Repository navigation
Update Go and x/net security patches - #15
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Outcome: Remove known Go and x/net vulnerabilities from the relay image.
Change: Build with Go 1.27.2 from a pinned official builder digest, use x/net v0.60.0, and update the documented binary verification command. Preserve the Go 1.26.2 language minimum.
Proof: Exact head 7c1cbb4e, base d2ebf4cc, stable Myers patch 666ea7b450eabc0675c0d674dcb9deaf101bd9a7. CI tests and lint, PR image build, and CodeQL pass on this head. Source review and local formatting,
go test -race -count=1 ./...,go vet ./..., binary build, and golangci-lint v2.14.0 pass. The unsigned local Docker/Syft image SBOM records stdlib go1.27.2 and x/net v0.60.0; Grype v0.112.0 with a frozen database returns exit 0, with no matched or ignored High/Critical findings. The documented rebuild produces the same binary bytes as the local image.Risk: Compiler and dependency update only. The runtime base, relay source, configuration, and normal image publication/signing workflow are unchanged. The published digest must be verified and scanned after the main-branch image workflow completes.
Owner: Tomás Senart.