mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-26 13:39:47 +00:00
rcourtman
592a1e52f6
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable standard library vulnerabilities in Pulse (net/http, crypto/tls, html/template, os, net/textproto), published on 2026-10-08 and fixed in Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting vulnerabilities under both govulncheck v1.1.4 and v1.7.0. Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged this. The private Enterprise build and test job notices it: once the scan finds reachable advisories it needs more than the 4 GiB CI VM holds, the guest kernel kills govulncheck, and the job is cancelled. That has failed every Enterprise pair check since 2026-10-08, including the first beta's. Move every release builder and local toolchain guard together, as 1.26.8 did, so no candidate artifact keeps an older compiler: go.mod, the builder image digests (index digest for 1.26.9-alpine), the release and dev scripts, the devcontainer, and the root pair diagnostic. Only x/net is raised in the module graph; go mod tidy is deliberately not run, so unrelated indirect requirements stay as they were. Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
25 lines
893 B
Docker
25 lines
893 B
Docker
FROM golang:1.26.9@sha256:d7722066f0b60ceccb6c0643cbed1f5f9e15506ac237146c95333504d7805d89
|
|
|
|
# Set bash as default shell for features
|
|
SHELL ["/bin/bash", "-c"]
|
|
|
|
# Install dev tools needed for hot-dev.sh
|
|
RUN apt-get update && apt-get install -y bash git make curl vim sudo lsof inotify-tools && rm -rf /var/lib/apt/lists/*
|
|
|
|
# Create non-root user
|
|
ARG USERNAME=vscode
|
|
ARG USER_UID=1000
|
|
ARG USER_GID=$USER_UID
|
|
|
|
RUN groupadd --gid $USER_GID $USERNAME && useradd --uid $USER_UID --gid $USER_GID -m $USERNAME -s /bin/bash && echo $USERNAME ALL=\(root\) NOPASSWD:ALL > /etc/sudoers.d/$USERNAME && chmod 0440 /etc/sudoers.d/$USERNAME
|
|
|
|
# Set up Go environment for non-root user
|
|
ENV GOPATH=/go
|
|
ENV PATH=$GOPATH/bin:$PATH
|
|
RUN mkdir -p $GOPATH/pkg $GOPATH/bin && chown -R $USERNAME:$USERNAME $GOPATH
|
|
|
|
USER $USERNAME
|
|
WORKDIR /workspace
|
|
|
|
CMD ["/bin/bash"]
|