mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-26 13:39:47 +00:00
rcourtman
592a1e52f6
govulncheck on the pinned 1.26.8 toolchain reports twelve reachable standard library vulnerabilities in Pulse (net/http, crypto/tls, html/template, os, net/textproto), published on 2026-10-08 and fixed in Go 1.26.9. golang.org/x/net v0.58.0 carries further advisories fixed in v0.60.0. With 1.26.9 and x/net v0.60.0 the scan reports no affecting vulnerabilities under both govulncheck v1.1.4 and v1.7.0. Pulse's own govulncheck job last ran on 2026-10-05, so nothing flagged this. The private Enterprise build and test job notices it: once the scan finds reachable advisories it needs more than the 4 GiB CI VM holds, the guest kernel kills govulncheck, and the job is cancelled. That has failed every Enterprise pair check since 2026-10-08, including the first beta's. Move every release builder and local toolchain guard together, as 1.26.8 did, so no candidate artifact keeps an older compiler: go.mod, the builder image digests (index digest for 1.26.9-alpine), the release and dev scripts, the devcontainer, and the root pair diagnostic. Only x/net is raised in the module graph; go mod tidy is deliberately not run, so unrelated indirect requirements stay as they were. Contract-Neutral: Toolchain and indirect dependency patch update that clears reported advisories; no product or runtime contract changed.
52 lines
1.5 KiB
Bash
Executable File
52 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
VERSION_FILE="${SCRIPT_DIR}/.go-version"
|
|
DEFAULT_VERSION="go1.26.9"
|
|
TARGET_ROOT="/opt/toolchains/go"
|
|
DOWNLOAD_ROOT="https://dl.google.com/go"
|
|
GOPATH_DIR="/var/lib/pulse/go"
|
|
CACHE_DIR="/var/cache/pulse/go-build"
|
|
TMP_DIR="/var/cache/pulse/tmp"
|
|
|
|
if [[ ! -f "$VERSION_FILE" ]]; then
|
|
echo "$DEFAULT_VERSION" | sudo tee "$VERSION_FILE" >/dev/null
|
|
fi
|
|
VERSION="$(tr -d '
|
|
|
|
' < "$VERSION_FILE")"
|
|
ARCHIVE="${VERSION}.linux-amd64.tar.gz"
|
|
DOWNLOAD_DIR="${TMPDIR:-/tmp}/go-install"
|
|
ARCHIVE_PATH="$DOWNLOAD_DIR/$ARCHIVE"
|
|
SHA_PATH="$ARCHIVE_PATH.sha256"
|
|
|
|
mkdir -p "$DOWNLOAD_DIR"
|
|
|
|
if [[ ! -f "$ARCHIVE_PATH" ]]; then
|
|
curl -fsSL "$DOWNLOAD_ROOT/$ARCHIVE" -o "$ARCHIVE_PATH"
|
|
fi
|
|
curl -fsSL "$DOWNLOAD_ROOT/$ARCHIVE.sha256" -o "$SHA_PATH"
|
|
|
|
CHECKSUM="$(tr -d '
|
|
|
|
' < "$SHA_PATH")"
|
|
printf '%s %s
|
|
' "$CHECKSUM" "$ARCHIVE_PATH" | sha256sum -c -
|
|
|
|
sudo mkdir -p "$TARGET_ROOT"
|
|
sudo rm -rf "$TARGET_ROOT/$VERSION"
|
|
sudo tar -C "$TARGET_ROOT" -xzf "$ARCHIVE_PATH"
|
|
sudo mv "$TARGET_ROOT/go" "$TARGET_ROOT/$VERSION"
|
|
sudo ln -sfn "$TARGET_ROOT/$VERSION" "$TARGET_ROOT/current"
|
|
sudo ln -sfn /opt/toolchains/go/current /usr/local/go
|
|
|
|
sudo mkdir -p "$GOPATH_DIR" "$GOPATH_DIR/bin" "$GOPATH_DIR/pkg"
|
|
sudo chown -R pulse:pulse "$GOPATH_DIR"
|
|
|
|
sudo mkdir -p "$CACHE_DIR" "$TMP_DIR"
|
|
sudo chown -R pulse:pulse "$CACHE_DIR" "$TMP_DIR"
|
|
|
|
sudo ln -sfn /opt/toolchains/go/current/bin/go /usr/local/bin/go
|
|
sudo ln -sfn /opt/toolchains/go/current/bin/gofmt /usr/local/bin/gofmt
|