From 83e56d90cdb34d19408248acd8cf715a6b9714a3 Mon Sep 17 00:00:00 2001 From: "trukhin.com" Date: Sun, 1 Nov 2026 19:28:32 +0100 Subject: [PATCH] fix(ci): build with Go 1.26.10 for the crypto/x509 advisory Go 1.26.10 fixes GO-2026-6809 (crypto/x509 intermediate distrust), which fails govulncheck, go-test and the release bundle gate on go1.26.9. Pin it in go.mod, every setup-go step, the PostgreSQL test container, the synthetic reference image, the etcdutl build and adjudication scripts and the release component inventory, re-pin the rebuilt etcdutl 3.6.14 digest and refresh the workflow policy digests. Signed-off-by: trukhin.com --- .github/scripts/build-release-etcdutl.sh | 2 +- .github/scripts/check-release-binaries.sh | 2 +- .github/workflow-policy.json | 10 +++---- .github/workflows/ci.yml | 26 +++++++++---------- .github/workflows/license.yml | 2 +- .github/workflows/release-provenance.yml | 12 ++++----- .github/workflows/security.yml | 8 +++--- .github/workflows/supply-chain.yml | 2 +- README.md | 2 +- contracts/etcd-recovery/README.md | 4 +-- .../etcd-recovery/image-identity.schema.json | 2 +- contracts/etcd-recovery/receipt.schema.json | 2 +- contracts/etcd-recovery/request.schema.json | 2 +- docs/ci-checks.md | 2 +- docs/development-installation.md | 2 +- docs/releasing.md | 2 +- go.mod | 2 +- pkg/backup/etcdrecovery/types.go | 2 +- reference/synthetic-service/Containerfile | 2 +- 19 files changed, 44 insertions(+), 44 deletions(-) diff --git a/.github/scripts/build-release-etcdutl.sh b/.github/scripts/build-release-etcdutl.sh index 694d855..ec3e7cd 100644 --- a/.github/scripts/build-release-etcdutl.sh +++ b/.github/scripts/build-release-etcdutl.sh @@ -17,7 +17,7 @@ version='3.6.14' source_commit='fc04cf702b0a46c2fd85547a2be05705b100a496' source_archive_sha256='c02ebbf6af5f9266f111009fb8d585649a9fcafe5788c200f5a28a7f00d438f0' source_url="https://codeload.github.com/etcd-io/etcd/tar.gz/${source_commit}" -go_version='go1.26.9' +go_version='go1.26.10' # Resolve an explicitly selected toolchain once, then disallow automatic # switching and caller-specific build settings in both independent builds. diff --git a/.github/scripts/check-release-binaries.sh b/.github/scripts/check-release-binaries.sh index bd78532..6a865ba 100644 --- a/.github/scripts/check-release-binaries.sh +++ b/.github/scripts/check-release-binaries.sh @@ -48,7 +48,7 @@ EOF etcd_version='3.6.14' source_commit='fc04cf702b0a46c2fd85547a2be05705b100a496' source_archive_sha256='c02ebbf6af5f9266f111009fb8d585649a9fcafe5788c200f5a28a7f00d438f0' -go_version='go1.26.9' +go_version='go1.26.10' etcd_version_arg='' source_commit_arg='' diff --git a/.github/workflow-policy.json b/.github/workflow-policy.json index f118631..7f03ab0 100644 --- a/.github/workflow-policy.json +++ b/.github/workflow-policy.json @@ -2,11 +2,11 @@ "schemaVersion": 1, "canonicalization": "yq-json+jq-cS", "workflows": { - ".github/workflows/ci.yml": "ff516325ce372b532df551ad62bf2a39f4154f98996cc8ed498380c36da62d0f", + ".github/workflows/ci.yml": "68f3bebb4a4ff8d9f5d3515771d3ecbbef36aa52f05317983bcca38a4f755cf1", ".github/workflows/cla-dco.yml": "5c3437cfa6ec997d97a3e9218a87114c1bb14f524e648d0df775f5bc6340430f", - ".github/workflows/license.yml": "16cc80a7ebac7a17ff76fc348bedc00df8bf7a9a563b2519160399d195927d76", - ".github/workflows/release-provenance.yml": "4a627ea963e0b7639c817439a74ed4dd1af32024709f6281bb5f22a31d38bf09", - ".github/workflows/security.yml": "941de9382d8ce617429489c89a1cb469bb937ffee6af94de130c50ded97cc93f", - ".github/workflows/supply-chain.yml": "bb9e4e00966ba230ad595af547e5bbbd692af04bb85f350081986065d8a465f4" + ".github/workflows/license.yml": "198bc671c1cecf84eb48c7c79c278b0bac59b2a7dc878a4ceaba4dc38a15ebee", + ".github/workflows/release-provenance.yml": "4716203f96efdd36ef740b428a628d5102461265e0a0fe4d3c5518a35498ff2e", + ".github/workflows/security.yml": "dc488df05a12d95414c06675855109081bb76cb409d60957c19a4cbd7b7aa513", + ".github/workflows/supply-chain.yml": "47a900113cd6d217b7d40148d3dbdd801d6495b14d678c235d634b270f3b9159" } } diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 