Skip to content

libprotoc is outdated #410

@fandreuz

Description

@fandreuz

I'd like to use otel/build-protobuf to build opentelemetry-proto. I noticed the libprotoc bundled inside the image is more than two years old (3.21.6). I think this comes from the outdated gRPC version, which is also more than two years old.

This is a problem in Java because due to protocolbuffers/protobuf#19540 I'm forced to use an outdated Protobuf runtime JAR, which comes with its own set of problems:

WARNING: Vulnerable protobuf generated type in use: io.opentelemetry.proto.profiles.v1development.ProfilesDictionary
As of 2022/09/29 (release 21.7) makeExtensionsImmutable should not be called from protobuf gencode. 
If you are seeing this message, your gencode is vulnerable to a denial of service attack. You should 
regenerate your code using protobuf 25.6 or later

I know I could just use another image, or protoc directly, but I'd like to raise the discussion in the meantime. Is there any blocker?

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions