ENG-48179: Revert NewClient api usage in configgrpc.

.chloggen/jpkroehling-configgrpc-use-own-compressors-for-zstd.yaml → .chloggen/batchseder-fix-potential-deadlock.yaml

@@ -1,13 +1,19 @@
 # Use this changelog template to create an entry for release notes.
 
 # One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
-change_type: 'bug_fix'
+change_type: bug_fix
 
 # The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
-component: Use own compressors for zstd
+component: exporterhelper
 
 # A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
-note: Before this change, the zstd compressor we used didn't respect the max message size.
+note: Fix potential deadlock in the batch sender
 
 # One or more tracking issues or pull requests related to the change
-issues: [10323]
+issues: [10315]
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+change_logs: [user]

.chloggen/builder-configure-default-scheme.yaml

@@ -0,0 +1,25 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: enhancement
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: cmd/builder
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Allow setting `otelcol.CollectorSettings.ResolverSettings.DefaultScheme` via the builder's `conf_resolver.default_uri_scheme` configuration option
+
+# One or more tracking issues or pull requests related to the change
+issues: [10296]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []

.chloggen/codeboten_create-settings-receiver.yaml

@@ -0,0 +1,28 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: deprecation
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: receiver
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Deprecate CreateSettings and NewNopCreateSettings
+
+# One or more tracking issues or pull requests related to the change
+issues: [9428]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: |
+  The following methods are being renamed:
+  - receiver.CreateSettings -> receiver.Settings
+  - receiver.NewNopCreateSettings -> receiver.NewNopSettings
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [api]

.chloggen/configauth-add-context-to-public-funcs.yaml

@@ -0,0 +1,25 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: deprecation
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: configauth
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note:  Deprecate `GetClientAuthenticator` and `GetServerAuthenticator`, use `GetClientAuthenticatorContext` and `GetServerAuthenticatorContext` instead. 
+
+# One or more tracking issues or pull requests related to the change
+issues: [9808]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext:
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [api]

.chloggen/confighttp-customroundtripper.yaml

@@ -0,0 +1,25 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: deprecation
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: confighttp
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Deprecate `ClientConfig.CustomRoundTripper`
+
+# One or more tracking issues or pull requests related to the change
+issues: [8627]
+
+# (Optional) One or more lines of additional information to render under the primary note.
+# These lines will be padded with 2 spaces and then inserted directly into the document.
+# Use pipe (|) for multiline entries.
+subtext: Set the `Transport` field on the `*http.Client` object returned from `(ClientConfig).ToClient` instead.
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: [api]

.chloggen/fix_batch_sender_chaining.yaml

@@ -0,0 +1,20 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: exporterhelper
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Fix a bug when the retry and timeout logic was not applied with enabled batching.
+
+# One or more tracking issues or pull requests related to the change
+issues: [10166]
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []

.chloggen/fix_batch_sender_shutdown.yaml

@@ -0,0 +1,20 @@
+# Use this changelog template to create an entry for release notes.
+
+# One of 'breaking', 'deprecation', 'new_component', 'enhancement', 'bug_fix'
+change_type: bug_fix
+
+# The name of the component, or a single word describing the area of concern, (e.g. otlpreceiver)
+component: exporterhelper
+
+# A brief description of the change.  Surround your text with quotes ("") if it needs to start with a backtick (`).
+note: Fix a bug where an unstarted batch_sender exporter hangs on shutdown
+
+# One or more tracking issues or pull requests related to the change
+issues: [10306]
+
+# Optional: The change log or logs in which this entry should be included.
+# e.g. '[user]' or '[user, api]'
+# Include 'user' if the change is relevant to end users.
+# Include 'api' if there is a change to a library API.
+# Default: '[user]'
+change_logs: []

.github/workflows/codeql-analysis.yml

@@ -30,12 +30,12 @@ jobs:
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
+        uses: github/codeql-action/init@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8
         with:
           languages: go
 
       - name: Autobuild
-        uses: github/codeql-action/autobuild@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
+        uses: github/codeql-action/autobuild@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
+        uses: github/codeql-action/analyze@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8

.github/workflows/scorecard.yml

@@ -64,6 +64,6 @@ jobs:
 
