From cde2886a8bfd92365b03126af9c02912af1b6a48 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Thu, 29 Oct 2026 18:37:57 +0800 Subject: [PATCH] Release 0.3.4 with patched JOSE and network dependencies --- .github/workflows/ci.yml | 4 ++-- README.md | 6 ++++-- go.mod | 8 ++++---- go.sum | 16 ++++++++-------- 4 files changed, 18 insertions(+), 16 deletions(-) diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 68aa930..8362414 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -29,7 +29,7 @@ jobs: - name: Run release gate env: - VERSION_OVERRIDE: v0.3.3 + VERSION_OVERRIDE: v0.3.4 SOURCE_DATE_EPOCH: "0" run: ./scripts/ci @@ -37,7 +37,7 @@ jobs: shell: bash run: | set -euo pipefail - artifact=dist/artifacts/secret-delivery-api-0.3.3-linux-amd64.tar.xz + artifact=dist/artifacts/secret-delivery-api-0.3.4-linux-amd64.tar.xz test -f "$artifact" mkdir -p release-evidence git rev-parse HEAD > release-evidence/source-revision.txt diff --git a/README.md b/README.md index f580512..1662042 100644 --- a/README.md +++ b/README.md @@ -8,7 +8,9 @@ PastureStack is an independent community effort to preserve, audit, and moderniz ## Project status -The maintenance source builds `v0.3.3` from the preserved upstream `v0.2.2` boundary. It uses Go modules and the exact Go 1.27.3 toolchain, x/net 0.60.0, deterministic Release packaging, bounded JSON requests, HTTP resource timeouts, scoped Vault storage operations, neutral product naming, race tests, a 70% critical-path coverage gate, and a loopback local-key API integration test. Go 1.27.3 includes the [crypto/x509 mitigation for CVE-2026-111943](https://pkg.go.dev/vuln/GO-2026-6809). Published versions and immutable assets are listed in [GitHub Releases](https://github.com/PastureStack/secret-delivery-api/releases/latest). Production deployment remains disabled until the matching Server integration has passed in an isolated VM. +The maintenance source builds `v0.3.4` from the preserved upstream `v0.2.2` boundary. It uses Go modules and the exact Go 1.27.3 toolchain, go-jose/v4 4.1.6, x/net 0.62.0, deterministic Release packaging, bounded JSON requests, HTTP resource timeouts, scoped Vault storage operations, neutral product naming, race tests, a 70% critical-path coverage gate, and a loopback local-key API integration test. Go 1.27.3 includes the [crypto/x509 mitigation for CVE-2026-111943](https://pkg.go.dev/vuln/GO-2026-6809). Published versions and immutable assets are listed in [GitHub Releases](https://github.com/PastureStack/secret-delivery-api/releases/latest). Production deployment remains disabled until the matching Server integration has passed in an isolated VM. + +Version 0.3.4 updates the official dependencies for the go-jose [RSA JWK resource limit](https://github.com/go-jose/go-jose/security/advisories/GHSA-mgcc-cww5-fp2q), [CBC-HMAC panic](https://github.com/go-jose/go-jose/security/advisories/GHSA-4w3g-jfj2-cw2q), and [JSON nesting](https://github.com/go-jose/go-jose/security/advisories/GHSA-vvm8-gf78-28g4) fixes, plus x/net HTML parsing/rendering fixes [GO-2026-6860](https://pkg.go.dev/vuln/GO-2026-6860) and [GO-2026-6866](https://pkg.go.dev/vuln/GO-2026-6866). The Vault transit protocol, local-key behavior, and Go toolchain remain unchanged. Release build information and a binary-derived CycloneDX SBOM identify the dependencies actually shipped; this component release does not establish Server integration acceptance. The `none` backend is an insecure compatibility fixture and is disabled by default. It can be enabled only with `--allow-insecure-none-backend` or `ALLOW_INSECURE_NONE_BACKEND=true` for an explicitly reviewed legacy migration. The supported Server path uses the `localkey` backend on the loopback interface. @@ -24,7 +26,7 @@ make package make ci ``` -For the maintenance build, set `VERSION_OVERRIDE=v0.3.3` and `SOURCE_DATE_EPOCH=0`. Packaging produces `secret-delivery-api-0.3.3-linux-amd64.tar.xz`. Use only the immutable asset from its matching published GitHub Release; a source version is not proof of publication. PastureStack Server verifies that asset's SHA-256 digest and installs the executable under the preserved `secrets-api` compatibility name. Operators do not need to host an artifact mirror. +For the maintenance build, set `VERSION_OVERRIDE=v0.3.4` and `SOURCE_DATE_EPOCH=0`. Packaging produces `secret-delivery-api-0.3.4-linux-amd64.tar.xz`. Use only the immutable asset from its matching published GitHub Release; a source version is not proof of publication. PastureStack Server verifies that asset's SHA-256 digest and installs the executable under the preserved `secrets-api` compatibility name. Operators do not need to host an artifact mirror. See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), [ORIGIN.md](ORIGIN.md), and [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md). diff --git a/go.mod b/go.mod index 2fda4b5..1aa8a0b 100644 --- a/go.mod +++ b/go.mod @@ -15,7 +15,7 @@ require ( require ( github.com/cenkalti/backoff/v4 v4.3.0 // indirect github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect - github.com/go-jose/go-jose/v4 v4.1.4 // indirect + github.com/go-jose/go-jose/v4 v4.1.6 // indirect github.com/hashicorp/errwrap v1.1.0 // indirect github.com/hashicorp/go-cleanhttp v0.5.2 // indirect github.com/hashicorp/go-multierror v1.1.1 // indirect @@ -29,8 +29,8 @@ require ( github.com/mitchellh/mapstructure v1.5.0 // indirect github.com/russross/blackfriday/v2 v2.1.0 // indirect github.com/ryanuber/go-glob v1.0.0 // indirect - golang.org/x/net v0.60.0 // indirect - golang.org/x/sys v0.48.0 // indirect - golang.org/x/text v0.42.0 // indirect + golang.org/x/net v0.62.0 // indirect + golang.org/x/sys v0.49.0 // indirect + golang.org/x/text v0.43.0 // indirect golang.org/x/time v0.15.0 // indirect ) diff --git a/go.sum b/go.sum index 17e214d..73033d6 100644 --- a/go.sum +++ b/go.sum @@ -8,8 +8,8 @@ github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/fatih/color v1.18.0 h1:S8gINlzdQ840/4pfAwic/ZE0djQEH3wM94VfqLTZcOM= github.com/fatih/color v1.18.0/go.mod h1:4FelSpRwEGDpQ12mAdzqdOukCy4u8WUtOY6lkT/6HfU= -github.com/go-jose/go-jose/v4 v4.1.4 h1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA= -github.com/go-jose/go-jose/v4 v4.1.4/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= +github.com/go-jose/go-jose/v4 v4.1.6 h1:sNRkftxFJxwsILiQukqp5z83QBSmntVwmgRY7AqBDO4= +github.com/go-jose/go-jose/v4 v4.1.6/go.mod h1:x4oUasVrzR7071A4TnHLGSPpNOm2a21K9Kf04k1rs08= github.com/go-test/deep v1.1.1 h1:0r/53hagsehfO4bzD2Pgr/+RgHqhmf+k1Bpse2cTu1U= github.com/go-test/deep v1.1.1/go.mod h1:5C2ZWiW0ErCdrYzpqxLbTX7MG14M9iiw8DgHncVwcsE= github.com/gorilla/context v1.1.2 h1:WRkNAv2uoa03QNIc1A6u4O7DAGMUVoopZhkiXWA2V1o= @@ -68,12 +68,12 @@ github.com/urfave/cli v1.22.17 h1:SYzXoiPfQjHBbkYxbew5prZHS1TOLT3ierW8SYLqtVQ= github.com/urfave/cli v1.22.17/go.mod h1:b0ht0aqgH/6pBYzzxURyrM4xXNgsoT/n2ZzwQiEhNVo= go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= -golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= -golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= -golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= -golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= -golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= -golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= +golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= +golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= +golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=