37e4558..0499842 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Verify delivery roadmap @@ -83,7 +83,7 @@ jobs: wait "${etcd_pid}" || true trap - EXIT chmod 0600 "${snapshot}" - GOTOOLCHAIN=go1.26.9 bash .github/scripts/build-release-etcdutl.sh \ + GOTOOLCHAIN=go1.26.10 bash .github/scripts/build-release-etcdutl.sh \ "${RUNNER_TEMP}/release-etcdutl" bash .github/scripts/check-release-binaries.sh "${RUNNER_TEMP}/release-etcdutl/etcdutl" CLOUDRING_TEST_ETCD_SNAPSHOT="${snapshot}" \ @@ -99,7 +99,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - run: go test -race ./... -count=1 @@ -108,7 +108,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 container: - image: golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c + image: golang:1.26.10-bookworm@sha256:23ce71337b726608afb1bc00986e630a05034a87a87ea1fc2cd1ae5cf33387eb services: postgres: image: postgres:18.6-bookworm@sha256:1c59e2c3c818eaa0f0628f695b36e7c9e362d6b219b36a54a32df645cbd7e1af @@ -127,7 +127,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Test transactional state and public runtime against PostgreSQL @@ -150,7 +150,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - run: go vet ./... @@ -164,7 +164,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Verify generic platform manifests @@ -183,7 +183,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Test minimum supported Go @@ -198,7 +198,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Verify module graph and build @@ -211,7 +211,7 @@ jobs: go build -mod=readonly -trimpath ./... - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Reproduce, scan and execute the complete release bundle @@ -231,7 +231,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Validate every shipped connector package @@ -253,7 +253,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Check conformance for the same shipped connector packages @@ -307,7 +307,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Scan complete checkout diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml index 6e9f348..7763910 100644 --- a/.github/workflows/license.yml +++ b/.github/workflows/license.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - shell: bash diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml index bf85144..9b1e72a 100644 --- a/.github/workflows/release-provenance.yml +++ b/.github/workflows/release-provenance.yml @@ -33,7 +33,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Independently reproduce release bundle and CycloneDX SBOM @@ -95,7 +95,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 @@ -203,7 +203,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 @@ -247,7 +247,7 @@ jobs: test "$(dist/etcd-recovery-worker/etcdutl version)" = $'etcdutl version: 3.6.14\nAPI version: 3.6' tool_digest="$(sha256sum dist/etcd-recovery-worker/etcdutl | cut -d ' ' -f 1)" worker_digest="$(sha256sum dist/etcd-recovery-worker/cloudring-etcd-recovery-worker | cut -d ' ' -f 1)" - test "${tool_digest}" = '8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1' + test "${tool_digest}" = '04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf' bash .github/scripts/check-release-binaries.sh dist/etcd-recovery-worker/* jq -n -cS \ --arg source_commit "${GITHUB_SHA}" \ @@ -282,7 +282,7 @@ jobs: purl: "pkg:github/etcd-io/etcd@v3.6.14", properties: [ {name: "cloudring.upstream.source-commit", value: "fc04cf702b0a46c2fd85547a2be05705b100a496"}, - {name: "cloudring.upstream.build-compiler", value: "go1.26.9"} + {name: "cloudring.upstream.build-compiler", value: "go1.26.10"} ], hashes: [{alg: "SHA-256", content: $tool_digest}] }, @@ -483,7 +483,7 @@ jobs: (.imageSubjectDigest | test("^sha256:[0-9a-f]{64}$")) and (.workerExecutableSha256 | test("^[0-9a-f]{64}$")) and .etcdutlVersion == "3.6.14" and - .etcdutlSha256 == "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1" and + .etcdutlSha256 == "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf" and .baseImageName == "gcr.io/distroless/static-debian12:nonroot" and .baseImageDigest == "sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35" and (.containerfileSha256 | test("^[0-9a-f]{64}$")) and diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index 65e8cc3..b294e5f 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -29,7 +29,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 @@ -48,7 +48,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... @@ -62,7 +62,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - run: go run github.com/securego/gosec/v2/cmd/gosec@v2.27.1 -quiet -fmt=golint -tests -nosec-require-justification -nosec-require-rules ./... @@ -77,7 +77,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Scan current tree and pushed history diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index dee863b..15c286a 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.9 + go-version: 1.26.10 check-latest: false cache: true - name: Validate workflow syntax diff --git a/README.md b/README.md index 0cd1788..39add47 100644 --- a/README.md +++ b/README.md @@ -232,7 +232,7 @@ operations, documentation, and developer experience. ## Validate a fresh clone -Prerequisites: Git and Go 1.26.9 or a newer supported security patch. The development installer and CI use Go 1.26.9. +Prerequisites: Git and Go 1.26.10 or a newer supported security patch. The development installer and CI use Go 1.26.10. ```bash git clone https://github.com/opencloudtech/CloudRING.git diff --git a/contracts/etcd-recovery/README.md b/contracts/etcd-recovery/README.md index 8ffba70..09ff3db 100644 --- a/contracts/etcd-recovery/README.md +++ b/contracts/etcd-recovery/README.md @@ -32,9 +32,9 @@ object key/version and credentials never appear in tool arguments, environment, stdout, stderr or receipts. `etcdutl` 3.6.14 is content-pinned to -`8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1` +`04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf` before execution. This executable is rebuilt from the unchanged official source -with Go 1.26.9 and retained symbols using the [release build procedure](../../docs/releasing.md); +with Go 1.26.10 and retained symbols using the [release build procedure](../../docs/releasing.md); its source and build identity are retained as `etcdutl-source.json`. Source `hashkv` runs only against a verified disposable private copy, because upstream `hashkv` can mutate bbolt metadata. The restored diff --git a/contracts/etcd-recovery/image-identity.schema.json b/contracts/etcd-recovery/image-identity.schema.json index cf8e7d3..25c1073 100644 --- a/contracts/etcd-recovery/image-identity.schema.json +++ b/contracts/etcd-recovery/image-identity.schema.json @@ -32,7 +32,7 @@ "imageSubjectDigest": {"$ref": "#/$defs/imageDigest"}, "workerExecutableSha256": {"$ref": "#/$defs/sha"}, "etcdutlVersion": {"const": "3.6.14"}, - "etcdutlSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"}, + "etcdutlSha256": {"const": "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf"}, "baseImageName": {"const": "gcr.io/distroless/static-debian12:nonroot"}, "baseImageDigest": {"const": "sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35"}, "containerfileSha256": {"$ref": "#/$defs/sha"}, diff --git a/contracts/etcd-recovery/receipt.schema.json b/contracts/etcd-recovery/receipt.schema.json index ffced24..e9b9e91 100644 --- a/contracts/etcd-recovery/receipt.schema.json +++ b/contracts/etcd-recovery/receipt.schema.json @@ -30,7 +30,7 @@ "properties": { "name": {"const": "etcdutl"}, "version": {"const": "3.6.14"}, - "executableSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"} + "executableSha256": {"const": "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf"} } }, "sourceStatusSha256": {"$ref": "#/$defs/sha"}, diff --git a/contracts/etcd-recovery/request.schema.json b/contracts/etcd-recovery/request.schema.json