       # Upload the results to GitHub's code scanning dashboard.
       - name: "Upload to code-scanning"
-        uses: github/codeql-action/upload-sarif@9fdb3e49720b44c48891d036bb502feb25684276 # v3.25.6
+        uses: github/codeql-action/upload-sarif@2e230e8fe0ad3a14a340ad0815ddb96d599d2aff # v3.25.8
         with:
           sarif_file: results.sarif

CHANGELOG-API.md

@@ -7,8 +7,14 @@ If you are looking for user-facing changes, check out [CHANGELOG.md](./CHANGELOG
 
 <!-- next version -->
 
+## v0.102.1
+
+No API-only changes on this release. **This release addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `configgrpc`.**
+
 ## v1.9.0/v0.102.0
 
+**This release addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `confighttp`.**
+
 ### 🛑 Breaking changes 🛑
 
 - `otelcol`: Remove deprecated `ConfigProvider` field from `CollectorSettings` (#10281)

CHANGELOG.md

@@ -7,12 +7,22 @@ If you are looking for developer-facing changes, check out [CHANGELOG-API.md](./
 
 <!-- next version -->
 
+## v0.102.1
+
+**This release addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `configgrpc`.**
+
+### 🧰 Bug fixes 🧰
+
+- `configrpc`: Use own compressors for zstd. Before this change, the zstd compressor we used didn't respect the max message size. This addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `configgrpc` (#10323)
+
 ## v1.9.0/v0.102.0
 
+**This release addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `confighttp`.**
+
 ### 🛑 Breaking changes 🛑
 
 - `envprovider`: Restricts Environment Variable names.  Environment variable names must now be ASCII only and start with a letter or an underscore, and can only contain underscores, letters, or numbers. (#9531)
-- `confighttp`: Apply MaxRequestBodySize to the result of a decompressed body (#10289)
+- `confighttp`: Apply MaxRequestBodySize to the result of a decompressed body. This addresses [GHSA-c74f-6mfw-mm4v](https://github.com/open-telemetry/opentelemetry-collector/security/advisories/GHSA-c74f-6mfw-mm4v) for `confighttp` (#10289)
   When using compressed payloads, the Collector would verify only the size of the compressed payload. 
   This change applies the same restriction to the decompressed content. As a security measure, a limit of 20 MiB was added, which makes this a breaking change. 
   For most clients, this shouldn't be a problem, but if you often have payloads that decompress to more than 20 MiB, you might want to either configure your

