-GOLANGCI_LINT_VERSION ?= v1.49.0
+GOLANGCI_LINT_VERSION ?= v1.54.2
 # golangci-lint only supports linux, darwin and windows platforms on i386/amd64.
 # windows isn't included here because of the path separator being different.
 ifeq ($(GOHOSTOS),$(filter $(GOHOSTOS),linux darwin))
@@ -91,6 +91,8 @@ BUILD_DOCKER_ARCHS = $(addprefix common-docker-,$(DOCKER_ARCHS))
 PUBLISH_DOCKER_ARCHS = $(addprefix common-docker-publish-,$(DOCKER_ARCHS))
 TAG_DOCKER_ARCHS = $(addprefix common-docker-tag-latest-,$(DOCKER_ARCHS))
 
+SANITIZED_DOCKER_IMAGE_TAG := $(subst +,-,$(DOCKER_IMAGE_TAG))
+
 ifeq ($(GOHOSTARCH),amd64)
         ifeq ($(GOHOSTOS),$(filter $(GOHOSTOS),linux freebsd darwin windows))
                 # Only supported on amd64
@@ -176,7 +178,7 @@ endif
 .PHONY: common-yamllint
 common-yamllint:
 	@echo ">> running yamllint on all YAML files in the repository"
-ifeq (, $(shell which yamllint))
+ifeq (, $(shell command -v yamllint > /dev/null))
 	@echo "yamllint not installed so skipping"
 else
 	yamllint .
@@ -205,7 +207,7 @@ common-tarball: promu
 .PHONY: common-docker $(BUILD_DOCKER_ARCHS)
 common-docker: $(BUILD_DOCKER_ARCHS)
 $(BUILD_DOCKER_ARCHS): common-docker-%:
-	docker build -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(DOCKER_IMAGE_TAG)" \
+	docker build -t "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)" \
 		-f $(DOCKERFILE_PATH) \
 		--build-arg ARCH="$*" \
 		--build-arg OS="linux" \
@@ -214,19 +216,19 @@ $(BUILD_DOCKER_ARCHS): common-docker-%:
 .PHONY: common-docker-publish $(PUBLISH_DOCKER_ARCHS)
 common-docker-publish: $(PUBLISH_DOCKER_ARCHS)
 $(PUBLISH_DOCKER_ARCHS): common-docker-publish-%:
-	docker push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(DOCKER_IMAGE_TAG)"
+	docker push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)"
 
 DOCKER_MAJOR_VERSION_TAG = $(firstword $(subst ., ,$(shell cat VERSION)))
 .PHONY: common-docker-tag-latest $(TAG_DOCKER_ARCHS)
 common-docker-tag-latest: $(TAG_DOCKER_ARCHS)
 $(TAG_DOCKER_ARCHS): common-docker-tag-latest-%:
-	docker tag "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(DOCKER_IMAGE_TAG)" "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:latest"
-	docker tag "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(DOCKER_IMAGE_TAG)" "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:v$(DOCKER_MAJOR_VERSION_TAG)"
+	docker tag "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)" "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:latest"
+	docker tag "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:$(SANITIZED_DOCKER_IMAGE_TAG)" "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$*:v$(DOCKER_MAJOR_VERSION_TAG)"
 
 .PHONY: common-docker-manifest
 common-docker-manifest:
-	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create -a "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(DOCKER_IMAGE_TAG)" $(foreach ARCH,$(DOCKER_ARCHS),$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$(ARCH):$(DOCKER_IMAGE_TAG))
-	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(DOCKER_IMAGE_TAG)"
+	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest create -a "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)" $(foreach ARCH,$(DOCKER_ARCHS),$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME)-linux-$(ARCH):$(SANITIZED_DOCKER_IMAGE_TAG))
+	DOCKER_CLI_EXPERIMENTAL=enabled docker manifest push "$(DOCKER_REPO)/$(DOCKER_IMAGE_NAME):$(SANITIZED_DOCKER_IMAGE_TAG)"
 
 .PHONY: promu
 promu: $(PROMU)