mirror of
https://github.com/rcourtman/Pulse.git
synced 2026-10-25 21:20:00 +00:00
rcourtman
02e53bc777
Go 1.26.10 (20 October) distrusts the compromised eMudhra intermediate CAs in crypto/x509 (CVE-2026-111943). Binaries built with 1.26.9 still accept chains through them, so every verified outbound TLS connection Pulse makes (licence, updates, webhooks, AI providers) stays open to interception by a holder of those keys. govulncheck does not flag a trust-store change as a called symbol, so the scheduled scan stayed green while the gap existed. Advance the governed toolchain floor and every pin together: go.mod, the toolchain installer and release-script guards, the source-built container stages (manifest-list digests for golang:1.26.10-alpine and the Debian dev container image), the root-pair diagnostic, and their tests. Vite 6.4.3 bundles a launch-editor with three advisories (GHSA-587h-7wmj-h5pm, GHSA-r825-w8mm-5pxw, GHSA-698v-4r3x-3vcv) that failed the daily advisory watch. 6.4.4 bundles the fixed launch-editor and 6.4.5 adds the dev-server server.fs query check. Both reach only the local dev server, not the built product. The lockfile changes only the vite entry, and dependencySecurity.test.ts now pins the floor.
52 lines
1.5 KiB
Bash
Executable File
52 lines
1.5 KiB
Bash
Executable File
#!/usr/bin/env bash
|
|
set -euo pipefail
|
|
|
|
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
VERSION_FILE="${SCRIPT_DIR}/.go-version"
|
|
DEFAULT_VERSION="go1.26.10"
|
|
TARGET_ROOT="/opt/toolchains/go"
|
|
DOWNLOAD_ROOT="https://dl.google.com/go"
|
|
GOPATH_DIR="/var/lib/pulse/go"
|
|
CACHE_DIR="/var/cache/pulse/go-build"
|
|
TMP_DIR="/var/cache/pulse/tmp"
|
|
|
|
if [[ ! -f "$VERSION_FILE" ]]; then
|
|
echo "$DEFAULT_VERSION" | sudo tee "$VERSION_FILE" >/dev/null
|
|
fi
|
|
VERSION="$(tr -d '
|
|
|
|
' < "$VERSION_FILE")"
|
|
ARCHIVE="${VERSION}.linux-amd64.tar.gz"
|
|
DOWNLOAD_DIR="${TMPDIR:-/tmp}/go-install"
|
|
ARCHIVE_PATH="$DOWNLOAD_DIR/$ARCHIVE"
|
|
SHA_PATH="$ARCHIVE_PATH.sha256"
|
|
|
|
mkdir -p "$DOWNLOAD_DIR"
|
|
|
|
if [[ ! -f "$ARCHIVE_PATH" ]]; then
|
|
curl -fsSL "$DOWNLOAD_ROOT/$ARCHIVE" -o "$ARCHIVE_PATH"
|
|
fi
|
|
curl -fsSL "$DOWNLOAD_ROOT/$ARCHIVE.sha256" -o "$SHA_PATH"
|
|
|
|
CHECKSUM="$(tr -d '
|
|
|
|
' < "$SHA_PATH")"
|
|
printf '%s %s
|
|
' "$CHECKSUM" "$ARCHIVE_PATH" | sha256sum -c -
|
|
|
|
sudo mkdir -p "$TARGET_ROOT"
|
|
sudo rm -rf "$TARGET_ROOT/$VERSION"
|
|
sudo tar -C "$TARGET_ROOT" -xzf "$ARCHIVE_PATH"
|
|
sudo mv "$TARGET_ROOT/go" "$TARGET_ROOT/$VERSION"
|
|
sudo ln -sfn "$TARGET_ROOT/$VERSION" "$TARGET_ROOT/current"
|
|
sudo ln -sfn /opt/toolchains/go/current /usr/local/go
|
|
|
|
sudo mkdir -p "$GOPATH_DIR" "$GOPATH_DIR/bin" "$GOPATH_DIR/pkg"
|
|
sudo chown -R pulse:pulse "$GOPATH_DIR"
|
|
|
|
sudo mkdir -p "$CACHE_DIR" "$TMP_DIR"
|
|
sudo chown -R pulse:pulse "$CACHE_DIR" "$TMP_DIR"
|
|
|
|
sudo ln -sfn /opt/toolchains/go/current/bin/go /usr/local/bin/go
|
|
sudo ln -sfn /opt/toolchains/go/current/bin/gofmt /usr/local/bin/gofmt
|