DO NOT MERGE: OCPBUGS-103516: posix_fadvise variant for perfscale comparison - #399
DO NOT MERGE: OCPBUGS-103516: posix_fadvise variant for perfscale comparison#399hasbro17 wants to merge 1 commit into
Conversation
…r perfscale Add a go.mod replace directive pointing bbolt at the experimental hasbro17/bbolt fadvise-random branch, which replaces madvise(MADV_RANDOM) with posix_fadvise(POSIX_FADV_RANDOM) (see etcd-io/bbolt#939). Throwaway branch for a control-plane-fips-24nodes perfscale run, to compare posix_fadvise against full MADV_RANDOM removal (etcd-io#395) and the broken baseline (etcd-io#397) on kernel 6.4+. Must not be merged. Ref: etcd-io/bbolt#939 Ref: https://redhat.atlassian.net/browse/OCPBUGS-103516 Assisted-by: Claude Code (Opus 4.8)
|
Pipeline controller notification For optional jobs, comment This repository is configured in: LGTM mode |
openshift-ci
Bot
added
the
do-not-merge/work-in-progress
|
Skipping CI for Draft Pull Request. |
openshift-ci-robot
added
jira/severity-critical
|
@hasbro17: This pull request references Jira Issue OCPBUGS-103516, which is invalid:
Comment The bug has been updated to refer to the pull request using the external bug tracker. DetailsIn response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the openshift-eng/jira-lifecycle-plugin repository. |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: hasbro17 The full list of commands accepted by this bot can be found here. The pull request process is described here DetailsNeeds approval from an approver in each of these files:
Approvers can indicate their approval by writing |
openshift-ci
Bot
added
the
approved
WalkthroughThe pull request updates the Changesbbolt replacement update
Estimated code review effort: 1 (Trivial) | ~2 minutes Possibly related PRs
Suggested reviewers: 🚥 Pre-merge checks | ✅ 15✅ Passed checks (15 passed)
✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
|
/payload-job periodic-ci-openshift-eng-ocp-perfscale-main-aws-5.0-nightly-x86-control-plane-fips-24nodes |
|
@hasbro17: trigger 1 job(s) for the /payload-(with-prs|job|aggregate|job-with-prs|aggregate-with-prs) command
See details on https://pr-payload-tests.ci.openshift.org/runs/ci/daa2fb50-95cb-11f1-97d4-2642cf99feaf-0 |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 2
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@etcdutl/go.mod`:
- Line 98: Update the bbolt replacements in etcdutl/go.mod:98 and
server/go.mod:94 to document the fork’s provenance and why it is required for
the Linux mmap advice changes, while retaining the pinned fork version. Add or
reference the requested SBOM, MIT-license, OSV, and artifact-signing evidence,
and validate the change with etcdutl and server tests plus Linux compaction,
recovery, and performance checks.
In `@go.mod`:
- Line 105: Record the bbolt fork in bill-of-materials.json by replacing
go.etcd.io/bbolt with github.com/hasbro17/bbolt and its pinned commit,
documenting the fork’s vulnerability review including GO-2026-4923, and adding
signed provenance for release artifacts. Apply the corresponding
dependency-source metadata update for go.mod:105, etcdutl/go.mod:98,
server/go.mod:94, and tests/go.mod:110; these four sites require no direct code
change beyond ensuring the BOM reflects each replacement consistently.
