vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Build and scan with the Go 1.27.3 toolchain

536f08b97b043993cce9a1c78ba5a606815b19d9 · Keenan Nemetz · 13d ago · parent e698b495

Build and scan with the Go 1.27.3 toolchain

govulncheck on Go 1.27.1 reports 13 reachable standard-library
vulnerabilities (net/http, HTTP/2, crypto/tls, crypto/x509,
html/template, net/textproto). Most fix in 1.27.2; GO-2026-6809 in
crypto/x509 fixes in 1.27.3.

Pin the toolchain in go.mod, run verify and release in an image that
carries it, and make reachable vulnerabilities fail both. The base image
is pinned by digest so the compiler that passes a push is the compiler
the tag is built with, and the scanner is pinned like nfpm already is.

The release build also sets SOURCE_DATE_EPOCH from the tag and drops the
build id, so the same tag rebuilds byte for byte.

Dependencies are refreshed to their current releases: x/net 0.61.0,
libc 1.79.1, msgp 1.6.5, regexp2 2.11.0, cbor 2.9.6, fwd 1.2.1. x/crypto
is already at its latest v0.58.0; the remaining GO-2026-5932 module
finding is the unused openpgp package, which the scan does not count as
reachable.

.vole/images/release.yaml +5−3

@@ -1,8 +1,10 @@
	1	1	# The image a release build runs in. Pinned so a tag built twice builds the same
	2		# way. It needs no packaging tools of its own: the steps fetch a pinned nfpm, which
	3		# is also what makes `vole workflow run release` work locally.
		2	# way: the tag names the exact toolchain go.mod pins (go 1.27.3) and the digest
		3	# pins the base image, so a rebuild cannot pick up a different compiler. It needs
		4	# no packaging tools of its own: the steps fetch a pinned nfpm, which is also what
		5	# makes `vole workflow run release` work locally.
	4	6	version: 1
	5		from: golang:1.27-bookworm
		7	from: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
	6	8	env:
	7	9	CGO_ENABLED: "0"
	8	10	# Opt in to the runner's cache mount, so a tag build reuses what CI already