Repository: dexidp/dex
Pull request #2107 (2021-05-04 17:54:10)

Discard package "version"
Signed-off-by: m.nabokikh <maksim.nabokikh@flant.com>

#### Overview
* Delete "version" package
* Inject version variable in two places

#### What this PR does / why we need it
Closes https://github.com/dexidp/dex/issues/1944

#### Special notes for your reviewer
I thought about this issue. It seems that injecting the version twice  (during the build stage) as good as injecting it once and then importing it two times. There is no possibility to import the version anymore, though (which was our goal).

#### Does this PR introduce a user-facing change?
```release-note
Discard package "version."
```



Patch:
diff --git a/Dockerfile b/Dockerfile
index 5630483c..735ae537 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.16.3-alpine3.13 AS builder
+FROM golang:1.16.4-alpine3.13 AS builder
 
 WORKDIR /usr/local/src/dex
 
diff --git a/Makefile b/Makefile
index 391311de..0c22b256 100644
--- a/Makefile
+++ b/Makefile
@@ -17,7 +17,7 @@ group=$(shell id -g -n)
 
 export GOBIN=$(PWD)/bin
 
-LD_FLAGS="-w -X $(REPO_PATH)/version.Version=$(VERSION)"
+LD_FLAGS="-w -X main.version=$(VERSION)"
 
 # Dependency versions
 GOLANGCI_VERSION = 1.32.2
diff --git a/cmd/dex/serve.go b/cmd/dex/serve.go
index 3f2df3ed..aaf36b32 100644
--- a/cmd/dex/serve.go
+++ b/cmd/dex/serve.go
@@ -449,7 +449,7 @@ func runServe(options serveOptions) error {
 		}
 
 		grpcSrv := grpc.NewServer(grpcOptions...)
-		api.RegisterDexServer(grpcSrv, server.NewAPI(serverConfig.Storage, logger))
+		api.RegisterDexServer(grpcSrv, server.NewAPI(serverConfig.Storage, logger, version))
 
 		grpcMetrics.InitializeMetrics(grpcSrv)
 		if c.GRPC.Reflection {
diff --git a/cmd/dex/version.go b/cmd/dex/version.go
index de206e16..99bd318b 100644
--- a/cmd/dex/version.go
+++ b/cmd/dex/version.go
@@ -5,10 +5,10 @@ import (
 	"runtime"
 
 	"github.com/spf13/cobra"
-
-	"github.com/dexidp/dex/version"
 )
 
+var version = "DEV"
+
 func commandVersion() *cobra.Command {
 	return &cobra.Command{
 		Use:   "version",
@@ -16,7 +16,7 @@ func commandVersion() *cobra.Command {
 		Run: func(_ *cobra.Command, _ []string) {
 			fmt.Printf(
 				"Dex Version: %s\nGo Version: %s\nGo OS/ARCH: %s %s\n",
-				version.Version,
+				version,
 				runtime.Version(),
 				runtime.GOOS,
 				runtime.GOARCH,
diff --git a/go.mod b/go.mod
index c12f8a8b..17d4255e 100644
--- a/go.mod
+++ b/go.mod
@@ -16,7 +16,7 @@ require (
 	github.com/gorilla/mux v1.8.0
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0
 	github.com/kylelemons/godebug v1.1.0
-	github.com/lib/pq v1.10.1
+	github.com/lib/pq v1.10.2
 	github.com/mattermost/xml-roundtrip-validator v0.1.0
 	github.com/mattn/go-sqlite3 v1.14.7
 	github.com/oklog/run v1.1.0
diff --git a/go.sum b/go.sum
index 9abe0423..fe0bebf9 100644
--- a/go.sum
+++ b/go.sum
@@ -320,8 +320,8 @@ github.com/kr/text v0.1.0/go.mod h1:4Jbv+DJW3UT/LiOwJeYQe1efqtUx/iVham/4vfdArNI=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
 github.com/lib/pq v1.10.0/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
-github.com/lib/pq v1.10.1 h1:6VXZrLU0jHBYyAqrSPa+MgPfnSvTPuMgK+k0o5kVFWo=
-github.com/lib/pq v1.10.1/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
+github.com/lib/pq v1.10.2 h1:AqzbZs4ZoCBp+GtejcpCpcxM3zlSMx29dXbUSeVtJb8=
+github.com/lib/pq v1.10.2/go.mod h1:AlVN5x4E4T544tWzH6hKfbfQvm3HdbOxrmggDNAPY9o=
 github.com/lightstep/lightstep-tracer-common/golang/gogo v0.0.0-20190605223551-bc2310a04743/go.mod h1:qklhhLq1aX+mtWk9cPHPzaBjWImj5ULL6C7HFJtXQMM=
 github.com/lightstep/lightstep-tracer-go v0.18.1/go.mod h1:jlF1pusYV4pidLvZ+XD0UBX0ZE6WURAspgAczcDHrL4=
 github.com/lyft/protoc-gen-validate v0.0.13/go.mod h1:XbGvPuh87YZc5TdIa2/I4pLk0QoUACkjt2znoq26NVQ=
diff --git a/server/api.go b/server/api.go
index 5938efa6..a68742b3 100644
--- a/server/api.go
+++ b/server/api.go
@@ -11,7 +11,6 @@ import (
 	"github.com/dexidp/dex/pkg/log"
 	"github.com/dexidp/dex/server/internal"
 	"github.com/dexidp/dex/storage"
-	"github.com/dexidp/dex/version"
 )
 