🪄 Autofix
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Repository: openshift/coderabbit/.coderabbit.yaml
Review profile: CHILL
Plan: Enterprise
Run ID: 2f4b6c63-283a-43b6-afbb-69ee7e252adf
⛔ Files ignored due to path filters (4)
etcdutl/go.sumis excluded by!**/*.sumgo.sumis excluded by!**/*.sumserver/go.sumis excluded by!**/*.sumtests/go.sumis excluded by!**/*.sum
📒 Files selected for processing (4)
etcdutl/go.modgo.modserver/go.modtests/go.mod
| ) | ||
|
|
||
| replace go.etcd.io/bbolt => github.com/openshift/bbolt v0.0.0-20260806041816-148dcef86a15 | ||
| replace go.etcd.io/bbolt => github.com/hasbro17/bbolt v1.3.7-0.20260811212650-b0af58f3a325 |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
git clone --filter=blob:none --no-checkout \
https://github.com/hasbro17/bbolt.git "$tmp/hasbro17-bbolt"
git -C "$tmp/hasbro17-bbolt" fetch --depth=1 origin b0af58f3a325
git -C "$tmp/hasbro17-bbolt" fetch --depth=1 \
https://github.com/etcd-io/bbolt.git \
refs/tags/v1.4.3:refs/tags/v1.4.3
git -C "$tmp/hasbro17-bbolt" diff --stat \
v1.4.3 b0af58f3a325 -- '*.go' go.mod
git -C "$tmp/hasbro17-bbolt" diff --name-status \
v1.4.3 b0af58f3a325 -- '*.go' go.modRepository: openshift/etcd
Length of output: 254
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- module declarations and replacements ---'
for f in etcdutl/go.mod server/go.mod go.mod tests/go.mod; do
if [ -f "$f" ]; then
printf '\n[%s]\n' "$f"
rg -n -C 3 'bbolt|module ' "$f"
fi
done
printf '%s\n' '--- fork commit resolution ---'
curl -fsSL 'https://api.github.com/repos/hasbro17/bbolt/commits/b0af58f3a325' |
jq '{sha: .sha, message: .commit.message, html_url: .html_url}'
printf '%s\n' '--- fork refs and tags ---'
curl -fsSL 'https://api.github.com/repos/hasbro17/bbolt/git/refs/tags/v1.3.7' |
jq '{ref: .ref, object: .object}'
curl -fsSL 'https://api.github.com/repos/hasbro17/bbolt/git/refs/tags/v1.4.3' |
jq '{ref: .ref, object: .object}' || true
printf '%s\n' '--- upstream v1.4.3 tag ---'
curl -fsSL 'https://api.github.com/repos/etcd-io/bbolt/git/refs/tags/v1.4.3' |
jq '{ref: .ref, object: .object}'Repository: openshift/etcd
Length of output: 2267
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- fork refs ---'
git ls-remote https://github.com/hasbro17/bbolt.git \
'refs/heads/*' 'refs/tags/v*' |
rg 'b0af58f3a325|refs/tags/v1\.4\.3|refs/tags/v1\.3\.7|refs/heads'
printf '%s\n' '--- upstream v1.4.3 refs ---'
git ls-remote https://github.com/etcd-io/bbolt.git \
'refs/tags/v1.4.3' 'refs/tags/v1.4.3^{}'
printf '%s\n' '--- Go proxy pseudo-version metadata ---'
curl -fsSL \
'https://proxy.golang.org/github.com/hasbro17/bbolt/@v/v1.3.7-0.20260811212650-b0af58f3a325.info' |
jq .
printf '%s\n' '--- module checksums ---'
for module_version in \
'github.com/hasbro17/bbolt@v1.3.7-0.20260811212650-b0af58f3a325' \
'go.etcd.io/bbolt@v1.4.3'; do
printf '\n[%s]\n' "$module_version"
curl -fsSL "https://sum.golang.org/lookup/$module_version" || true
doneRepository: openshift/etcd
Length of output: 1676
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
git clone --filter=blob:none --no-checkout \
https://github.com/hasbro17/bbolt.git "$tmp/bbolt"
git -C "$tmp/bbolt" fetch --depth=1 origin \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1
git -C "$tmp/bbolt" fetch --depth=1 \
https://github.com/etcd-io/bbolt.git \
refs/tags/v1.4.3:refs/tags/upstream-v1.4.3 \
refs/tags/v1.4.3^{}:refs/remotes/upstream/v1.4.3-commit
printf '%s\n' '--- commits ---'
git -C "$tmp/bbolt" rev-parse \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1 \
upstream-v1.4.3 \
upstream/v1.4.3-commit
printf '%s\n' '--- diff summary ---'
git -C "$tmp/bbolt" diff --stat \
upstream/v1.4.3-commit \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1 \
-- '*.go' go.mod
printf '%s\n' '--- changed files ---'
git -C "$tmp/bbolt" diff --name-status \
upstream/v1.4.3-commit \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1 \
-- '*.go' go.mod
