From fd8767ff3079cbe544509330cb084cffe0418453 Mon Sep 17 00:00:00 2001 From: "trukhin.com" Date: Sun, 11 Oct 2026 19:56:40 +0200 Subject: [PATCH 1/2] fix(ci): move the release compiler and CI to Go 1.26.9 Go 1.26.9 (2026-10-08) fixes the standard-library advisories that turn govulncheck, the release bundle scan in go-build-module-integrity and the etcdutl gate in go-test red on every pull request. There are thirteen, in net/http, net/textproto, mime/multipart, crypto/tls, html/template and os: GO-2026-6599, 6600, 6603, 6604, 6605, 6607, 6608, 6609, 6610, 6611, 6612, 6613 and 6617. Pin go1.26.9 in go.mod, every setup-go step, the PostgreSQL test container and the synthetic reference image (golang:1.26.9-bookworm index d9c68c2c), the etcdutl build and adjudication scripts and the release component inventory. The etcdutl 3.6.14 rebuild changes with the compiler, so re-pin its digest to 8cc788cf in the worker, the three etcd-recovery schemas, the contract README and release provenance. Recompute the workflow policy digests and update the docs that name the release compiler. Signed-off-by: trukhin.com --- .github/scripts/build-release-etcdutl.sh | 2 +- .github/scripts/check-release-binaries.sh | 2 +- .github/workflow-policy.json | 10 +++---- .github/workflows/ci.yml | 26 +++++++++---------- .github/workflows/license.yml | 2 +- .github/workflows/release-provenance.yml | 12 ++++----- .github/workflows/security.yml | 8 +++--- .github/workflows/supply-chain.yml | 2 +- README.md | 2 +- contracts/etcd-recovery/README.md | 4 +-- .../etcd-recovery/image-identity.schema.json | 2 +- contracts/etcd-recovery/receipt.schema.json | 2 +- contracts/etcd-recovery/request.schema.json | 2 +- docs/ci-checks.md | 2 +- docs/development-installation.md | 2 +- docs/releasing.md | 2 +- go.mod | 2 +- pkg/backup/etcdrecovery/types.go | 2 +- reference/synthetic-service/Containerfile | 2 +- 19 files changed, 44 insertions(+), 44 deletions(-) diff --git a/.github/scripts/build-release-etcdutl.sh b/.github/scripts/build-release-etcdutl.sh index 57f0f60..694d855 100644 --- a/.github/scripts/build-release-etcdutl.sh +++ b/.github/scripts/build-release-etcdutl.sh @@ -17,7 +17,7 @@ version='3.6.14' source_commit='fc04cf702b0a46c2fd85547a2be05705b100a496' source_archive_sha256='c02ebbf6af5f9266f111009fb8d585649a9fcafe5788c200f5a28a7f00d438f0' source_url="https://codeload.github.com/etcd-io/etcd/tar.gz/${source_commit}" -go_version='go1.26.8' +go_version='go1.26.9' # Resolve an explicitly selected toolchain once, then disallow automatic # switching and caller-specific build settings in both independent builds. diff --git a/.github/scripts/check-release-binaries.sh b/.github/scripts/check-release-binaries.sh index e5e4375..325aa8f 100644 --- a/.github/scripts/check-release-binaries.sh +++ b/.github/scripts/check-release-binaries.sh @@ -48,7 +48,7 @@ EOF etcd_version='3.6.14' source_commit='fc04cf702b0a46c2fd85547a2be05705b100a496' source_archive_sha256='c02ebbf6af5f9266f111009fb8d585649a9fcafe5788c200f5a28a7f00d438f0' -go_version='go1.26.8' +go_version='go1.26.9' etcd_version_arg='' source_commit_arg='' diff --git a/.github/workflow-policy.json b/.github/workflow-policy.json index d6bf9b4..f118631 100644 --- a/.github/workflow-policy.json +++ b/.github/workflow-policy.json @@ -2,11 +2,11 @@ "schemaVersion": 1, "canonicalization": "yq-json+jq-cS", "workflows": { - ".github/workflows/ci.yml": "be63f023563fde67eef849a61cfa2f108b981a7685b6d9280bf48243b9a2526b", + ".github/workflows/ci.yml": "ff516325ce372b532df551ad62bf2a39f4154f98996cc8ed498380c36da62d0f", ".github/workflows/cla-dco.yml": "5c3437cfa6ec997d97a3e9218a87114c1bb14f524e648d0df775f5bc6340430f", - ".github/workflows/license.yml": "813e0774ad869ca4898449c0ba087b005a3187b32455d0dc2f3a62d89b4e8b81", - ".github/workflows/release-provenance.yml": "36712b212df0f999a1a699a41498030d5d634161d35de2a3ed3db80ffb7bbee9", - ".github/workflows/security.yml": "0c77bba18ea6e3d1