 // apiVersion increases every time a new call is added to the API. Clients should use this info
@@ -30,18 +29,20 @@ const (
 )
 
 // NewAPI returns a server which implements the gRPC API interface.
-func NewAPI(s storage.Storage, logger log.Logger) api.DexServer {
+func NewAPI(s storage.Storage, logger log.Logger, version string) api.DexServer {
 	return dexAPI{
-		s:      s,
-		logger: logger,
+		s:       s,
+		logger:  logger,
+		version: version,
 	}
 }
 
 type dexAPI struct {
 	api.UnimplementedDexServer
 
-	s      storage.Storage
-	logger log.Logger
+	s       storage.Storage
+	logger  log.Logger
+	version string
 }
 
 func (d dexAPI) CreateClient(ctx context.Context, req *api.CreateClientReq) (*api.CreateClientResp, error) {
@@ -223,7 +224,7 @@ func (d dexAPI) DeletePassword(ctx context.Context, req *api.DeletePasswordReq)
 
 func (d dexAPI) GetVersion(ctx context.Context, req *api.VersionReq) (*api.VersionResp, error) {
 	return &api.VersionResp{
-		Server: version.Version,
+		Server: d.version,
 		Api:    apiVersion,
 	}, nil
 }
diff --git a/server/handlers.go b/server/handlers.go
index 4cfe6b84..f39db575 100644
--- a/server/handlers.go
+++ b/server/handlers.go
@@ -2,6 +2,7 @@ package server
 
 import (
 	"crypto/sha256"
+	"crypto/subtle"
 	"encoding/base64"
 	"encoding/json"
 	"fmt"
@@ -678,7 +679,8 @@ func (s *Server) withClientFromStorage(w http.ResponseWriter, r *http.Request, h
 		}
 		return
 	}
-	if client.Secret != clientSecret {
+
+	if subtle.ConstantTimeCompare([]byte(client.Secret), []byte(clientSecret)) != 1 {
 		if clientSecret == "" {
 			s.logger.Infof("missing client_secret on token request for client: %s", client.ID)
 		} else {
diff --git a/server/server.go b/server/server.go
index 167dfb9a..84c3a82f 100644
--- a/server/server.go
+++ b/server/server.go
@@ -204,6 +204,7 @@ func newServer(ctx context.Context, c Config, rotationStrategy rotationStrategy)
 	if c.Storage == nil {
 		return nil, errors.New("server: storage cannot be nil")
 	}
+
 	if len(c.SupportedResponseTypes) == 0 {
 		c.SupportedResponseTypes = []string{responseTypeCode}
 	}
diff --git a/version/version.go b/version/version.go
deleted file mode 100644
index 04f684a5..00000000
--- a/version/version.go
+++ /dev/null
@@ -1,5 +0,0 @@
-// Package version contains version information for this app.
-package version
-
-// Version is set by the build scripts.
-var Version = "was not built properly"


Test patch:
diff --git a/server/api_test.go b/server/api_test.go
index e7725063..02061340 100644
--- a/server/api_test.go
+++ b/server/api_test.go
@@ -36,7 +36,7 @@ func newAPI(s storage.Storage, logger log.Logger, t *testing.T) *apiClient {
 	}
 
 	serv := grpc.NewServer()
-	api.RegisterDexServer(serv, NewAPI(s, logger))
+	api.RegisterDexServer(serv, NewAPI(s, logger, "test"))
 	go serv.Serve(l)
 
 	// Dial will retry automatically if the serv.Serve() goroutine