cmd/builder/README.md

@@ -131,6 +131,16 @@ replaces:
   - github.com/open-telemetry/opentelemetry-collector-contrib/internal/common => github.com/open-telemetry/opentelemetry-collector-contrib/internal/common v0.40.0
 ```
 
+The builder also allows setting the scheme to use as the default URI scheme via `conf_resolver.default_uri_scheme`:
+
+```yaml
+conf_resolver:
+   default_uri_scheme: "env"
+```
+
+This tells the builder to produce a Collector that uses the `env` scheme when expanding configuration that does not
+provide a scheme, such as `${HOST}` (instead of doing `${env:HOST}`).
+
 ## Steps
 
 The builder has 3 steps:

cmd/builder/go.mod

@@ -18,7 +18,7 @@ require (
 	go.uber.org/goleak v1.3.0
 	go.uber.org/multierr v1.11.0
 	go.uber.org/zap v1.27.0
-	golang.org/x/mod v0.17.0
+	golang.org/x/mod v0.18.0
 )
 
 require (

cmd/builder/internal/builder/config.go

@@ -43,9 +43,18 @@ type Config struct {
 	Replaces     []string     `mapstructure:"replaces"`
 	Excludes     []string     `mapstructure:"excludes"`
 
+	ConfResolver ConfResolver `mapstructure:"conf_resolver"`
+
 	downloadModules retry `mapstructure:"-"`
 }
 
+type ConfResolver struct {
+	// When set, will be used to set the CollectorSettings.ConfResolver.DefaultScheme value,
+	// which determines how the Collector interprets URIs that have no scheme, such as ${ENV}.
+	// See https://pkg.go.dev/go.opentelemetry.io/collector/confmap#ResolverSettings for more details.
+	DefaultURIScheme string `mapstructure:"default_uri_scheme"`
+}
+
 // Distribution holds the parameters for the final binary
 type Distribution struct {
 	Module                   string `mapstructure:"module"`

cmd/builder/internal/builder/main_test.go

@@ -316,6 +316,18 @@ func TestGenerateAndCompile(t *testing.T) {
 				return cfg
 			},
 		},
+		{
+			testCase: "ConfResolverDefaultURIScheme set",
+			cfgBuilder: func(t *testing.T) Config {
+				cfg := newTestConfig()
+				cfg.ConfResolver = ConfResolver{
+					DefaultURIScheme: "env",
+				}
+				cfg.Distribution.OutputPath = t.TempDir()
+				cfg.Replaces = append(cfg.Replaces, replaces...)
+				return cfg
+			},
+		},
 	}
 
 	for _, tt := range testCases {

cmd/builder/internal/builder/templates/main.go.tmpl

@@ -35,6 +35,9 @@ func main() {
 					{{.Name}}.NewFactory(),
 					{{- end}}
 				},
+				{{- if .ConfResolver.DefaultURIScheme }}
+				DefaultScheme: "{{ .ConfResolver.DefaultURIScheme }}",
+				{{- end }}
 				ConverterFactories: []confmap.ConverterFactory{
 					expandconverter.NewFactory(),
 				},

cmd/builder/internal/command.go

@@ -174,6 +174,8 @@ func applyCfgFromFile(flags *flag.FlagSet, cfgFromFile builder.Config) {
 	cfg.Replaces = cfgFromFile.Replaces
 	cfg.Excludes = cfgFromFile.Excludes
 
+	cfg.ConfResolver.DefaultURIScheme = cfgFromFile.ConfResolver.DefaultURIScheme
+
 	if !flags.Changed(skipGenerateFlag) && cfgFromFile.SkipGenerate {
 		cfg.SkipGenerate = cfgFromFile.SkipGenerate
 	}

cmd/builder/internal/command_test.go

@@ -84,7 +84,7 @@ func Test_applyCfgFromFile(t *testing.T) {
 		wantErr bool
 	}{
 		{
-			name: "distribution, excludes, exporters, receivers, processors, replaces are applied correctly",
+			name: "distribution, scheme, excludes, exporters, receivers, processors, replaces are applied correctly",
 			args: args{
 				flags: flag.NewFlagSet("version=1.0.0", 1),
 				cfgFromFile: builder.Config{
@@ -95,16 +95,22 @@ func Test_applyCfgFromFile(t *testing.T) {
 					Receivers:    []builder.Module{testModule},
 					Exporters:    []builder.Module{testModule},
 					Replaces:     testStringTable,
+					ConfResolver: builder.ConfResolver{
+						DefaultURIScheme: "env",
+					},
 				},
 			},
 			want: builder.Config{
 				Logger:       zap.NewNop(),
 				Distribution: testDistribution,
-				Excludes:     testStringTable,
-				Processors:   []builder.Module{testModule},
-				Receivers:    []builder.Module{testModule},
-				Exporters:    []builder.Module{testModule},
-				Replaces:     testStringTable,
+				ConfResolver: builder.ConfResolver{
+					DefaultURIScheme: "env",
+				},
+				Excludes:   testStringTable,
+				Processors: []builder.Module{testModule},
+				Receivers:  []builder.Module{testModule},
+				Exporters:  []builder.Module{testModule},
+				Replaces:   testStringTable,
 			},
 			wantErr: false,
 		},
@@ -246,6 +252,7 @@ func Test_applyCfgFromFile(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			applyCfgFromFile(tt.args.flags, tt.args.cfgFromFile)
+			assert.Equal(t, tt.want.ConfResolver.DefaultURIScheme, cfg.ConfResolver.DefaultURIScheme)
 			assert.Equal(t, tt.want.Distribution, cfg.Distribution)
 			assert.Equal(t, tt.want.SkipGenerate, cfg.SkipGenerate)
 			assert.Equal(t, tt.want.SkipCompilation, cfg.SkipCompilation)

cmd/builder/internal/config/default.yaml

@@ -5,6 +5,9 @@ dist:
   version: 0.102.1-dev
   otelcol_version: 0.102.1
 
+conf_resolver:
+  default_uri_scheme: "env"
+
 receivers:
   - gomod: go.opentelemetry.io/collector/receiver/nopreceiver v0.102.1
   - gomod: go.opentelemetry.io/collector/receiver/otlpreceiver v0.102.1