From 350fa0454d8bb3487d98f049c81728f32eb1089c Mon Sep 17 00:00:00 2001 From: Iurii Trukhin Date: Fri, 6 Nov 2026 01:01:35 +0100 Subject: [PATCH 1/3] fix(ci): update CodeQL actions to v4.39.1 consistently Pin init, autobuild and analyze to the v4.39.1 release commit, update the supply-chain allowlist and the reviewed workflow digests, and group github/codeql-action updates in Dependabot so the three pins move in one pull request. Signed-off-by: Iurii Trukhin --- .github/dependabot.yml | 4 ++++ .github/workflow-policy.json | 4 ++-- .github/workflows/security.yml | 6 +++--- .github/workflows/supply-chain.yml | 2 +- 4 files changed, 10 insertions(+), 6 deletions(-) diff --git a/.github/dependabot.yml b/.github/dependabot.yml index 632e8eb..495d796 100644 --- a/.github/dependabot.yml +++ b/.github/dependabot.yml @@ -4,6 +4,10 @@ updates: directory: / schedule: interval: weekly + groups: + codeql-action: + patterns: + - "github/codeql-action*" - package-ecosystem: gomod directory: / schedule: diff --git a/.github/workflow-policy.json b/.github/workflow-policy.json index 7f03ab0..5798382 100644 --- a/.github/workflow-policy.json +++ b/.github/workflow-policy.json @@ -6,7 +6,7 @@ ".github/workflows/cla-dco.yml": "5c3437cfa6ec997d97a3e9218a87114c1bb14f524e648d0df775f5bc6340430f", ".github/workflows/license.yml": "198bc671c1cecf84eb48c7c79c278b0bac59b2a7dc878a4ceaba4dc38a15ebee", ".github/workflows/release-provenance.yml": "4716203f96efdd36ef740b428a628d5102461265e0a0fe4d3c5518a35498ff2e", - ".github/workflows/security.yml": "dc488df05a12d95414c06675855109081bb76cb409d60957c19a4cbd7b7aa513", - ".github/workflows/supply-chain.yml": "47a900113cd6d217b7d40148d3dbdd801d6495b14d678c235d634b270f3b9159" + ".github/workflows/security.yml": "85950b712f295f33d7a25c9cd029132c59ba0b5d169c2d52d7d1ebd08e30609d", + ".github/workflows/supply-chain.yml": "f52f7eb34b2af530bef1f3fad9041f04de8333d282136750644134be82dba766" } } diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index b294e5f..a03e81d 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -32,12 +32,12 @@ jobs: go-version: 1.26.10 check-latest: false cache: true - - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 with: languages: go config-file: ./.github/codeql/codeql-config.yml - - uses: github/codeql-action/autobuild@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 - - uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1 + - uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 govulncheck: runs-on: ubuntu-latest diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 15c286a..18456d2 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -155,7 +155,7 @@ jobs: . == "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" or . == "actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6" or . == "docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f" or - test("^github/codeql-action/(init|autobuild|analyze)@7188fc363630916deb702c7fdcf4e481b751f97a$") or + test("^github/codeql-action/(init|autobuild|analyze)@9b3254085494b55a0f7c4c2b3d2d52cc712ce370$") or test("^docker://[^@[:space:]]+@sha256:[0-9a-f]{64}$")); def safe_image: type == "string" and From c9c01954319b3fbe42ee3bf1282118458c4478b8 Mon Sep 17 00:00:00 2001 From: Iurii Trukhin Date: Tue, 10 Nov 2026 11:13:47 +0100 Subject: [PATCH 2/3] fix(ci): move CodeQL actions to v4.39.3 Pin init, autobuild and analyze to the v4.39.3 release commit 33d7b85da1a04171e211befe2c739303b9a4c066, update the supply-chain allowlist to the same commit and refresh the reviewed workflow digests for security.yml and supply-chain.yml. Signed-off-by: Iurii Trukhin --- .github/workflow-policy.json | 4 ++-- .github/workflows/security.yml | 6 +++--- .github/workflows/supply-chain.yml | 2 +- 3 files changed, 6 insertions(+), 