Context
The gnmic Go binary is being removed from docker-ptf (companion sonic-buildimage PR to follow). This is part of an effort to reduce the attack surface of docker-ptf after a series of golang.org/x/* CVEs flagged by S360 against the embedded Go modules. The companion gnoic removal landed in sonic-buildimage#27055.
While there is no current S360 finding against gnmic itself, it is only exercised by a single integration test (tests/gnmi/test_gnmic.py, which calls gnmic capabilities via PtfGnmic.capabilities()). All other gNMI/gNOI testing in this repo uses the in-tree Python gNOI/gNMI clients (gnmi_tls.gnoi.*, pygnmi, etc.), not the gnmic CLI.
Removing the binary is therefore a low-cost reduction in supply-chain surface — but tests/gnmi/test_gnmic.py will start failing as soon as the new docker-ptf image is rolled out.
Plan
- (this issue) Skip
gnmi/test_gnmic.py via conditional_mark referencing this issue.
- Land the corresponding
docker-ptf change to remove gnmic from the image.
- Decide long-term: either delete
tests/gnmi/test_gnmic.py + tests/common/ptf_gnmic.py entirely, or restore gnmic if a real consumer emerges. Closing this issue will lift the skip — by then we should have a definitive answer.
Affected
tests/gnmi/test_gnmic.py — only test that invokes the gnmic binary.tests/common/ptf_gnmic.py — wrapper module; constructor does not shell out, so other fixtures that hold a PtfGnmic reference (gnmi_tls) are not affected unless they call methods on it.tests/common/test_ptf_gnmic.py — unit test, mocks subprocess; not affected.
Context
The
gnmicGo binary is being removed fromdocker-ptf(companion sonic-buildimage PR to follow). This is part of an effort to reduce the attack surface ofdocker-ptfafter a series of golang.org/x/* CVEs flagged by S360 against the embedded Go modules. The companiongnoicremoval landed in sonic-buildimage#27055.While there is no current S360 finding against
gnmicitself, it is only exercised by a single integration test (tests/gnmi/test_gnmic.py, which callsgnmic capabilitiesviaPtfGnmic.capabilities()). All other gNMI/gNOI testing in this repo uses the in-tree Python gNOI/gNMI clients (gnmi_tls.gnoi.*,pygnmi, etc.), not thegnmicCLI.Removing the binary is therefore a low-cost reduction in supply-chain surface — but
tests/gnmi/test_gnmic.pywill start failing as soon as the newdocker-ptfimage is rolled out.Plan
gnmi/test_gnmic.pyvia conditional_mark referencing this issue.docker-ptfchange to removegnmicfrom the image.tests/gnmi/test_gnmic.py+tests/common/ptf_gnmic.pyentirely, or restoregnmicif a real consumer emerges. Closing this issue will lift the skip — by then we should have a definitive answer.Affected
tests/gnmi/test_gnmic.py— only test that invokes thegnmicbinary.tests/common/ptf_gnmic.py— wrapper module; constructor does not shell out, so other fixtures that hold aPtfGnmicreference (gnmi_tls) are not affected unless they call methods on it.tests/common/test_ptf_gnmic.py— unit test, mocks subprocess; not affected.