mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-26 21:47:20 +00:00
rcourtman
592a1e52f6
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable standard library vulnerabilities in Pulse (net/http, crypto/tls, html/template, os, net/textproto), published on 2026-10-08 and fixed in Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting vulnerabilities under both govulncheck v1.1.4 and v1.7.0. Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged this. The private Enterprise build and test job notices it: once the scan finds reachable advisories it needs more than the 4 GiB CI VM holds, the guest kernel kills govulncheck, and the job is cancelled. That has failed every Enterprise pair check since 2026-10-08, including the first beta's. Move every release builder and local toolchain guard together, as 1.26.8 did, so no candidate artifact keeps an older compiler: go.mod, the builder image digests (index digest for 1.26.9-alpine), the release and dev scripts, the devcontainer, and the root pair diagnostic. Only x/net is raised in the module graph; go mod tidy is deliberately not run, so unrelated indirect requirements stay as they were. Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
38 lines
2.3 KiB
Markdown
38 lines
2.3 KiB
Markdown
# Fixed root-route diagnostic
|
|
|
|
This manual, main-only workflow measures the unresolved hosted root-route
|
|
comparison, not release readiness. It never runs package tests, other benchmarks,
|
|
or layout interventions, and never changes a release threshold.
|
|
|
|
The source pair is fixed in `scripts/diagnose-root-pair.py`: baseline
|
|
`9168d16a32e948665eba80e2899604933292cdc0` and durable main candidate
|
|
`dd388decf5896123b6587b1b16f9aee7c3a747f3`. The candidate has the exact
|
|
`1120cce4d631bca5525cafc5b5620251998773f7` tree measured from ephemeral
|
|
source commit `4cdf250f474ad9cde6ffb121527f021b7387603f7`; metadata retains that original
|
|
evidence identity. Tree and HTTP source hashes must match. Both API test binaries
|
|
use Go 1.26.9, readonly modules and identical CI
|
|
embed text; compilation finishes before either warm-up. Four available CPUs
|
|
are selected and inherited by children, GOMAXPROCS is four. After two 100ms
|
|
warm-ups and ten seconds settling, ten rounds alternate AB/BA with one 1s
|
|
root-only sample per binary per round. No selective retries are supported.
|
|
|
|
Artifacts retain source/tree, binary and embed hashes, build logs/toolchain,
|
|
root/benchmark disassembly and symbols, sample order/start/end timestamps,
|
|
affinity, CPU model, pressure and cgroup throttling observations. Unavailable
|
|
telemetry is explicit, not zero. Executables are not published. Partial evidence
|
|
survives failure; only complete collection sets `complete=true`. A crash stops
|
|
collection and does not authorise crash investigation. The original adverse
|
|
result remains evidence even if this comparison finds no gap.
|
|
|
|
Dispatch requires the exact reviewed current-main workflow SHA and attempt one;
|
|
permissions are contents-read only, with no production credentials or writes.
|
|
Independent review and protected landing precede any hosted collection. Inspect
|
|
the retained attempt before another operation; a successful collection is not a
|
|
qualification verdict. No beta.3 scope or installed acceptance changes here.
|
|
|
|
Focused contract proof (mocked commands, no benchmark):
|
|
`python3 -m unittest discover -s scripts/tests -p test_root_pair_diagnostic.py -v`.
|
|
It checks the fixed order and selection, build-before-sample sequencing,
|
|
partial failure retention, source/toolchain refusal, receipt non-overwrite,
|
|
workflow authority and complete artifact hashes.
|