bd1cf3447549fc0bbb4aaa3a1f94a2763dd53a3f42390e9e", - ".github/workflows/supply-chain.yml": "2d90a0d90de0f9dffa40005ae9134105ac9198bbee58416d570ed16f96e58097" + ".github/workflows/license.yml": "16cc80a7ebac7a17ff76fc348bedc00df8bf7a9a563b2519160399d195927d76", + ".github/workflows/release-provenance.yml": "4a627ea963e0b7639c817439a74ed4dd1af32024709f6281bb5f22a31d38bf09", + ".github/workflows/security.yml": "941de9382d8ce617429489c89a1cb469bb937ffee6af94de130c50ded97cc93f", + ".github/workflows/supply-chain.yml": "bb9e4e00966ba230ad595af547e5bbbd692af04bb85f350081986065d8a465f4" } } diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 93be404..37e4558 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Verify delivery roadmap @@ -83,7 +83,7 @@ jobs: wait "${etcd_pid}" || true trap - EXIT chmod 0600 "${snapshot}" - GOTOOLCHAIN=go1.26.8 bash .github/scripts/build-release-etcdutl.sh \ + GOTOOLCHAIN=go1.26.9 bash .github/scripts/build-release-etcdutl.sh \ "${RUNNER_TEMP}/release-etcdutl" bash .github/scripts/check-release-binaries.sh "${RUNNER_TEMP}/release-etcdutl/etcdutl" CLOUDRING_TEST_ETCD_SNAPSHOT="${snapshot}" \ @@ -99,7 +99,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - run: go test -race ./... -count=1 @@ -108,7 +108,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 container: - image: golang:1.26.8-bookworm@sha256:9fdc884aacc3bec89b20ffc69f4bb369c78210e3e4f600387b5128b12c199f81 + image: golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c services: postgres: image: postgres:18.6-bookworm@sha256:1c59e2c3c818eaa0f0628f695b36e7c9e362d6b219b36a54a32df645cbd7e1af @@ -127,7 +127,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Test transactional state and public runtime against PostgreSQL @@ -150,7 +150,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - run: go vet ./... @@ -164,7 +164,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Verify generic platform manifests @@ -183,7 +183,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Test minimum supported Go @@ -198,7 +198,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Verify module graph and build @@ -211,7 +211,7 @@ jobs: go build -mod=readonly -trimpath ./... - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Reproduce, scan and execute the complete release bundle @@ -231,7 +231,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Validate every shipped connector package @@ -253,7 +253,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Check conformance for the same shipped connector packages @@ -307,7 +307,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Scan complete checkout diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml index cb5f8b6..6e9f348 100644 --- a/.github/workflows/license.yml +++ b/.github/workflows/license.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - shell: bash diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml index dd105ed..bf85144 100644 --- a/.github/workflows/release-provenance.yml +++ b/.github/workflows/release-provenance.yml @@ -33,7 +33,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Independently reproduce release bundle and CycloneDX SBOM @@ -95,7 +95,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 @@ -203,7 +203,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 @@ -247,7 +247,7 @@ jobs: test "$(dist/etcd-recovery-worker/etcdutl version)" = $'etcdutl version: 3.6.14\nAPI version: 3.6' tool_digest="$(sha256sum dist/etcd-recovery-worker/etcdutl | cut -d ' ' -f 1)" worker_digest="$(sha256sum dist/etcd-recovery-worker/cloudring-etcd-recovery-worker | cut -d ' ' -f 1)" - test "${tool_digest}" = '2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d' + test "${tool_digest}" = '8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1' bash .github/scripts/check-release-binaries.sh dist/etcd-recovery-worker/* jq -n -cS \ --arg source_commit "${GITHUB_SHA}" \ @@ -282,7 +282,7 @@ jobs: purl: "pkg:github/etcd-io/etcd@v3.6.14", properties: [ {name: "cloudring.upstream.source-commit", value: "fc04cf702b0a46c2fd85547a2be05705b100a496"}, - {name: "cloudring.upstream.build-compiler", value: "go1.26.8"} + {name: "cloudring.upstream.build-compiler", value: "go1.26.9"} ], hashes: [{alg: "SHA-256", content: $tool_digest}] }, @@ -483,7 +483,7 @@ jobs: (.imageSubjectDigest | test("^sha256:[0-9a-f]{64}$")) and (.workerExecutableSha256 | test("^[0-9a-f]{64}$")) and .etcdutlVersion == "3.6.14" and - .etcdutlSha256 == "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d" and + .etcdutlSha256 == "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1" and .baseImageName == "gcr.io/distroless/static-debian12:nonroot" and .baseImageDigest == "sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35" and (.containerfileSha256 | test("^[0-9a-f]{64}$")) and diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index aedee55..65e8cc3 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -29,7 +29,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 @@ -48,7 +48,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... @@ -62,7 +62,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - run: go run github.com/securego/gosec/v2/cmd/gosec@v2.27.1 -quiet -fmt=golint -tests -nosec-require-justification -nosec-require-rules ./... @@ -77,7 +77,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Scan current tree and pushed history diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index a7a5af6..dee863b 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.8 + go-version: 1.26.9 check-latest: false cache: true - name: Validate workflow syntax diff --git a/README.md b/README.md index 84f7ade..27b3437 100644 --- a/README.md +++ b/README.md @@ -223,7 +223,7 @@ operations, documentation, and developer experience. ## Validate a fresh clone -Prerequisites: Git and Go 1.26.8 or a newer supported security patch. The development installer and CI use Go 1.26.8. +Prerequisites: Git and Go 1.26.9 or a newer supported security patch. The development installer and CI use Go 1.26.9. ```bash git clone https://github.com/opencloudtech/CloudRING.git diff --git a/contracts/etcd-recovery/README.md b/contracts/etcd-recovery/README.md index 0cc1ce9..8ffba70 100644 --- a/contracts/etcd-recovery/README.md +++ b/contracts/etcd-recovery/README.md @@ -32,9 +32,9 @@ object key/version and credentials never appear in tool arguments, environment, stdout, stderr or receipts. `etcdutl` 3.6.14 is content-pinned to -`2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d` +`8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1` before execution. This executable is rebuilt from the unchanged official source -with Go 1.26.8 and retained symbols using the [release build procedure](../../docs/releasing.md); +with Go 1.26.9 and retained symbols using the [release build procedure](../../docs/releasing.md); its source and build identity are retained as `etcdutl-source.json`. Source `hashkv` runs only against a verified disposable private copy, because upstream `hashkv` can mutate bbolt metadata. The restored diff --git a/contracts/etcd-recovery/image-identity.schema.json b/contracts/etcd-recovery/image-identity.schema.json index 96b680b..cf8e7d3 100644 --- a/contracts/etcd-recovery/image-identity.schema.json +++ b/contracts/etcd-recovery/image-identity.schema.json @@ -32,7 +32,7 @@ "imageSubjectDigest": {"$ref": "#/$defs/imageDigest"}, "workerExecutableSha256": {"$ref": "#/$defs/sha"}, "etcdutlVersion": {"const": "3.6.14"}, - "etcdutlSha256": {"const": "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d"}, + "etcdutlSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"}, "baseImageName": {"const": "gcr.io/distroless/static-debian12:nonroot"}, "baseImageDigest": {"const": "sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35"}, "containerfileSha256": {"$ref": "#/$defs/sha"}, diff --git a/contracts/etcd-recovery/receipt.schema.json