gsadmin/pulse
1
0
Fork 0
mirror of https://github.com/rcourtman/Pulse.git synced 2026-10-26 05:29:45 +00:00
Code Issues Packages Projects Releases Wiki Activity

Preserve the current upstream Go security toolchain and dependency repair

Browse Source 
Compose the exact observed upstream additively without rewriting reviewed tip 805ea6d712 or any accepted ancestry. The new Go 1.26.9 and x/net graph need matching final-source evidence before this batch can be proposed.

Change-source: pulse-maintainer
This commit is contained in:
pulse-triage[bot]
2026-10-11 23:42:21 +01:00
parent 7ebef3b868 f42b2d7e88
commit eead1dce67
21 changed files with 46 additions and 40 deletions
Download Patch File Download Diff File Expand all files Collapse all files
scripts/.go-version
+1 -1
View File
@@ -1 +1 @@
go1.26.8
go1.26.9
scripts/build-release-binaries.sh
+1 -1
View File
@@ -44,7 +44,7 @@ case "${OUTPUT_ROOT}" in
;;
esac
required_go="go1.26.8"
required_go="go1.26.9"
current_go="$(go env GOVERSION 2>/dev/null || true)"
if [[ "${current_go}" != "${required_go}" ]]; then
echo "Error: Go toolchain must be ${required_go} (got ${current_go:-unknown})." >&2
scripts/build-release.sh
+1 -1
View File
@@ -20,7 +20,7 @@ if [ -x /usr/local/go/bin/go ]; then
fi
# Release artifacts must be built with the vetted toolchain to match security-gate evidence.
required_go="go1.26.8"
required_go="go1.26.9"
current_go="$(go env GOVERSION 2>/dev/null || true)"
if [[ "${PULSE_SKIP_GO_VERSION_CHECK:-false}" != "true" ]]; then
if [[ "${current_go}" != "${required_go}" ]]; then
scripts/build-secure-runtime-qualification.sh
+1 -1
View File
@@ -35,7 +35,7 @@ if [[ -z "${PULSE_UPDATE_SIGNING_PUBLIC_KEY:-}" ]]; then
exit 3
fi
required_go="go1.26.8"
required_go="go1.26.9"
go_version="$(go env GOVERSION 2>/dev/null || true)"
if [[ "${go_version}" != "${required_go}" ]]; then
echo "Error: Go toolchain must be ${required_go} (got ${go_version:-unknown})." >&2
scripts/diagnose-root-pair.py
+2 -2
View File
@@ -71,8 +71,8 @@ def telemetry():
def execute(repo, output):
output.mkdir(parents=True, exist_ok=False) # never overwrite a previous attempt
os.environ.update(GOTOOLCHAIN='local', GOMAXPROCS='4', GOFLAGS='-mod=readonly', GOENV='off', GOAMD64='v1', CGO_ENABLED='1')
if run(['go', 'version']).strip() != 'go version go1.26.8 linux/amd64':
raise ValueError('requires exact hosted experiment toolchain go1.26.8 linux/amd64')
if run(['go', 'version']).strip() != 'go version go1.26.9 linux/amd64':
raise ValueError('requires exact hosted experiment toolchain go1.26.9 linux/amd64')
metadata = {
'purpose': 'diagnostic-only; no gate disposition or release candidate',
'rounds': ROUNDS, 'gomaxprocs': 4, 'benchtime': '1s',
scripts/install-go-toolchain.sh
+5 -3
View File
@@ -3,7 +3,7 @@ set -euo pipefail
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
VERSION_FILE="${SCRIPT_DIR}/.go-version"
DEFAULT_VERSION="go1.26.8"
DEFAULT_VERSION="go1.26.9"
TARGET_ROOT="/opt/toolchains/go"
DOWNLOAD_ROOT="https://dl.google.com/go"
GOPATH_DIR="/var/lib/pulse/go"
@@ -14,7 +14,8 @@ if [[ ! -f "$VERSION_FILE" ]]; then
echo "$DEFAULT_VERSION" | sudo tee "$VERSION_FILE" >/dev/null
fi
VERSION="$(tr -d '
' < "$VERSION_FILE")"
ARCHIVE="${VERSION}.linux-amd64.tar.gz"
DOWNLOAD_DIR="${TMPDIR:-/tmp}/go-install"
ARCHIVE_PATH="$DOWNLOAD_DIR/$ARCHIVE"
@@ -28,7 +29,8 @@ fi
curl -fsSL "$DOWNLOAD_ROOT/$ARCHIVE.sha256" -o "$SHA_PATH"
CHECKSUM="$(tr -d '
CHECKSUM="$(tr -d '
' < "$SHA_PATH")"
