Sign in

Search issue titles and bodies, change requests and comments. Private repositories you cannot read are not included.
vole
Clone

Read only, no credentials:

https://rodent.software/git/vole.git

Write over SSH with a registered key:

git clone ssh://git@0.0.0.0:2222/vole.git

A free and open-source forge that lives in your Git repo.

#16

Build and scan with the Go 1.27.3 toolchain

closed · by keenan 13d ago

keenan opened this 13d ago

Closes the toolchain and vulnerability-scanning item of #01M5XCHYYYWCWZPFDWC8RS3X6X, the cheapest P0 in #01M5XCHRQFT0FTM0CJYRYWVD3V.

Why

On Go 1.27.1, govulncheck ./... reports 13 vulnerabilities that the code actually reaches, all in the standard library:

Package Fixed in
crypto/x509 (GO-2026-6809) 1.27.3
net/http, HTTP/2, crypto/tls, html/template, net/textproto (11 advisories) 1.27.2

Several traces are on the server’s own request path (server.Run → http.Server.Serve) and in core/lfs/transfer.go, so this is not theoretical.

What changed

  • go.mod pins toolchain go1.27.3. A developer on 1.27.1 now builds with 1.27.3 without upgrading their install.
  • .vole/images/verify.yaml, .vole/images/release.yaml move to golang:1.27.3-bookworm, pinned by digest (sha256:972b4110…) so a rebuild cannot pick up a different compiler.
  • .vole/workflows/verify.yaml gains a govulncheck step, fetched at a pinned v1.9.0 the same way nfpm already is. A new reachable vulnerability fails the push.
  • .vole/workflows/release.yaml gates a tag on the same scan before it builds anything, because a tag can point at a commit that never passed branch CI and a release cannot be recalled.
  • Reproducible release build: SOURCE_DATE_EPOCH from the tag’s commit time (nfpm honours it) and -buildid= in the link flags, on top of the -trimpath and CGO_ENABLED=0 already there.
  • Dependencies refreshed: x/net 0.61.0, modernc.org/libc 1.79.1, msgp 1.6.5, regexp2/v2 2.11.0, cbor/v2 2.9.6, fwd 1.2.1.
  • docs/getting-started.md states the 1.27.3 requirement.

On golangci-lint

The scope item says to update it or replace it with a Go 1.27-compatible staticcheck setup. There is no golangci-lint config in the repository and CI never invokes it — go vet ./... on the pinned toolchain is the static check that gates a push, and it is now Go 1.27.3 by construction. The golangci-lint binary on this machine is a developer-local 2.12.2 built with go1.26.8 and is not part of the build. I did not add a new linter to CI here: that changes what every branch must pass and belongs in its own change.

Verification

vole workflow run verify in the pinned image, all steps:

  • gofmt -l . — clean
  • go vet ./..., go build ./... — clean
  • govulncheck ./... (v1.9.0) — no vulnerabilities found, 0 reachable
  • packaging — deb and rpm built
  • markdown links — clean
  • go test -race -count=1 ./... — all packages pass

govulncheck still reports one module finding it does not count as reachable: GO-2026-5932, the unmaintained golang.org/x/crypto/openpgp package. Vole does not import it, and x/crypto is already at its latest v0.58.0, so there is nothing to upgrade away from.

Acceptance

  • govulncheck ./... is clean on the release toolchain.
  • CI fails when a new reachable vulnerability is introduced (new step in verify, gate in release).
  • Release artifacts are built by the pinned toolchain: the image carries 1.27.3 and go.mod refuses to build with less.

Discussion (0)

No discussion yet.