index c15d1e7..bae0170 100644 --- a/contracts/etcd-recovery/request.schema.json +++ b/contracts/etcd-recovery/request.schema.json @@ -27,7 +27,7 @@ "workerExecutableSha256": {"$ref": "#/$defs/sha"}, "workerImageDigest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"}, "etcdutlVersion": {"const": "3.6.14"}, - "etcdutlSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"}, + "etcdutlSha256": {"const": "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf"}, "issuedAt": {"type": "string", "format": "date-time"}, "expiresAt": {"type": "string", "format": "date-time"}, "timeoutSeconds": {"type": "integer", "minimum": 1, "maximum": 1800} diff --git a/docs/ci-checks.md b/docs/ci-checks.md index 5aec5e5..42d7e85 100644 --- a/docs/ci-checks.md +++ b/docs/ci-checks.md @@ -102,7 +102,7 @@ the bundle checksum, and creates GitHub artifact attestations. The recovery image job independently reproduces the worker binary and two OCI image layouts, checks their Linux AMD64 subject manifest digests are identical, and requires the separately pushed registry subject to match that reviewed digest. -The official `etcdutl` 3.6.14 source is rebuilt twice with Go 1.26.9 and +The official `etcdutl` 3.6.14 source is rebuilt twice with Go 1.26.10 and independent caches. The source archive, rebuilt binary, BuildKit, Dockerfile frontend, Buildx and Syft inputs are immutable-version or content pinned. The job publishes only `sha-`, creates a real Syft image-package SBOM plus a diff --git a/docs/development-installation.md b/docs/development-installation.md index cd42182..046d221 100644 --- a/docs/development-installation.md +++ b/docs/development-installation.md @@ -57,7 +57,7 @@ substitute `latest` images or an unverified BOM. Linux users can use the verified `cloudring-linux-amd64` asset as `cloudring`. Linux and macOS users can also build the client from the clean public release -checkout with Go 1.26.9 or a newer supported security release: +checkout with Go 1.26.10 or a newer supported security release: ```sh go build -o ./cloudring ./cmd/cloudring diff --git a/docs/releasing.md b/docs/releasing.md index 32b29a5..a0ba4a2 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -23,7 +23,7 @@ the exact Go toolchain pinned in the workflow, Linux/amd64 target, GNU tar and Python 3 (standard-library UUID generation only); using a different compiler is a different build input. -The release compiler is Go 1.26.9, a supported patch release. The required +The release compiler is Go 1.26.10, a supported patch release. The required pull-request build check also reproduces the complete bundle with this exact compiler. Before artifacts are uploaded or attested, pinned `govulncheck` examines every compiled command, including the recovery worker and its upstream diff --git a/go.mod b/go.mod index 26d324f..1694a66 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/opencloudtech/CloudRING -go 1.26.9 +go 1.26.10 require ( github.com/jackc/pgx/v5 v5.11.0 diff --git a/pkg/backup/etcdrecovery/types.go b/pkg/backup/etcdrecovery/types.go index c1d01c9..f6dfbae 100644 --- a/pkg/backup/etcdrecovery/types.go +++ b/pkg/backup/etcdrecovery/types.go @@ -17,7 +17,7 @@ const ( SandboxStateSchemaVersion = "cloudring.etcd-recovery.sandbox-state/v1" ToolName = "etcdutl" ToolVersion = "3.6.14" - ToolSHA256 = "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1" + ToolSHA256 = "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf" DefaultRequestPath = "/run/cloudring/request/request.json" DefaultArchivePath = "/run/cloudring/archive/snapshot.db" diff --git a/reference/synthetic-service/Containerfile b/reference/synthetic-service/Containerfile index 34b77d1..9fbcbb1 100644 --- a/reference/synthetic-service/Containerfile +++ b/reference/synthetic-service/Containerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c AS build +FROM golang:1.26.10-bookworm@sha256:23ce71337b726608afb1bc00986e630a05034a87a87ea1fc2cd1ae5cf33387eb AS build WORKDIR /src COPY go.mod ./