printf '%s %s
' "$CHECKSUM" "$ARCHIVE_PATH" | sha256sum -c -
scripts/installtests/build_release_assets_test.go
+3 -3
View File
@@ -1618,7 +1618,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
dockerfile := string(dockerfileBytes)
dockerRequired := []string{
"FROM --platform=linux/amd64 node:24-alpine@sha256:" + node24Amd64FrontendDigest + " AS frontend-builder",
`FROM --platform=linux/amd64 golang:1.26.8-alpine@sha256:`,
`FROM --platform=linux/amd64 golang:1.26.9-alpine@sha256:`,
`FROM backend-builder AS release-assets-builder`,
`AS agent_runtime`,
`AS pulse-runtime-foundation`,
@@ -1653,7 +1653,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
}
}
assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 node:24-alpine@sha256:`, ` AS frontend-builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 golang:1.26.8-alpine@sha256:`, ` AS backend-builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM --platform=linux/amd64 golang:1.26.9-alpine@sha256:`, ` AS backend-builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ` AS agent_runtime`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ` AS pulse-runtime-foundation`)
hostedStart := strings.Index(dockerfile, `FROM pulse-runtime-base AS hosted_runtime`)
@@ -1666,7 +1666,7 @@ func TestDockerBuildUsesCanonicalReleaseLdflags(t *testing.T) {
t.Fatalf("hosted_runtime target must not depend on installer rendering or embedded agent artifacts:\n%s", hostedStage)
}
if strings.Contains(dockerfile, `FROM --platform=linux/amd64 node:24-alpine AS frontend-builder`) ||
strings.Contains(dockerfile, `FROM --platform=linux/amd64 golang:1.26.8-alpine AS backend-builder`) ||
strings.Contains(dockerfile, `FROM --platform=linux/amd64 golang:1.26.9-alpine AS backend-builder`) ||
strings.Contains(dockerfile, `FROM alpine:3.24 AS agent_runtime`) ||
strings.Contains(dockerfile, `FROM alpine:3.24 AS pulse-runtime-base`) {
t.Fatal("Dockerfile base images must be pinned by immutable @sha256 digests")
scripts/installtests/integration_container_test.go
+1 -1
View File
@@ -13,7 +13,7 @@ func TestIntegrationContainersUseGovernedImmutableBases(t *testing.T) {
t.Fatalf("read mock GitHub Dockerfile: %v", err)
}
dockerfile := string(dockerfileBytes)
assertDigestPinnedDockerStage(t, dockerfile, `FROM golang:1.26.8-alpine@sha256:`, ` AS builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM golang:1.26.9-alpine@sha256:`, ` AS builder`)
assertDigestPinnedDockerStage(t, dockerfile, `FROM alpine:3.24@sha256:`, ``)
composeBytes, err := os.ReadFile(repoFile("tests", "integration", "docker-compose.test.yml"))
scripts/installtests/provider_msp_deploy_test.go
+3 -3
View File
@@ -15,7 +15,7 @@ func TestProviderMSPGoBuilderMatchesIntegrationMock(t *testing.T) {
// These builders use the same Go patch level and immutable image. The
// mock's build must not exercise a different compiler from the hosted
// control plane merely because Dependabot advanced one Dockerfile.
const expected = "golang:1.26.8-alpine@sha256:8ac98ca534ac3f51e1f420a1dd2c15e74c75cfa0f23f3ad27eb5d7236c349a0c"
const expected = "golang:1.26.9-alpine@sha256:3082400e369fa24d5fc60bca20edab3f6d604e0c5a690ec66b295eff4dd87ade"
pattern := regexp.MustCompile(`(?m)^FROM (?:--platform=\$BUILDPLATFORM )?(golang:[^[:space:]]+) AS builder$`)
for _, path := range [][]string{
{"deploy", "provider-msp", "Dockerfile.control-plane"},
@@ -328,7 +328,7 @@ func TestProviderMSPControlPlaneDockerfileBuildsReleaseLicenseBinary(t *testing.
