Bump spegel to v0.0.20-k3s1

[dereknola]

Signed-off-by: Derek Nola derek.nola@suse.com

Proposed Changes

• New spegel version, upstream incorporated more of our patches, so we are down from 5 patches to 3 patches But we added more 🙃 .
• Bumps libp2p, making Bump libp2p for riscv support #9719 redundant
• Removes quic-go pins. The indirect version is now v0.42.0 (because we bumped libp2p), which resolves the CVE we originally pinned avoid.

Types of Changes

Dependency Bump

Verification

CI Green

Testing

Linked Issues

#7151

User-Facing Change

Further Comments

[codecov]

Codecov Report

Attention: Patch coverage is 0% with 1 lines in your changes are missing coverage. Please review.

Project coverage is 46.67%. Comparing base (49414a8) to head (b5fc99a).
Report is 2 commits behind head on master.

Files	Patch %	Lines
pkg/spegel/spegel.go	0.00%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##           master    #9863      +/-   ##
==========================================
- Coverage   52.87%   46.67%   -6.20%     
==========================================
  Files         157      157              
  Lines       13822    13822              
==========================================
- Hits         7308     6452     -856     
- Misses       5128     6132    +1004     
+ Partials     1386     1238     -148     

Flag	Coverage Δ
e2etests	38.83% <0.00%> (-10.48%)	⬇️
inttests	39.41% <0.00%> (+0.06%)	⬆️
unittests	16.82% <0.00%> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

[brandond]

k3s-io/spegel@v0.0.18-k3s4...v0.0.19-k3s1

LGTM!

[brandond]

We might have to revert this one: k3s-io/spegel@8a5978f
and keep this one instead: k3s-io/spegel@8fbe436

I don't agree with his approach to fixing the error handling. With his fix, if there is an error it just stops syncing images until the next time k3s is restarted.

[brandond]

nit on dropped patches

[dereknola]

Okay I can work on a patch bringing that back and put out a k3s2

[brandond]

yeah, probably just revert + cherry-pick should do it.

[brandond]

Now there's another one! https://github.com/spegel-org/spegel/releases/tag/v0.0.20

[dereknola]

Welp, looks like its a high severity CVE on quic-go