6 deletions(-) diff --git a/.github/workflow-policy.json b/.github/workflow-policy.json index 5798382..3f8fd11 100644 --- a/.github/workflow-policy.json +++ b/.github/workflow-policy.json @@ -6,7 +6,7 @@ ".github/workflows/cla-dco.yml": "5c3437cfa6ec997d97a3e9218a87114c1bb14f524e648d0df775f5bc6340430f", ".github/workflows/license.yml": "198bc671c1cecf84eb48c7c79c278b0bac59b2a7dc878a4ceaba4dc38a15ebee", ".github/workflows/release-provenance.yml": "4716203f96efdd36ef740b428a628d5102461265e0a0fe4d3c5518a35498ff2e", - ".github/workflows/security.yml": "85950b712f295f33d7a25c9cd029132c59ba0b5d169c2d52d7d1ebd08e30609d", - ".github/workflows/supply-chain.yml": "f52f7eb34b2af530bef1f3fad9041f04de8333d282136750644134be82dba766" + ".github/workflows/security.yml": "bd6c50f18c7f2a6c032d7cba0ec067368dafb45dc6b1c1bbfbb93c92b078aee2", + ".github/workflows/supply-chain.yml": "076b840506af74d6dd823c784367704a275b38560b8e7e361c69f550ec027a49" } } diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index a03e81d..eab541c 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -32,12 +32,12 @@ jobs: go-version: 1.26.10 check-latest: false cache: true - - uses: github/codeql-action/init@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 with: languages: go config-file: ./.github/codeql/codeql-config.yml - - uses: github/codeql-action/autobuild@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 - - uses: github/codeql-action/analyze@9b3254085494b55a0f7c4c2b3d2d52cc712ce370 # v4.39.1 + - uses: github/codeql-action/autobuild@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 + - uses: github/codeql-action/analyze@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 govulncheck: runs-on: ubuntu-latest diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 18456d2..3e0a0d2 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -155,7 +155,7 @@ jobs: . == "actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c" or . == "actions/attest@f7c74d28b9d84cb8768d0b8ca14a4bac6ef463e6" or . == "docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f" or - test("^github/codeql-action/(init|autobuild|analyze)@9b3254085494b55a0f7c4c2b3d2d52cc712ce370$") or + test("^github/codeql-action/(init|autobuild|analyze)@33d7b85da1a04171e211befe2c739303b9a4c066$") or test("^docker://[^@[:space:]]+@sha256:[0-9a-f]{64}$")); def safe_image: type == "string" and From 2d72515fa5cbade62404e5ea547d06436492c2b5 Mon Sep 17 00:00:00 2001 From: Iurii Trukhin Date: Wed, 11 Nov 2026 13:04:58 +0100 Subject: [PATCH 3/3] fix(ci): build with Go 1.26.11 for GO-2026-6859 Go 1.26.11 fixes GO-2026-6859 in net/http, which fails govulncheck and release binary adjudication on go1.26.10. Pin Go 1.26.11 across go.mod, workflow setup-go steps, container build images, etcdutl 3.6.14 release build scripts and schemas, and refresh canonical workflow policy digests. Signed-off-by: Iurii Trukhin --- .github/scripts/build-release-etcdutl.sh | 2 +- .github/scripts/check-release-binaries.sh | 2 +- .github/workflow-policy.json | 10 +++---- .github/workflows/ci.yml | 26 +++++++++---------- .github/workflows/license.yml | 2 +- .github/workflows/release-provenance.yml | 12 ++++----- .github/workflows/security.yml | 8 +++--- .github/workflows/supply-chain.yml | 2 +- README.md | 2 +- contracts/etcd-recovery/README.md | 4 +-- .../etcd-recovery/image-identity.schema.json | 2 +- contracts/etcd-recovery/receipt.schema.json | 2 +- contracts/etcd-recovery/request.schema.json | 2 +- docs/ci-checks.md | 2 +- docs/development-installation.md | 2 +- docs/releasing.md | 2 +- go.mod | 2 +- pkg/backup/etcdrecovery/types.go | 2 +- reference/synthetic-service/Containerfile | 2 +- 19 files changed, 44 insertions(+), 44 deletions(-) diff --git a/.github/scripts/build-release-etcdutl.sh