gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-09-09 18:15:50 +00:00
Code Issues Packages Projects Releases Wiki Activity

Advance release builds to Go 1.26.8

Browse Source 
Go 1.26.8 supersedes the prior patch release, so every release builder and local toolchain guard must move together to prevent candidate artifacts from retaining an older compiler and runtime.

Contract-Neutral: toolchain-only patch update; no product or runtime contract changed
Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot]
2026-09-04 07:18:46 +01:00
parent f891c49bc0
commit 35d4cb0e97
16 changed files with 34 additions and 31 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.devcontainer/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM golang:1.26.7@sha256:dc2521c2a906db43073b8b4d99f491b6341cf15610b6ebbab187c45153f9959e
FROM golang:1.26.8@sha256:9d2f36f06329b2a141b9db99ffa32765cf695ee57b813ca29e245e8670bcbfff
# Set bash as default shell for features
SHELL ["/bin/bash", "-c"]
.devcontainer/README.md
+3 -3
View File
@@ -5,7 +5,7 @@ This dev container provides a complete, reproducible development environment for
## What's Included
### Development Tools
- **Go 1.26.7** - Backend development
- **Go 1.26.8** - Backend development
- **Node.js 24** - Frontend development
- **gopls v0.17.0** - Go language server
- **Delve** - Go debugger
@@ -225,7 +225,7 @@ Custom overrides: Create `.env.devcontainer` (gitignored)
## Resources
- **VM Specs**: 8GB RAM, 30GB disk, 2 CPU cores
- **Base Image**: `golang:1.26.7` (Ubuntu-based)
- **Base Image**: `golang:1.26.8` (Debian-based)
- **Caches**: ~2-3GB for Go modules and build artifacts
## Tips & Tricks
@@ -247,7 +247,7 @@ MacBook (VS Code)
dev-containers VM (Proxmox)
↓ Docker
Dev Container
├── Go 1.26.7 + tools
├── Go 1.26.8 + tools
├── Node 24 + npm
├── Your code (/workspaces/pulse)
├── Hot reload watchers
Dockerfile
+1 -1
View File
@@ -26,7 +26,7 @@ RUN --mount=type=cache,id=pulse-npm-cache,target=/root/.npm \
# Build stage for Go backend
# Force amd64 platform - Go cross-compiles for all targets anyway,
# and this avoids slow QEMU emulation during multi-arch builds
FROM --platform=linux/amd64 golang:1.26.7-alpine@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS backend-builder
FROM --platform=linux/amd64 golang:1.26.8-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS backend-builder
ARG BUILD_AGENT
ARG VERSION
deploy/provider-msp/Dockerfile.control-plane
+1 -1
View File
@@ -12,7 +12,7 @@ COPY SECURITY.md TERMS.md /app/
RUN --mount=type=cache,id=pulse-control-plane-npm-cache,target=/root/.npm \
npm run build
FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS builder
FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS builder
ARG VERSION=dev
ARG BUILD_TIME=unknown
ARG GIT_COMMIT=unknown
docs/release-control/v6/internal/subsystems/deployment-installability.md
+7 -7
View File
@@ -3204,15 +3204,15 @@ vulnerabilities in the current patch level, the canonical fix is to advance the
governed release toolchain and immutable Go builder digest together, not to
suppress the scanner or produce release artifacts with an older patched-over
runtime.
As of 2026-08-27, the governed release floor is Go `1.26.7`. It supersedes
`1.26.5`, whose standard library is reachable through seven vulnerable Pulse
call paths reported by `govulncheck`, including HTTP/TLS, URL parsing, SAML XML
decoding, HTML templating, and public-key parsing. Both source-built container
stages pin the Docker Official Images Linux amd64 manifest
`sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468`;
As of 2026-09-04, the governed release floor is Go `1.26.8`, the current
supported `1.26` patch release. It retains the security corrections that made
`1.26.7` the previous floor and adds the upstream compiler, runtime, cgo,
`debug/elf`, and `os` fixes shipped in `1.26.8`. Source-built Alpine container
stages pin the Docker Official Images manifest list
`sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628`;
the checked-in toolchain files and release-script guards must reject an older
compiler so local, exact-candidate, provider control-plane, and container builds
cannot silently reintroduce the vulnerable runtime.
cannot silently reintroduce a superseded runtime.