"FROM --platform=linux/amd64 node:24-alpine@sha256:"+node24Amd64FrontendDigest+" AS frontend-builder",
"npm ci",
"npm run build",
"FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:",
"FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine@sha256:",
"FROM alpine:3.24@sha256:",
"ARG PULSE_LICENSE_PUBLIC_KEY_SHA256",
"ARG TARGETOS",
@@ -355,7 +355,7 @@ func TestProviderMSPControlPlaneDockerfileBuildsReleaseLicenseBinary(t *testing.
"CGO_ENABLED=0 go build -o /pulse-control-plane ./cmd/pulse-control-plane",
)
assertDigestPinnedDockerStage(t, text, `FROM --platform=linux/amd64 node:24-alpine@sha256:`, ` AS frontend-builder`)
assertDigestPinnedDockerStage(t, text, `FROM --platform=$BUILDPLATFORM golang:1.26.8-alpine@sha256:`, ` AS builder`)
assertDigestPinnedDockerStage(t, text, `FROM --platform=$BUILDPLATFORM golang:1.26.9-alpine@sha256:`, ` AS builder`)
assertDigestPinnedDockerStage(t, text, `FROM alpine:3.24@sha256:`, ` AS control-plane-runtime-foundation`)
}
scripts/tests/test-hot-dev-runtime.sh
+3 -3
View File
@@ -414,9 +414,9 @@ test_go_release_toolchain_floor() {
module_toolchain="$(sed -n 's/^toolchain //p' "${ROOT_DIR}/go.mod")"
installed_toolchain="$(cd "${ROOT_DIR}" && go env GOVERSION)"
assert_contains "Go module uses the patched release toolchain" "${module_toolchain}" "go1.26.8"
assert_contains "dev toolchain installer uses the patched release toolchain" "$(<"${ROOT_DIR}/scripts/.go-version")" "go1.26.8"
assert_contains "active dev runtime resolves the patched release toolchain" "${installed_toolchain}" "go1.26.8"
assert_contains "Go module uses the patched release toolchain" "${module_toolchain}" "go1.26.9"
assert_contains "dev toolchain installer uses the patched release toolchain" "$(<"${ROOT_DIR}/scripts/.go-version")" "go1.26.9"
assert_contains "active dev runtime resolves the patched release toolchain" "${installed_toolchain}" "go1.26.9"
}
test_backend_race_suite_keeps_hosted_runner_timeout_headroom() {
scripts/tests/test_root_pair_diagnostic.py
+2 -2
View File
@@ -56,7 +56,7 @@ class DiagnosticTests(unittest.TestCase):
def fake_run(args, cwd=None):
if args == ['go', 'version']:
return 'go version go1.26.7 linux/amd64' if bad_go else 'go version go1.26.8 linux/amd64'
return 'go version go1.26.7 linux/amd64' if bad_go else 'go version go1.26.9 linux/amd64'
if args[:2] == ['git', 'rev-parse']:
return 'wrong' if bad_tree else diag.TREES[args[2].split('^')[0]]
if args[:3] == ['go', 'tool', 'nm']:
@@ -151,7 +151,7 @@ class DiagnosticTests(unittest.TestCase):
self.assertIn('[[ "$GITHUB_RUN_ATTEMPT" == 1 ]]', workflow)
self.assertIn('path: root-pair-evidence/', workflow)
self.assertIn('if: always()', workflow)
self.assertIn("go-version: '1.26.8'", workflow)
self.assertIn("go-version: '1.26.9'", workflow)
self.assertIn('timeout-minutes: 45', workflow)