Various binaries not auto-bumped

[benjaminguttmann-avtq]

Hi,

we recognized that various binaries used in the Bosh Release are not bumped via CI/CD at all.

• yq
• vault
• terraform
• certstrap? (do we even need that)
• shield

Is that on purpose? Does anything speak against adding them to CI/CD?

[norman-abramovitz]

They should be bumped. The pipeline needs to looked at again @dennisjbell @krutten

[norman-abramovitz]

@krutten @wayneeseguin Any reason not to add most of these tools to the CI to auto-bump?

Tool	Old version	New version	Source	Action
git	2.35.7	2.54.0	https://www.kernel.org/pub/software/scm/git/git-2.54.0.tar.xz	bump
tmux	3.2a	3.6b	https://github.com/tmux/tmux/releases/download/3.6b/tmux-3.6b.tar.gz	bump
vim	8.2.4528	9.2.0541	https://github.com/vim/vim/archive/refs/tags/v9.2.0541.tar.gz	bump
wget	1.21.3	1.25.0	https://ftp.gnu.org/gnu/wget/wget-1.25.0.tar.gz	bump
tree	2.0.2	2.3.2	https://gitlab.com/OldManProgrammer/unix-tree/-/archive/2.3.2/unix-tree-2.3.2.tar.gz	bump
s3cmd	2.4.0	2.4.0	(latest upstream)	skip

Pre-built binary blobs

Tool	Old version	New version	Notes	Action
terraform	1.1.7	1.5.7	last MPL-2.0 release (pre-BSL)	bump
opentofu	—	1.12.0	new blob (tofu), open-source terraform fork	add
vault	1.9.4	1.14.10	last MPL-2.0 release (pre-BSL)	bump
openbao	—	2.5.4	new blob (bao), open-source vault fork	add
certstrap	1.2.0	1.3.0		bump
jq	1.6	1.8.1		bump
shield	8.7.4	9.0.1	major version bump	bump
yq	4.25.2	4.53.2		bump
nats	1.0.2 (legacy)	—	legacy nats pub/sub client; modern natscli is a different tool	skip (user)
spiff	1.0.8	—	only a beta available upstream (1.7.0-beta-8)	skip
tmate	2.4.0	2.4.0	no upstream change since 2019-11	skip

CI-managed (Concourse jobs-upstream.yml auto-bumps)

bbr, bosh, cf, cf7, cf8, credhub, esuf, fly, genesis, safe, spruce, uaa, cloudfoundry-utils

[benjaminguttmann-avtq]

hi @norman-abramovitz

any update on this topic?

[norman-abramovitz]

The coding was done. I will need to ask after this week.

[norman-abramovitz]

This is now in place as of v5.1.3. yq, jq, shield, certstrap, opentofu, and openbao each have a CI job wired to a github-release resource that detects new upstream versions; bumps are applied via a manually-gated job (a maintainer clicks to run) with a downgrade guard backed by ci/version_control.yml. terraform and vault are intentionally pinned at their last MPL-2.0 releases (1.5.7 / 1.14.10) since later versions moved to BSL — opentofu 1.12.x and openbao 2.5.x are included as the open-source successors. All of these shipped bumped in v5.1.3: https://github.com/cloudfoundry-community/jumpbox-boshrelease/releases/tag/v5.1.3

@benjaminguttmann-avtq - The basic code is in place now. Doing some cleanup #116 #117