That same dev-runtime dependency-manifest boundary now also owns the maintained
Docker engine module floor. `go.mod`, `go.sum`, and
`internal/cloudcp/docker/manager.go` must route hosted runtime orchestration
go.mod
+1 -1
View File
@@ -2,7 +2,7 @@ module github.com/rcourtman/pulse-go-rewrite
go 1.26.0
toolchain go1.26.7
toolchain go1.26.8
require (
github.com/IGLOU-EU/go-wildcard/v2 v2.1.1
scripts/.go-version
+1 -1
View File
@@ -1 +1 @@
go1.26.7
go1.26.8
scripts/build-release-binaries.sh
+1 -1
View File
@@ -44,7 +44,7 @@ case "${OUTPUT_ROOT}" in
;;
esac
required_go="go1.26.7"
required_go="go1.26.8"
current_go="$(go env GOVERSION 2>/dev/null || true)"
if [[ "${current_go}" != "${required_go}" ]]; then
echo "Error: Go toolchain must be ${required_go} (got ${current_go:-unknown})." >&2
scripts/build-release.sh
+1 -1
View File
@@ -20,7 +20,7 @@ if [ -x /usr/local/go/bin/go ]; then
fi
# Release artifacts must be built with the vetted toolchain to match security-gate evidence.
required_go="go1.26.7"
required_go="go1.26.8"
current_go="$(go env GOVERSION 2>/dev/null || true)"
if [[ "${PULSE_SKIP_GO_VERSION_CHECK:-false}" != "true" ]]; then
if [[ "${current_go}" != "${required_go}" ]]; then
scripts/build-secure-runtime-qualification.sh
+1 -1
View File
@@ -35,7 +35,7 @@ if [[ -z "${PULSE_UPDATE_SIGNING_PUBLIC_KEY:-}" ]]; then
exit 3
fi
required_go="go1.26.7"
required_go="go1.26.8"
go_version="$(go env GOVERSION 2>/dev/null || true)"
if [[ "${go_version}" != "${required_go}" ]]; then
echo "Error: Go toolchain must be ${required_go} (got ${go_version:-unknown})." >&2
scripts/install-go-toolchain.sh
+1 -1
View File
@@ -3,7 +3,7 @@ set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
VERSION_FILE="${SCRIPT_DIR}/.go-version"
DEFAULT_VERSION="go1.26.7"
DEFAULT_VERSION="go1.26.8"
TARGET_ROOT="/opt/toolchains/go"
DOWNLOAD_ROOT="https://dl.google.com/go"
GOPATH_DIR="/var/lib/pulse/go"
scripts/installtests/build_release_assets_test.go
+8 -5
View File
@@ -1606,7 +1606,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
dockerfile := string(dockerfileBytes)
dockerRequired := []string{
`FROM --platform=linux/amd64 node:24-alpine@sha256:`,
`FROM --platform=linux/amd64 golang:1.26.7-alpine@sha256:`,
`FROM --platform=linux/amd64 golang:1.26.8-alpine@sha256:`,
`FROM backend-builder AS release-assets-builder`,
`AS agent_runtime`,
`AS pulse-runtime-foundation`,
@@ -1641,7 +1641,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
}
}
assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 node:24-alpine@sha256:`, ` AS frontend-builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 golang:1.26.7-alpine@sha256:`, ` AS backend-builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 golang:1.26.8-alpine@sha256:`, ` AS backend-builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ` AS agent_runtime`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ` AS pulse-runtime-foundation`)
hostedStart := strings.Index(dockerfile, `FROM pulse-runtime-base AS hosted_runtime`)
@@ -1654,7 +1654,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
t.Fatalf("hosted_runtime target must not depend on installer rendering or embedded agent artifacts:\n%s", hostedStage)
}
if strings.Contains(dockerfile, `FROM --platform=linux/amd64 node:24-alpine AS frontend-builder`) ||
strings.Contains(dockerfile, `FROM --platform=linux/amd64 golang:1.26.7-alpine AS backend-builder`) ||
strings.Contains(dockerfile, `FROM --platform=linux/amd64 golang:1.26.8-alpine AS backend-builder`) ||
strings.Contains(dockerfile, `FROM alpine:3.24 AS agent_runtime`) ||
strings.Contains(dockerfile, `FROM alpine:3.24 AS pulse-runtime-base`) {
t.Fatal("Dockerfile base images must be pinned by immutable @sha256 digests")
@@ -2829,7 +2829,10 @@ func TestReleaseAssetCommonRunsUpdateKeyThroughModulePath(t *testing.T) {
t.Skip("go not installed")
}
cmd := exec.Command("bash", "-lc", "source ./scripts/release_asset_common.sh; pulse_release_go_run_update_key")
// Keep the toolchain selected by the test runner. A login shell may source a
// developer's stale mise/asdf profile and replace setup-go's release
// toolchain while leaving its GOROOT behind.