printf '%s\n' '--- module files ---'
git -C "$tmp/bbolt" show \
upstream/v1.4.3-commit:go.mod
printf '\n[fork]\n'
git -C "$tmp/bbolt" show \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1:go.modRepository: openshift/etcd
Length of output: 396
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
git clone --filter=blob:none --no-checkout \
https://github.com/hasbro17/bbolt.git "$tmp/bbolt"
git -C "$tmp/bbolt" fetch --depth=1 origin \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1
git -C "$tmp/bbolt" fetch --depth=1 \
https://github.com/etcd-io/bbolt.git \
refs/tags/v1.4.3:refs/tags/upstream-v1.4.3
fork_commit="$(git -C "$tmp/bbolt" rev-parse \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1^{commit})"
upstream_commit="$(git -C "$tmp/bbolt" rev-parse \
refs/tags/upstream-v1.4.3^{commit})"
printf '%s\n' '--- commits ---'
printf 'fork: %s\n' "$fork_commit"
printf 'upstream: %s\n' "$upstream_commit"
printf '%s\n' '--- diff summary ---'
git -C "$tmp/bbolt" diff --stat \
"$upstream_commit" "$fork_commit" -- '*.go' go.mod
printf '%s\n' '--- changed files ---'
git -C "$tmp/bbolt" diff --name-status \
"$upstream_commit" "$fork_commit" -- '*.go' go.mod
printf '%s\n' '--- module files ---'
git -C "$tmp/bbolt" show "$upstream_commit:go.mod"
printf '\n[fork]\n'
git -C "$tmp/bbolt" show "$fork_commit:go.mod"Repository: openshift/etcd
Length of output: 2195
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
tmp="$(mktemp -d)"
trap 'rm -rf "$tmp"' EXIT
git clone --filter=blob:none --no-checkout \
https://github.com/hasbro17/bbolt.git "$tmp/bbolt"
git -C "$tmp/bbolt" fetch --depth=1 origin \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1
git -C "$tmp/bbolt" fetch --depth=1 \
https://github.com/etcd-io/bbolt.git \
refs/tags/v1.4.3:refs/tags/upstream-v1.4.3
fork_commit="$(git -C "$tmp/bbolt" rev-parse \
b0af58f3a3257e164b9c1f397d27766c5f6b8ba1^{commit})"
upstream_commit="$(git -C "$tmp/bbolt" rev-parse \
refs/tags/upstream-v1.4.3^{commit})"
printf '%s\n' '--- source diff ---'
git -C "$tmp/bbolt" diff --no-ext-diff --unified=80 \
"$upstream_commit" "$fork_commit" -- \
bolt_fadvise_linux.go bolt_fadvise_other.go bolt_unix.go
printf '%s\n' '--- local dependency and policy metadata ---'
git ls-files '*go.sum' '*LICENSE*' '*NOTICE*' '*SBOM*' '*provenance*' \
'.github/workflows/*' |
sed -n '1,160p'
printf '%s\n' '--- bbolt references in checksums and workflows ---'
rg -n -C 2 'bbolt|cosign|sigstore|provenance|attest|sbom|osv' \
--glob '*go.sum' --glob '.github/workflows/**' --glob 'Makefile*' \
--glob 'README*' . || trueRepository: openshift/etcd
Length of output: 10033
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- fork license files ---'
for path in LICENSE COPYING NOTICE; do
url="https://raw.githubusercontent.com/hasbro17/bbolt/b0af58f3a3257e164b9c1f397d27766c5f6b8ba1/$path"
status="$(curl -sS -o "/tmp/$path" -w '%{http_code}' "$url" || true)"
printf '%s: HTTP %s\n' "$path" "$status"
if [ "$status" = 200 ]; then
sed -n '1,12p' "/tmp/$path"
fi
done
printf '%s\n' '--- OSV records for upstream and fork module identities ---'
for module in go.etcd.io/bbolt github.com/hasbro17/bbolt; do
printf '\n[%s]\n' "$module"
curl -fsSL -X POST https://api.osv.dev/v1/query \
-H 'content-type: application/json' \
--data "{\"package\":{\"ecosystem\":\"Go\",\"name\":\"$module\"}}" |
jq -r '.vulns[]? | [.id, .summary] | `@tsv`'
doneRepository: openshift/etcd
Length of output: 909
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
printf '%s\n' '--- release and artifact workflows ---'
for file in $(git ls-files '.github/workflows/*'); do
if rg -qi 'release|artifact|image|cosign|sigstore|provenance|attest|sbom|sign' "$file"; then
printf '\n[%s]\n' "$file"
rg -n -C 3 -i \
'release|artifact|cosign|sigstore|provenance|attest|sbom|sign' "$file"
fi
doneRepository: openshift/etcd
Length of output: 2175
Document the fork provenance and validate the Linux mmap change.