b/contracts/etcd-recovery/receipt.schema.json index 86c4bde..ffced24 100644 --- a/contracts/etcd-recovery/receipt.schema.json +++ b/contracts/etcd-recovery/receipt.schema.json @@ -30,7 +30,7 @@ "properties": { "name": {"const": "etcdutl"}, "version": {"const": "3.6.14"}, - "executableSha256": {"const": "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d"} + "executableSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"} } }, "sourceStatusSha256": {"$ref": "#/$defs/sha"}, diff --git a/contracts/etcd-recovery/request.schema.json b/contracts/etcd-recovery/request.schema.json index 85beed6..c15d1e7 100644 --- a/contracts/etcd-recovery/request.schema.json +++ b/contracts/etcd-recovery/request.schema.json @@ -27,7 +27,7 @@ "workerExecutableSha256": {"$ref": "#/$defs/sha"}, "workerImageDigest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"}, "etcdutlVersion": {"const": "3.6.14"}, - "etcdutlSha256": {"const": "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d"}, + "etcdutlSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"}, "issuedAt": {"type": "string", "format": "date-time"}, "expiresAt": {"type": "string", "format": "date-time"}, "timeoutSeconds": {"type": "integer", "minimum": 1, "maximum": 1800} diff --git a/docs/ci-checks.md b/docs/ci-checks.md index f804f0c..5aec5e5 100644 --- a/docs/ci-checks.md +++ b/docs/ci-checks.md @@ -102,7 +102,7 @@ the bundle checksum, and creates GitHub artifact attestations. The recovery image job independently reproduces the worker binary and two OCI image layouts, checks their Linux AMD64 subject manifest digests are identical, and requires the separately pushed registry subject to match that reviewed digest. -The official `etcdutl` 3.6.14 source is rebuilt twice with Go 1.26.8 and +The official `etcdutl` 3.6.14 source is rebuilt twice with Go 1.26.9 and independent caches. The source archive, rebuilt binary, BuildKit, Dockerfile frontend, Buildx and Syft inputs are immutable-version or content pinned. The job publishes only `sha-`, creates a real Syft image-package SBOM plus a diff --git a/docs/development-installation.md b/docs/development-installation.md index da46735..cd42182 100644 --- a/docs/development-installation.md +++ b/docs/development-installation.md @@ -57,7 +57,7 @@ substitute `latest` images or an unverified BOM. Linux users can use the verified `cloudring-linux-amd64` asset as `cloudring`. Linux and macOS users can also build the client from the clean public release -checkout with Go 1.26.8 or a newer supported security release: +checkout with Go 1.26.9 or a newer supported security release: ```sh go build -o ./cloudring ./cmd/cloudring diff --git a/docs/releasing.md b/docs/releasing.md index cfeec27..32b29a5 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -23,7 +23,7 @@ the exact Go toolchain pinned in the workflow, Linux/amd64 target, GNU tar and Python 3 (standard-library UUID generation only); using a different compiler is a different build input. -The release compiler is Go 1.26.8, a supported patch release. The required +The release compiler is Go 1.26.9, a supported patch release. The required pull-request build check also reproduces the complete bundle with this exact compiler. Before artifacts are uploaded or attested, pinned `govulncheck` examines every compiled command, including the recovery worker and its upstream diff --git a/go.mod b/go.mod index af43caa..26d324f 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/opencloudtech/CloudRING -go 1.26.8 +go 1.26.9 require ( github.com/jackc/pgx/v5 v5.11.0 diff --git a/pkg/backup/etcdrecovery/types.go b/pkg/backup/etcdrecovery/types.go index 4eb2c88..c1d01c9 100644 --- a/pkg/backup/etcdrecovery/types.go +++ b/pkg/backup/etcdrecovery/types.go @@ -17,7 +17,7 @@ const ( SandboxStateSchemaVersion = "cloudring.etcd-recovery.sandbox-state/v1" ToolName = "etcdutl" ToolVersion = "3.6.14" - ToolSHA256 = "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d" + ToolSHA256 = "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1" DefaultRequestPath = "/run/cloudring/request/request.json" DefaultArchivePath = "/run/cloudring/archive/snapshot.db" diff --git a/reference/synthetic-service/Containerfile b/reference/synthetic-service/Containerfile index 0cbdf63..34b77d1 100644 --- a/reference/synthetic-service/Containerfile +++ b/reference/synthetic-service/Containerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.8-bookworm@sha256:9fdc884aacc3bec89b20ffc69f4bb369c78210e3e4f600387b5128b12c199f81 AS build +FROM golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c AS build WORKDIR /src COPY go.mod ./ From a430741407b47fa3bd2f907671ce5bdbf4d289a2 Mon Sep 17 00:00:00 2001 From: "trukhin.com" Date: Sun, 11 Oct 2026 20:18:04 +0200 Subject: [PATCH 2/2] fix(ci): reviewed bounded override for etcdutl x/net HTTP/2 advisories After the compiler update the etcdutl gate still fails on GO-2026-6603, GO-2026-6611, GO-2026-6612 and GO-2026-6617. Their remaining part is golang.org/x/net v0.55.0 from the unchanged etcd 3.6.14 module graph, fixed in x/net v0.60.0 (2026-10-08). No etcd release ships it yet: 3.6.15, 3.7.2 and both release branches carry v0.58.0, main v0.59.0. Of the 27 example traces source mode reports per advisory, 12 enter through the init-time closure dispatch already adjudicated for GO-2026-6348 (crc32 table init -> sync.OnceFunc -> grpc client transport) and 15 through error, fmt.Stringer and io.Writer interface dispatch from cobra, cobrautl and pflag. Each advisory needs an HTTP/2 peer; no etcdutl subcommand opens a listener or dials, and the recovery worker runs only version, snapshot status, hashkv and snapshot restore on local files. Add the four IDs to the reviewed overrides; they must be removed when the pinned etcd release ships x/net >= v0.60.0. The IDs also cover net/http, so the comment records that every scanned binary must be built with the fixed compiler. GO-2026-6443 stays informational as unreachable, GO-2026-6610 is not a binary-mode finding, and the gate still prints the full binary and source reports. Signed-off-by: trukhin.com --- .github/scripts/check-release-binaries.sh | 22 +++++++++++++++++++++- 1 file changed, 21 insertions(+), 1 deletion(-) diff --git a/.github/scripts/check-release-binaries.sh b/.github/scripts/check-release-binaries.sh index 325aa8f..bd78532 100644 --- a/.github/scripts/check-release-binaries.sh +++ b/.github/scripts/check-release-binaries.sh @@ -269,7 +269,27 @@ fi # conservatism produces this trace. REMOVE THIS ENTRY when the pinned etcd # release ships grpc >= 1.83.1 (see ANCHOR(etcd-pin)); do not extend this # list without a recorded adjudication in the PR that adds it. -advisory_overrides="GO-2026-6348" +# +# GO-2026-6603, GO-2026-6611, GO-2026-6612, GO-2026-6617 (HTTP/2 Trailer +# memory exhaustion, initial-window CPU, flow-control refund, HPACK encoder +# race): the go1.26.9 release compiler fixes their standard-library part; +# golang.org/x/net v0.55.0 from the pinned etcd module graph remains. Of the +# 27 example traces source mode reports per advisory, 12 enter through the +# init-time closure dispatch of GO-2026-6348 (crc32 table init -> +# sync.OnceFunc -> grpc client transport) and 15 through error, fmt.Stringer +# and io.Writer interface dispatch from cobra, cobrautl and pflag. Each +# advisory needs an HTTP/2 peer; no etcdutl subcommand opens a listener or +# dials, and the recovery worker runs only version, snapshot status, hashkv +# and snapshot restore on local files. These IDs also cover net/http and +# overrides match every binary in one run, so each scanned binary must be +# built with go1.26.9 or go1.27.2 and later. REMOVE THESE ENTRIES when the +# pinned etcd release ships golang.org/x/net >= v0.60.0 (see +# ANCHOR(etcd-pin)). +advisory_overrides="GO-2026-6348 +GO-2026-6603 +GO-2026-6611 +GO-2026-6612 +GO-2026-6617" gate_failed=0 for id in ${binary_ids}; do