cmd := exec.Command("bash", "-c", "source ./scripts/release_asset_common.sh; pulse_release_go_run_update_key")
cmd.Dir = repoFile()
output, err := cmd.CombinedOutput()
if err == nil {
@@ -2861,7 +2864,7 @@ func TestReleaseAssetCommonRejectsUnexpectedUpdateSigningPublicKey(t *testing.T)
t.Fatalf("generate unexpected public key: %v", err)
}
cmd := exec.Command("bash", "-lc", "source ./scripts/release_asset_common.sh; pulse_release_prepare_signing_state pulse-installer pulse-install")
cmd := exec.Command("bash", "-c", "source ./scripts/release_asset_common.sh; pulse_release_prepare_signing_state pulse-installer pulse-install")
cmd.Dir = repoFile()
cmd.Env = append(os.Environ(),
"PULSE_UPDATE_SIGNING_KEY="+base64.StdEncoding.EncodeToString(privateKey),
scripts/installtests/integration_container_test.go
+1 -1
View File
@@ -13,7 +13,7 @@ func TestIntegrationContainersUseGovernedImmutableBases(t *testing.T) {
t.Fatalf("read mock GitHub Dockerfile: %v", err)
}
dockerfile := string(dockerfileBytes)
assertDigestPinnedDockerStage(t, dockerfile, `FROM golang:1.26.7-alpine@sha256:`, ` AS builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM golang:1.26.8-alpine@sha256:`, ` AS builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ``)
composeBytes, err := os.ReadFile(repoFile("tests", "integration", "docker-compose.test.yml"))
scripts/installtests/provider_msp_deploy_test.go
+2 -2
View File
@@ -306,7 +306,7 @@ func TestProviderMSPControlPlaneDockerfileBuildsReleaseLicenseBinary(t *testing.
"FROM --platform=linux/amd64 node:24-alpine@sha256:",
"npm ci",
"npm run build",
"FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine@sha256:",
"FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:",
"FROM alpine:3.24@sha256:",
"ARG PULSE_LICENSE_PUBLIC_KEY_SHA256",
"ARG TARGETOS",
@@ -333,7 +333,7 @@ func TestProviderMSPControlPlaneDockerfileBuildsReleaseLicenseBinary(t *testing.
"CGO_ENABLED=0 go build -o /pulse-control-plane ./cmd/pulse-control-plane",
)
assertDigestPinnedDockerStage(t, text, `FROM --platform=linux/amd64 node:24-alpine@sha256:`, ` AS frontend-builder`)
assertDigestPinnedDockerStage(t, text, `FROM --platform=$BUILDPLATFORM golang:1.26.7-alpine@sha256:`, ` AS builder`)
assertDigestPinnedDockerStage(t, text, `FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:`, ` AS builder`)
assertDigestPinnedDockerStage(t, text, `FROM alpine:3.24@sha256:`, ` AS control-plane-runtime-foundation`)
}
scripts/tests/test-hot-dev-runtime.sh
+3 -3
View File
@@ -364,9 +364,9 @@ test_go_release_toolchain_floor() {
module_toolchain="$(sed -n 's/^toolchain //p' "${ROOT_DIR}/go.mod")"
installed_toolchain="$(cd "${ROOT_DIR}" && go env GOVERSION)"
assert_contains "Go module uses the patched release toolchain" "${module_toolchain}" "go1.26.7"
assert_contains "dev toolchain installer uses the patched release toolchain" "$(<"${ROOT_DIR}/scripts/.go-version")" "go1.26.7"
assert_contains "active dev runtime resolves the patched release toolchain" "${installed_toolchain}" "go1.26.7"
assert_contains "Go module uses the patched release toolchain" "${module_toolchain}" "go1.26.8"
assert_contains "dev toolchain installer uses the patched release toolchain" "$(<"${ROOT_DIR}/scripts/.go-version")" "go1.26.8"
assert_contains "active dev runtime resolves the patched release toolchain" "${installed_toolchain}" "go1.26.8"
}
test_backend_race_suite_keeps_hosted_runner_timeout_headroom() {
tests/integration/mock-github-server/Dockerfile
+1 -1
View File
@@ -1,4 +1,4 @@
FROM golang:1.26.7-alpine@sha256:28d89ee9cc0ff9fec75c82ca201e6bf7fdf9a679d4b7b24dfa04f2bb766bb468 AS builder
FROM golang:1.26.8-alpine@sha256:ce864e7223ac17b1775e6fd0b4c0db580c2eb50e7953a427916379e4b92a1628 AS builder
WORKDIR /build
COPY go.mod ./