The fork matches upstream go.etcd.io/bbolt v1.4.3 except for the mmap advice files. Run the etcdutl and server tests, plus Linux compaction, recovery, and performance checks. Document the need for this fork and provide provenance, SBOM, and artifact-signing evidence. go.sum pins the content, the fork uses the MIT license, and OSV reports no advisories.
📍 Affects 2 files
etcdutl/go.mod#L98-L98(this comment)server/go.mod#L94-L94
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@etcdutl/go.mod` at line 98, Update the bbolt replacements in
etcdutl/go.mod:98 and server/go.mod:94 to document the fork’s provenance and why
it is required for the Linux mmap advice changes, while retaining the pinned
fork version. Add or reference the requested SBOM, MIT-license, OSV, and
artifact-signing evidence, and validate the change with etcdutl and server tests
plus Linux compaction, recovery, and performance checks.
| ) | ||
|
|
||
| replace go.etcd.io/bbolt => github.com/openshift/bbolt v0.0.0-20260806041816-148dcef86a15 | ||
| replace go.etcd.io/bbolt => github.com/hasbro17/bbolt v1.3.7-0.20260811212650-b0af58f3a325 |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
#!/usr/bin/env bash
set -euo pipefail
repo="hasbro17/bbolt"
module="github.com/${repo}"
version="v1.3.7-0.20260811212650-b0af58f3a325"
commit="b0af58f3a325"
curl -fsSL "https://api.github.com/repos/${repo}/commits/${commit}" |
jq -e --arg prefix "${commit}" '.sha | startswith($prefix)'
curl -fsSL "https://api.github.com/repos/${repo}/license?ref=${commit}" |
jq -r '.license.spdx_id // "UNKNOWN"'
curl -fsSL -X POST "https://api.osv.dev/v1/query" \
-H "content-type: application/json" \
-d "{\"package\":{\"name\":\"${module}\",\"ecosystem\":\"Go\"},\"version\":\"${version}\"}" |
jq '{vulnerabilities: [.vulns[]?.id]}'
while IFS= read -r file; do
rg -n -F "replace go.etcd.io/bbolt => ${module} ${version}" "$file"
done < <(fd -HI -t f '^go\.mod$')
while IFS= read -r file; do
rg -n -F "${module} ${version}" "$file"
done < <(fd -HI -t f '^go\.sum$')
fd -HI -t f |
rg '(^|/)(Makefile|.*\.(yaml|yml|sh|toml|json))$' |
while IFS= read -r file; do
rg -n -i 'sbom|cyclonedx|spdx|provenance|slsa|cosign|sigstore|attest' "$file" || true
doneRepository: openshift/etcd
Length of output: 201
🏁 Script executed:
#!/usr/bin/env bash
set -u
printf '%s\n' '--- replacement declarations ---'
for file in go.mod etcdutl/go.mod server/go.mod tests/go.mod; do
if [ -f "$file" ]; then
rg -n -C 2 'go\.etcd\.io/bbolt|github\.com/hasbro17/bbolt' "$file"
fi
done
printf '%s\n' '--- fork version in sums and module files ---'
rg -n -F 'github.com/hasbro17/bbolt' --glob 'go.sum' --glob 'go.mod' . || true
printf '%s\n' '--- dependency and release metadata files ---'
git ls-files | rg '(^|/)(go\.sum|Makefile|.*\.(yaml|yml|sh|toml|json))$' | sed -n '1,240p'
printf '%s\n' '--- supply-chain controls ---'
rg -n -i 'sbom|cyclonedx|spdx|provenance|slsa|cosign|sigstore|attest|license|osv|vulnerabilit' \
--glob 'Makefile' --glob '*.yaml' --glob '*.yml' --glob '*.sh' --glob '*.toml' --glob '*.json' . || trueRepository: openshift/etcd
Length of output: 18225
🌐 Web query:
hasbro17/bbolt b0af58f3a325 v1.3.7-0.20260811212650-b0af58f3a325 GitHub
💡 Result:
The GitHub repository hasbro17/bbolt is an unofficial fork of the bbolt key/value database [1]. The primary, authoritative repository for bbolt is etcd-io/bbolt [2][3][4]. The specific identifier v1.3.7-0.20260811212650-b0af58f3a325 is a pseudo-version string typically generated by the Go module system (Go Modules) [3]. This format indicates a dependency on a specific commit (b0af58f3a325) from the repository, dated August 11, 2026 [1][3]. Because hasbro17/bbolt is not the official repository, this version string likely reflects a user-specific fork or a dependency resolution quirk rather than an official release from the maintainers of the bbolt project [1][4]. The official bbolt project uses semantic versioning and is managed under the etcd-io organization [4]. As of August 2026, the latest official release for bbolt is v1.5.0 [4]. Users are strongly advised to use the official module path, go.etcd.io/bbolt, which points to the etcd-io/bbolt repository, to ensure they are using the maintained and stable version of the software [3].
