rcourtman
592a1e52f6
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable standard library vulnerabilities in Pulse (net/http, crypto/tls, html/template, os, net/textproto), published on 2026-10-08 and fixed in Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting vulnerabilities under both govulncheck v1.1.4 and v1.7.0. Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged this. The private Enterprise build and test job notices it: once the scan finds reachable advisories it needs more than the 4 GiB CI VM holds, the guest kernel kills govulncheck, and the job is cancelled. That has failed every Enterprise pair check since 2026-10-08, including the first beta's. Move every release builder and local toolchain guard together, as 1.26.8 did, so no candidate artifact keeps an older compiler: go.mod, the builder image digests (index digest for 1.26.9-alpine), the release and dev scripts, the devcontainer, and the root pair diagnostic. Only x/net is raised in the module graph; go mod tidy is deliberately not run, so unrelated indirect requirements stay as they were. Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
2.3 KiB
Fixed root-route diagnostic
This manual, main-only workflow measures the unresolved hosted root-route comparison, not release readiness. It never runs package tests, other benchmarks, or layout interventions, and never changes a release threshold.
The source pair is fixed in scripts/diagnose-root-pair.py: baseline
9168d16a32e948665eba80e2899604933292cdc0 and durable main candidate
dd388decf5896123b6587b1b16f9aee7c3a747f3. The candidate has the exact
1120cce4d631bca5525cafc5b5620251998773f7 tree measured from ephemeral
source commit 4cdf250f474ad9cde6ffb121527f021b7387603f7; metadata retains that original
evidence identity. Tree and HTTP source hashes must match. Both API test binaries
use Go 1.26.9, readonly modules and identical CI
embed text; compilation finishes before either warm-up. Four available CPUs
are selected and inherited by children, GOMAXPROCS is four. After two 100ms
warm-ups and ten seconds settling, ten rounds alternate AB/BA with one 1s
root-only sample per binary per round. No selective retries are supported.
Artifacts retain source/tree, binary and embed hashes, build logs/toolchain,
root/benchmark disassembly and symbols, sample order/start/end timestamps,
affinity, CPU model, pressure and cgroup throttling observations. Unavailable
telemetry is explicit, not zero. Executables are not published. Partial evidence
survives failure; only complete collection sets complete=true. A crash stops
collection and does not authorise crash investigation. The original adverse
result remains evidence even if this comparison finds no gap.
Dispatch requires the exact reviewed current-main workflow SHA and attempt one; permissions are contents-read only, with no production credentials or writes. Independent review and protected landing precede any hosted collection. Inspect the retained attempt before another operation; a successful collection is not a qualification verdict. No beta.3 scope or installed acceptance changes here.
Focused contract proof (mocked commands, no benchmark):
python3 -m unittest discover -s scripts/tests -p test_root_pair_diagnostic.py -v.
It checks the fixed order and selection, build-before-sample sequencing,
partial failure retention, source/toolchain refusal, receipt non-overwrite,
workflow authority and complete artifact hashes.