vole

Clone

Read only, no credentials:

https://rodent.software/vole.git

Write over SSH with a registered key:

git clone ssh://git@rodent.software:2222/vole.git

A free and open-source forge that lives in your Git repo.

Build and scan with the Go 1.27.3 toolchain

536f08b97b043993cce9a1c78ba5a606815b19d9 · Keenan Nemetz · 14d ago · parent e698b495

Build and scan with the Go 1.27.3 toolchain

govulncheck on Go 1.27.1 reports 13 reachable standard-library
vulnerabilities (net/http, HTTP/2, crypto/tls, crypto/x509,
html/template, net/textproto). Most fix in 1.27.2; GO-2026-6809 in
crypto/x509 fixes in 1.27.3.

Pin the toolchain in go.mod, run verify and release in an image that
carries it, and make reachable vulnerabilities fail both. The base image
is pinned by digest so the compiler that passes a push is the compiler
the tag is built with, and the scanner is pinned like nfpm already is.

The release build also sets SOURCE_DATE_EPOCH from the tag and drops the
build id, so the same tag rebuilds byte for byte.

Dependencies are refreshed to their current releases: x/net 0.61.0,
libc 1.79.1, msgp 1.6.5, regexp2 2.11.0, cbor 2.9.6, fwd 1.2.1. x/crypto
is already at its latest v0.58.0; the remaining GO-2026-5932 module
finding is the unused openpgp package, which the scan does not count as
reachable.

go.mod +8−6

@@ -2,6 +2,8 @@ module github.com/rodent-software/vole
	2	2
	3	3	go 1.27
	4	4
		5	toolchain go1.27.3
		6
	5	7	require (
	6	8	github.com/BurntSushi/toml v1.6.0
	7	9	github.com/alecthomas/chroma/v2 v2.27.0
@@ -15,9 +17,9 @@ require (
	15	17
	16	18	require (
	17	19	github.com/aymerick/douceur v0.2.0 // indirect
	18		github.com/dlclark/regexp2/v2 v2.2.1 // indirect
		20	github.com/dlclark/regexp2/v2 v2.11.0 // indirect
	19	21	github.com/dustin/go-humanize v1.1.0 // indirect
	20		github.com/fxamacker/cbor/v2 v2.9.4 // indirect
		22	github.com/fxamacker/cbor/v2 v2.9.6 // indirect
	21	23	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
	22	24	github.com/go-webauthn/x v0.3.1 // indirect
	23	25	github.com/golang-jwt/jwt/v5 v5.3.1 // indirect
@@ -26,14 +28,14 @@ require (
	26	28	github.com/gorilla/css v1.0.1 // indirect
	27	29	github.com/mattn/go-isatty v0.0.24 // indirect
	28	30	github.com/ncruces/go-strftime v1.1.0 // indirect
	29		github.com/philhofer/fwd v1.2.0 // indirect
		31	github.com/philhofer/fwd v1.2.1 // indirect
	30	32	github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect
	31		github.com/tinylib/msgp v1.6.4 // indirect
		33	github.com/tinylib/msgp v1.6.5 // indirect
	32	34	github.com/x448/float16 v0.8.4 // indirect
	33		golang.org/x/net v0.60.0 // indirect
		35	golang.org/x/net v0.61.0 // indirect
	34	36	golang.org/x/sys v0.49.0 // indirect
	35	37	golang.org/x/text v0.43.0 // indirect
	36		modernc.org/libc v1.79.0 // indirect
		38	modernc.org/libc v1.79.1 // indirect
	37	39	modernc.org/mathutil v1.7.1 // indirect
	38	40	modernc.org/memory v1.12.1 // indirect
	39	41	)