Citations:
- 1: https://github.com/hasbro17/bbolt
- 2: https://github.com/coreos/bbolt
- 3: https://pkg.go.dev/go.etcd.io/bbolt
- 4: https://github.com/etcd-io/bbolt
🌐 Web query:
site:github.com/hasbro17/bbolt license bbolt
💡 Result:
The bbolt database project is licensed under the MIT License [1]. This is a permissive free software license that allows for broad use, modification, and distribution of the software [1].
Citations:
🌐 Web query:
OSV github.com/hasbro17/bbolt v1.3.7-0.20260811212650-b0af58f3a325
💡 Result:
The OSV (Open Source Vulnerabilities) database does not contain a specific entry for the fork github.com/hasbro17/bbolt [1]. However, the primary upstream library for bbolt, go.etcd.io/bbolt, has been associated with vulnerability GO-2026-4923 (also tracked as CVE-2026-33817) [2][3][4]. This vulnerability involves an index out-of-range panic when calling Bucket.Stats on a branch page with zero elements, typically caused by database corruption [4]. While this issue was patched in the official etcd-io/bbolt repository [4], it is important to verify if the hasbro17 fork has incorporated these or other upstream security patches, as independent forks may diverge from the official maintenance track [1].
Citations:
- 1: https://github.com/hasbro17/bbolt
- 2: https://osv.dev/vulnerability/GO-2026-4923
- 3: https://osv.dev/vulnerability/UBUNTU-CVE-2026-33817
- 4: x/vulndb: potential Go vuln in go.etcd.io/bbolt golang/vulndb#4923
🏁 Script executed:
#!/usr/bin/env bash
set -u
module='github.com/hasbro17/bbolt'
version='v1.3.7-0.20260811212650-b0af58f3a325'
encoded_module='github.com/hasbro17/bbolt'
printf '%s\n' '--- Go proxy metadata ---'
for suffix in info mod zip; do
url="https://proxy.golang.org/${encoded_module}/@v/${version}.${suffix}"
printf '%s\n' "$url"
curl -fsSL "$url" | if [ "$suffix" = zip ]; then wc -c; else sed -n '1,80p'; fi || true
done
printf '%s\n' '--- Go checksum database record ---'
curl -fsSL "https://sum.golang.org/lookup/${module}@${version}" | sed -n '1,120p' || true
printf '%s\n' '--- Fork source metadata at the pinned commit ---'
for path in LICENSE COPYING go.mod; do
url="https://raw.githubusercontent.com/hasbro17/bbolt/b0af58f3a325/${path}"
printf '%s\n' "$url"
curl -fsSL "$url" | sed -n '1,40p' || true
done
printf '%s\n' '--- BOM entries for bbolt ---'
for file in bill-of-materials.json bill-of-materials.override.json; do
if [ -f "$file" ]; then
printf '%s\n' "$file"
jq -r '.. | objects | select((tostring | test("bbolt"; "i"))) ' "$file" 2>/dev/null | sed -n '1,100p'
fi
done
printf '%s\n' '--- release and security workflow controls ---'
for file in .github/workflows/verify-released-assets.yaml .github/workflows/scorecards.yml .github/workflows/codeql-analysis.yml Makefile scripts/build-release.sh scripts/release.sh scripts/updatebom.sh; do
if [ -f "$file" ]; then
printf '%s\n' "--- $file"
rg -n -i -C 2 'sbom|cyclonedx|spdx|provenance|slsa|cosign|sigstore|attest|license|vulnerabil|bill-of-materials' "$file" || true
fi
doneRepository: openshift/etcd
Length of output: 5198
🏁 Script executed:
#!/usr/bin/env bash
set -u
python3 - <<'PY'
from pathlib import Path
import re
version = "v1.3.7-0.20260811212650-b0af58f3a325"
want = f"github.com/hasbro17/bbolt {version}"
files = ["go.sum", "etcdutl/go.sum", "server/go.sum", "tests/go.sum"]
for path in files:
text = Path(path).read_text()
matches = [line for line in text.splitlines()
if line.startswith(want + " ")]
print(f"{path}: {len(matches)} content checksum line(s)")
for line in matches:
print(" " + line)
mod_matches = [line for line in text.splitlines()
if line.startswith(want + "/go.mod ")]
print(f"{path}: {len(mod_matches)} go.mod checksum line(s)")
PYRepository: openshift/etcd
Length of output: 922
🌐 Web query:
hasbro17 bbolt b0af58f3a325 LICENSE raw.githubusercontent.com
💡 Result:
The repository hasbro17/bbolt is a fork of the popular embedded key/value database for Go [1][2]. The project is licensed under the MIT License, which is standard for the bbolt project [1][3]. The specific reference "b0af58f3a325" appears to be an abbreviated git commit hash associated with the bbolt codebase, though it does not map to a primary branch or tag in the main etcd-io/bbolt repository [2]. Projects like this often maintain fork-specific history, but the core license terms for bbolt projects remain consistent with the original MIT license created by Ben Johnson [4][5][1][2]. If you are inspecting this file from a raw GitHub URL, it is retrieving the MIT license text from that specific point in the repository's history [4][5]. For production or development purposes, it is recommended to use the actively maintained version at github.com/etcd-io/bbolt [2][3].