b/.github/scripts/build-release-etcdutl.sh index ec3e7cd..26559d8 100644 --- a/.github/scripts/build-release-etcdutl.sh +++ b/.github/scripts/build-release-etcdutl.sh @@ -17,7 +17,7 @@ version='3.6.14' source_commit='fc04cf702b0a46c2fd85547a2be05705b100a496' source_archive_sha256='c02ebbf6af5f9266f111009fb8d585649a9fcafe5788c200f5a28a7f00d438f0' source_url="https://codeload.github.com/etcd-io/etcd/tar.gz/${source_commit}" -go_version='go1.26.10' +go_version='go1.26.11' # Resolve an explicitly selected toolchain once, then disallow automatic # switching and caller-specific build settings in both independent builds. diff --git a/.github/scripts/check-release-binaries.sh b/.github/scripts/check-release-binaries.sh index 6a865ba..9a8241a 100644 --- a/.github/scripts/check-release-binaries.sh +++ b/.github/scripts/check-release-binaries.sh @@ -48,7 +48,7 @@ EOF etcd_version='3.6.14' source_commit='fc04cf702b0a46c2fd85547a2be05705b100a496' source_archive_sha256='c02ebbf6af5f9266f111009fb8d585649a9fcafe5788c200f5a28a7f00d438f0' -go_version='go1.26.10' +go_version='go1.26.11' etcd_version_arg='' source_commit_arg='' diff --git a/.github/workflow-policy.json b/.github/workflow-policy.json index 3f8fd11..7722703 100644 --- a/.github/workflow-policy.json +++ b/.github/workflow-policy.json @@ -2,11 +2,11 @@ "schemaVersion": 1, "canonicalization": "yq-json+jq-cS", "workflows": { - ".github/workflows/ci.yml": "68f3bebb4a4ff8d9f5d3515771d3ecbbef36aa52f05317983bcca38a4f755cf1", + ".github/workflows/ci.yml": "189aa44926c9e674c51b123af2261478b054ea02f664ae01bab56dd92229a872", ".github/workflows/cla-dco.yml": "5c3437cfa6ec997d97a3e9218a87114c1bb14f524e648d0df775f5bc6340430f", - ".github/workflows/license.yml": "198bc671c1cecf84eb48c7c79c278b0bac59b2a7dc878a4ceaba4dc38a15ebee", - ".github/workflows/release-provenance.yml": "4716203f96efdd36ef740b428a628d5102461265e0a0fe4d3c5518a35498ff2e", - ".github/workflows/security.yml": "bd6c50f18c7f2a6c032d7cba0ec067368dafb45dc6b1c1bbfbb93c92b078aee2", - ".github/workflows/supply-chain.yml": "076b840506af74d6dd823c784367704a275b38560b8e7e361c69f550ec027a49" + ".github/workflows/license.yml": "1f0fab8ad59a7054bfa0e2a976b032d7bc99e8322520e25e69b5f722731972e1", + ".github/workflows/release-provenance.yml": "b9ec9e0ead013094a3ea8b3e5f1d9bc5d64342a59ac84c5b547b7342d677847c", + ".github/workflows/security.yml": "fcb9611a4524fe169ab3d96d99634a3c5325f9a0f437bf1f3887cf674749b926", + ".github/workflows/supply-chain.yml": "e2aba9d701c975820bcff117210c931470a5a8fc5519e7fc107c4a9b05728ed3" } } diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 0499842..0c3e20f 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -32,7 +32,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Verify delivery roadmap @@ -83,7 +83,7 @@ jobs: wait "${etcd_pid}" || true trap - EXIT chmod 0600 "${snapshot}" - GOTOOLCHAIN=go1.26.10 bash .github/scripts/build-release-etcdutl.sh \ + GOTOOLCHAIN=go1.26.11 bash .github/scripts/build-release-etcdutl.sh \ "${RUNNER_TEMP}/release-etcdutl" bash .github/scripts/check-release-binaries.sh "${RUNNER_TEMP}/release-etcdutl/etcdutl" CLOUDRING_TEST_ETCD_SNAPSHOT="${snapshot}" \ @@ -99,7 +99,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - run: go test -race ./... -count=1 @@ -108,7 +108,7 @@ jobs: runs-on: ubuntu-latest timeout-minutes: 15 container: - image: golang:1.26.10-bookworm@sha256:23ce71337b726608afb1bc00986e630a05034a87a87ea1fc2cd1ae5cf33387eb + image: golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 services: postgres: image: postgres:18.6-bookworm@sha256:1c59e2c3c818eaa0f0628f695b36e7c9e362d6b219b36a54a32df645cbd7e1af @@ -127,7 +127,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Test transactional state and public runtime against PostgreSQL @@ -150,7 +150,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - run: go vet ./... @@ -164,7 +164,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Verify generic platform manifests @@ -183,7 +183,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Test minimum supported Go @@ -198,7 +198,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Verify module graph and build @@ -211,7 +211,7 @@ jobs: go build -mod=readonly -trimpath ./... - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Reproduce, scan and execute the complete release bundle @@ -231,7 +231,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Validate every shipped connector package @@ -253,7 +253,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Check conformance for the same shipped connector packages @@ -307,7 +307,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Scan complete checkout diff --git a/.github/workflows/license.yml b/.github/workflows/license.yml index 7763910..fbbdfb1 100644 --- a/.github/workflows/license.yml +++ b/.github/workflows/license.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - shell: bash diff --git a/.github/workflows/release-provenance.yml b/.github/workflows/release-provenance.yml index 9b1e72a..05d2cca 100644 --- a/.github/workflows/release-provenance.yml +++ b/.github/workflows/release-provenance.yml @@ -33,7 +33,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Independently reproduce release bundle and CycloneDX SBOM @@ -95,7 +95,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 @@ -203,7 +203,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0 @@ -247,7 +247,7 @@ jobs: test "$(dist/etcd-recovery-worker/etcdutl version)" = $'etcdutl version: 3.6.14\nAPI version: 3.6' tool_digest="$(sha256sum dist/etcd-recovery-worker/etcdutl | cut -d ' ' -f 1)" worker_digest="$(sha256sum dist/etcd-recovery-worker/cloudring-etcd-recovery-worker | cut -d ' ' -f 1)" - test "${tool_digest}" = '04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf' + test "${tool_digest}" = '9ada77511dce9263c24c8a0c116318d5384b1e348ace152da76aa65b62d17784' bash .github/scripts/check-release-binaries.sh dist/etcd-recovery-worker/* jq -n -cS \ --arg source_commit "${GITHUB_SHA}" \ @@ -282,7 +282,7 @@ jobs: purl: "pkg:github/etcd-io/etcd@v3.6.14", properties: [ {name: "cloudring.upstream.source-commit", value: "fc04cf702b0a46c2fd85547a2be05705b100a496"}, - {name: "cloudring.upstream.build-compiler", value: "go1.26.10"} + {name: "cloudring.upstream.build-compiler", value: "go1.26.11"} ], hashes: [{alg: "SHA-256", content: $tool_digest}] }, @@ -483,7 +483,7 @@ jobs: (.imageSubjectDigest | test("^sha256:[0-9a-f]{64}$")) and (.workerExecutableSha256 | test("^[0-9a-f]{64}$")) and .etcdutlVersion == "3.6.14" and - .etcdutlSha256 == "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf" and + .etcdutlSha256 == "9ada77511dce9263c24c8a0c116318d5384b1e348ace152da76aa65b62d17784" and .baseImageName == "gcr.io/distroless/static-debian12:nonroot" and .baseImageDigest == "sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35" and (.containerfileSha256 | test("^[0-9a-f]{64}$")) and diff --git a/.github/workflows/security.yml b/.github/workflows/security.yml index eab541c..d2de7b5 100644 --- a/.github/workflows/security.yml +++ b/.github/workflows/security.yml @@ -29,7 +29,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - uses: github/codeql-action/init@33d7b85da1a04171e211befe2c739303b9a4c066 # v4.39.3 @@ -48,7 +48,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./... @@ -62,7 +62,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - run: go run github.com/securego/gosec/v2/cmd/gosec@v2.27.1 -quiet -fmt=golint -tests -nosec-require-justification -nosec-require-rules ./... @@ -77,7 +77,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Scan current tree and pushed history diff --git a/.github/workflows/supply-chain.yml b/.github/workflows/supply-chain.yml index 3e0a0d2..a9961fb 100644 --- a/.github/workflows/supply-chain.yml +++ b/.github/workflows/supply-chain.yml @@ -26,7 +26,7 @@ jobs: persist-credentials: false - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.26.10 + go-version: 1.26.11 check-latest: false cache: true - name: Validate workflow syntax diff --git a/README.md b/README.md index 39add47..7772204 100644 --- a/README.md +++ b/README.md @@ -232,7 +232,7 @@ operations, documentation, and developer experience. ## Validate a fresh clone -Prerequisites: Git and Go 1.26.10 or a newer supported security patch. The development installer and CI use Go 1.26.10. +Prerequisites: Git and Go 1.26.11 or a newer supported security patch. The development installer and CI use Go 1.26.11. ```bash git clone https://github.com/opencloudtech/CloudRING.git diff --git a/contracts/etcd-recovery/README.md b/contracts/etcd-recovery/README.md index 09ff3db..c5d7790 100644 --- a/contracts/etcd-recovery/README.md +++ b/contracts/etcd-recovery/README.md @@ -32,9 +32,9 @@ object key/version and credentials never appear in tool arguments, environment, stdout, stderr or receipts. `etcdutl` 3.6.14 is content-pinned to -`04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf` +`9ada77511dce9263c24c8a0c116318d5384b1e348ace152da76aa65b62d17784` before execution. This executable is rebuilt from the unchanged official source -with Go 1.26.10 and retained symbols using the [release build procedure](../../docs/releasing.md); +with Go 1.26.11 and retained symbols using the [release build procedure](../../docs/releasing.md); its source and build identity are retained as `etcdutl-source.json`. Source `hashkv` runs only against a verified disposable private copy, because upstream `hashkv` can mutate bbolt metadata. The restored diff --git a/contracts/etcd-recovery/image-identity.schema.json b/contracts/etcd-recovery/image-identity.schema.json index 25c1073..c311814 100644 --- a/contracts/etcd-recovery/image-identity.schema.json +++ b/contracts/etcd-recovery/image-identity.schema.json @@ -32,7 +32,7 @@ "imageSubjectDigest": {"$ref": "#/$defs/imageDigest"}, "workerExecutableSha256": {"$ref": "#/$defs/sha"}, "etcdutlVersion": {"const": "3.6.14"}, - "etcdutlSha256": {"const": "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf"}, + "etcdutlSha256": {"const": "9ada77511dce9263c24c8a0c116318d5384b1e348ace152da76aa65b62d17784"}, "baseImageName": {"const": "gcr.io/distroless/static-debian12:nonroot"}, "baseImageDigest": {"const": "sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35"}, "containerfileSha256": {"$ref": "#/$defs/sha"}, diff --git a/contracts/etcd-recovery/receipt.schema.json b/contracts/etcd-recovery/receipt.schema.json index e9b9e91..3599d3e 100644 --- a/contracts/etcd-recovery/receipt.schema.json +++ b/contracts/etcd-recovery/receipt.schema.json @@ -30,7 +30,7 @@ "properties": { "name": {"const": "etcdutl"}, "version": {"const": "3.6.14"}, - "executableSha256": {"const": "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf"} + "executableSha256": {"const": "9ada77511dce9263c24c8a0c116318d5384b1e348ace152da76aa65b62d17784"} } }, "sourceStatusSha256": {"$ref": "#/$defs/sha"}, diff --git a/contracts/etcd-recovery/request.schema.json b/contracts/etcd-recovery/request.schema.json index bae0170..8a0c1d1 100644 --- a/contracts/etcd-recovery/request.schema.json +++ b/contracts/etcd-recovery/request.schema.json @@ -27,7 +27,7 @@ "workerExecutableSha256": {"$ref": "#/$defs/sha"}, "workerImageDigest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"}, "etcdutlVersion": {"const": "3.6.14"}, - "etcdutlSha256": {"const": "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf"}, + "etcdutlSha256": {"const": "9ada77511dce9263c24c8a0c116318d5384b1e348ace152da76aa65b62d17784"}, "issuedAt": {"type": "string", "format": "date-time"}, "expiresAt": {"type": "string", "format": "date-time"}, "timeoutSeconds": {"type": "integer", "minimum": 1, "maximum": 1800} diff --git a/docs/ci-checks.md b/docs/ci-checks.md index 42d7e85..7b8735d 100644 --- a/docs/ci-checks.md +++ b/docs/ci-checks.md @@ -102,7 +102,7 @@ the bundle checksum, and creates GitHub artifact attestations. The recovery image job independently reproduces the worker binary and two OCI image layouts, checks their Linux AMD64 subject manifest digests are identical, and requires the separately pushed registry subject to match that reviewed digest. -The official `etcdutl` 3.6.14 source is rebuilt twice with Go 1.26.10 and +The official `etcdutl` 3.6.14 source is rebuilt twice with Go 1.26.11 and independent caches. The source archive, rebuilt binary, BuildKit, Dockerfile frontend, Buildx and Syft inputs are immutable-version or content pinned. The job publishes only `sha-`, creates a real Syft image-package SBOM plus a diff --git a/docs/development-installation.md b/docs/development-installation.md index 046d221..c697458 100644 --- a/docs/development-installation.md +++ b/docs/development-installation.md @@ -57,7 +57,7 @@ substitute `latest` images or an unverified BOM. Linux users can use the verified `cloudring-linux-amd64` asset as `cloudring`. Linux and macOS users can also build the client from the clean public release -checkout with Go 1.26.10 or a newer supported security release: +checkout with Go 1.26.11 or a newer supported security release: ```sh go build -o ./cloudring ./cmd/cloudring diff --git a/docs/releasing.md b/docs/releasing.md index a0ba4a2..d58ba59 100644 --- a/docs/releasing.md +++ b/docs/releasing.md @@ -23,7 +23,7 @@ the exact Go toolchain pinned in the workflow, Linux/amd64 target, GNU tar and Python 3 (standard-library UUID generation only); using a different compiler is a different build input. -The release compiler is Go 1.26.10, a supported patch release. The required +The release compiler is Go 1.26.11, a supported patch release. The required pull-request build check also reproduces the complete bundle with this exact compiler. Before artifacts are uploaded or attested, pinned `govulncheck` examines every compiled command, including the recovery worker and its upstream diff --git a/go.mod b/go.mod index 1694a66..c01b7e6 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/opencloudtech/CloudRING -go 1.26.10 +go 1.26.11 require ( github.com/jackc/pgx/v5 v5.11.0 diff --git a/pkg/backup/etcdrecovery/types.go b/pkg/backup/etcdrecovery/types.go index f6dfbae..2715926 100644 --- a/pkg/backup/etcdrecovery/types.go +++ b/pkg/backup/etcdrecovery/types.go @@ -17,7 +17,7 @@ const ( SandboxStateSchemaVersion = "cloudring.etcd-recovery.sandbox-state/v1" ToolName = "etcdutl" ToolVersion = "3.6.14" - ToolSHA256 = "04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf" + ToolSHA256 = "9ada77511dce9263c24c8a0c116318d5384b1e348ace152da76aa65b62d17784" DefaultRequestPath = "/run/cloudring/request/request.json" DefaultArchivePath = "/run/cloudring/archive/snapshot.db" diff --git a/reference/synthetic-service/Containerfile b/reference/synthetic-service/Containerfile index 9fbcbb1..e566fa0 100644 --- a/reference/synthetic-service/Containerfile +++ b/reference/synthetic-service/Containerfile @@ -1,4 +1,4 @@ -FROM golang:1.26.10-bookworm@sha256:23ce71337b726608afb1bc00986e630a05034a87a87ea1fc2cd1ae5cf33387eb AS build +FROM golang:1.26.11-bookworm@sha256:dc40a13b61304647ed7e5d581d246b86413dfc29d63c6d018310feb93cd98fc0 AS build WORKDIR /src COPY go.mod ./