vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Build and scan with the Go 1.27.3 toolchain

536f08b97b043993cce9a1c78ba5a606815b19d9 · Keenan Nemetz · 14d ago · parent e698b495

Build and scan with the Go 1.27.3 toolchain

govulncheck on Go 1.27.1 reports 13 reachable standard-library
vulnerabilities (net/http, HTTP/2, crypto/tls, crypto/x509,
html/template, net/textproto). Most fix in 1.27.2; GO-2026-6809 in
crypto/x509 fixes in 1.27.3.

Pin the toolchain in go.mod, run verify and release in an image that
carries it, and make reachable vulnerabilities fail both. The base image
is pinned by digest so the compiler that passes a push is the compiler
the tag is built with, and the scanner is pinned like nfpm already is.

The release build also sets SOURCE_DATE_EPOCH from the tag and drops the
build id, so the same tag rebuilds byte for byte.

Dependencies are refreshed to their current releases: x/net 0.61.0,
libc 1.79.1, msgp 1.6.5, regexp2 2.11.0, cbor 2.9.6, fwd 1.2.1. x/crypto
is already at its latest v0.58.0; the remaining GO-2026-5932 module
finding is the unused openpgp package, which the scan does not count as
reachable.

.vole/images/verify.yaml +6−1

@@ -2,6 +2,11 @@
	2	2	# (with gcc, so -race works), git and the ssh client and keygen the server tests
	3	3	# spawn, and python3 for the link check.
	4	4	#
		5	# The toolchain is the one go.mod pins (go 1.27.3), and the base image is pinned
		6	# by digest so the scanner and the compiler that pass a push are the ones the
		7	# release is built with. Bump both together, and bump the govulncheck version in
		8	# the workflows when the scanner moves.
		9	#
	5	10	# The ci user exists for OpenSSH: ssh and ssh-keygen call getpwuid() and exit 255
	6	11	# with "No user exists for uid N" when the running uid has no passwd entry, which
	7	12	# the server tests hit. The container runs as the host's uid (so the bind-mounted
@@ -12,7 +17,7 @@
	12	17	# nfpm is not installed here: the packaging step fetches it at a pinned version, so
	13	18	# that a local run and a pushed run execute the same command.
	14	19	version: 1
	15		from: golang:1.27-bookworm
		20	from: golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
	16	21	env:
	17	22	CGO_ENABLED: "1"
	18	23	# Opt in to the cache the runner mounts at /cache. Nothing is cached unless the