Citations:
- 1: https://github.com/hasbro17/bbolt
- 2: https://github.com/etcd-io/bbolt
- 3: https://pkg.go.dev/go.etcd.io/bbolt
- 4: https://github.com/cblichmann/bbolt/blob/84658f4d37fe1cde06ac729c898e66b13bab6568/LICENSE
- 5: https://github.com/cblichmann/bbolt/blob/63f0e073f3f803a4ad52ddfacfc0158eb41ba31c/LICENSE
Record the fork in the supply-chain manifest before merging.
The four go.sum files authenticate the pinned commit, and the fork includes the MIT license. However, bill-of-materials.json identifies the dependency only as go.etcd.io/bbolt, not github.com/hasbro17/bbolt. Update the BOM to record the replacement source and commit. Document the fork’s vulnerability review, including upstream GO-2026-4923, and add signed provenance for release artifacts.
📍 Affects 4 files
go.mod#L105-L105(this comment)etcdutl/go.mod#L98-L98server/go.mod#L94-L94tests/go.mod#L110-L110
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In `@go.mod` at line 105, Record the bbolt fork in bill-of-materials.json by
replacing go.etcd.io/bbolt with github.com/hasbro17/bbolt and its pinned commit,
documenting the fork’s vulnerability review including GO-2026-4923, and adding
signed provenance for release artifacts. Apply the corresponding
dependency-source metadata update for go.mod:105, etcdutl/go.mod:98,
server/go.mod:94, and tests/go.mod:110; these four sites require no direct code
change beyond ensuring the BOM reflects each replacement consistently.
Source: Path instructions
|
/test perfscale-control-plane-6nodes |
|
@hasbro17: The following test failed, say
Full PR test history. Your PR dashboard. DetailsInstructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. I understand the commands that are listed here. |
2 participants
DO NOT MERGE — throwaway PR for perfscale data gathering only.
Points bbolt (via
go.modreplace) at the experimentalhasbro17/bboltfadvise-randombranch, which replaces
madvise(MADV_RANDOM)withposix_fadvise(POSIX_FADV_RANDOM)on the database fd.Both suppress readahead, but
posix_fadvisezeroes the file's readaheadwindow without setting
VM_RAND_READ, so on Linux 6.4+ it avoids theaggressive page-cache eviction that
MADV_RANDOMnow triggers.Purpose: a
control-plane-fips-24nodesperfscale run to compareposix_fadviseagainst:MADV_RANDOMremoval (merged DOWNSTREAM: carry: OCPBUGS-103516: Replace bbolt with patched fork to remove MADV_RANDOM #395 / re-run DO NOT MERGE: OCPBUGS-103516: Fixed perfscale re-run (matched baseline) #398)MADV_RANDOMbaseline (DO NOT MERGE: OCPBUGS-103516: Restore MADV_RANDOM to gather broken baseline #397)on the same kernel 6.4+ infra, to inform the upstream argument in
etcd-io/bbolt#939.
Do not merge or review — this branch will be deleted once the data is
collected.
Ref: etcd-io/bbolt#939
Ref: https://redhat.atlassian.net/browse/OCPBUGS-103516
Summary by CodeRabbit