diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index e5b2ebc..e646ae8 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -16,7 +16,7 @@ jobs: env: SOURCE_DATE_EPOCH: "0" TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:ee940acbf1f58ebadb42d01434ce4609530bf1b52536afbd1eee66cd7123c5c9 - ARTIFACT_NAME: machine-driver-bundle-0.16.4-linux-amd64.tar.xz + ARTIFACT_NAME: machine-driver-bundle-0.16.5-linux-amd64.tar.xz steps: - name: Check out the reviewed source @@ -25,14 +25,14 @@ jobs: - name: Install the exact Go toolchain uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0 with: - go-version: 1.27.0 + go-version: 1.27.3 check-latest: false cache: false - name: Install the exact Python toolchain uses: actions/setup-python@5fda3b95a4ea91299a34e894583c3862153e4b97 # v7.0.0 with: - python-version: '3.14.6' + python-version: '3.14.9' check-latest: false - name: Prepare evidence directory diff --git a/README.md b/README.md index 56adf44..6d75a10 100644 --- a/README.md +++ b/README.md @@ -4,15 +4,15 @@ PastureStack is an independent community effort to preserve, audit, and moderniz This repository builds the Linux AMD64 machine-management bundle consumed by the PastureStack compatibility server. The current public GitHub Release is -[`v0.16.4`](https://github.com/PastureStack/machine-driver-bundle/releases/tag/v0.16.4), +[`v0.16.5`](https://github.com/PastureStack/machine-driver-bundle/releases/tag/v0.16.5), and the generated archive and both rebuilt executables use numeric version -`0.16.4` without a product or maintenance suffix. +`0.16.5` without a product or maintenance suffix. ## Reviewed inputs - Docker Machine is rebuilt from GitLab's maintained fork at upstream source tag `v0.16.2-gitlab.52`, commit `95d190cbe55757b4212b69d0a278151d1faaaf66`. That external tag is recorded only as an immutable source coordinate. - The compatibility provider is rebuilt from Equinix's final release `0.6.0`, commit `1579a8271d52e00760e38dd153d3935abc302915`, with the protocol-compatible binary name `docker-machine-driver-packet`. -- Both binaries are built with Go `1.27.0`. The zero-fuzz source patch migrates the linked cloud clients to maintained SDKs, including AWS SDK v2 and Azure Track 2 with managed disks; resulting `go.mod` and `go.sum` hashes are locked. +- Both binaries are built with Go `1.27.3`. The zero-fuzz source patch migrates the linked cloud clients to maintained SDKs, including AWS SDK v2 and Azure Track 2 with managed disks; resulting `go.mod` and `go.sum` hashes are locked. The official GitLab checksum manifest is verified with its release signature and the exact GitLab signing-key fingerprint before any source is built. Source archives, licenses, patched module files, and output binaries are independently SHA-256 pinned. @@ -41,7 +41,13 @@ make test Output: ```text -dist/artifacts/machine-driver-bundle-0.16.4-linux-amd64.tar.xz +dist/artifacts/machine-driver-bundle-0.16.5-linux-amd64.tar.xz ``` Artifacts built directly from a checkout are review candidates. A GitHub Release, when present, is the reviewed distribution and its package is covered by GitHub Artifact Attestation generated from the protected default branch. Catalog changes, container-registry changes, and deployment remain intentionally excluded from this workflow. + +## October 2026 security maintenance + +The source patches select `golang.org/x/net v0.60.0` and its required x/crypto, x/sys, x/term, and x/text updates. The patched module manifests and sums remain checksum-locked; CI rebuilds and checks the exact binaries before release. + +Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Python tooling uses the patched pip/CA path; CI interpreter pins remain on the Python 3.14 series. Release artifacts must pass the repository's existing checks before publication. diff --git a/THIRD-PARTY-NOTICES.txt b/THIRD-PARTY-NOTICES.txt index 5ab3a79..c6b9928 100644 --- a/THIRD-PARTY-NOTICES.txt +++ b/THIRD-PARTY-NOTICES.txt @@ -1,6 +1,6 @@ Machine Driver Bundle contains code rebuilt from these upstream projects: -1. Go standard library 1.27.0 +1. Go standard library 1.27.3 License: BSD 3-Clause License Source: https://go.dev/ diff --git a/patches/docker-machine-grpc-security.patch b/patches/docker-machine-grpc-security.patch new file mode 100644 index 0000000..36eda96 --- /dev/null +++ b/patches/docker-machine-grpc-security.patch @@ -0,0 +1,27 @@ +diff --git a/go.mod b/go.mod +index c8790bc..8d1c379 100644 +--- a/go.mod ++++ b/go.mod +@@ -99,6 +99,6 @@ require ( + golang.org/x/text v0.42.0 // indirect + golang.org/x/time v0.15.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea // indirect +- google.golang.org/grpc v1.83.1 // indirect ++ google.golang.org/grpc v1.83.2 // indirect + google.golang.org/protobuf v1.36.12 // indirect + ) +diff --git a/go.sum b/go.sum +index 4fe372e..a513b5e 100644 +--- a/go.sum ++++ b/go.sum +@@ -345,8 +345,8 @@ google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7 h1: + google.golang.org/genproto/googleapis/api v0.0.0-20260630182238-925bb5da69e7/go.mod h1:KqHwBx2upmfa1XSi1WuRvC+2VGCLtooKkfmyvRbUmqA= + google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea h1:kVhQEPTpKQahD5+JSBTfBB19wcgQTTjAIn45MBqnyHk= + google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +-google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= +-google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= ++google.golang.org/grpc v1.83.2 h1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU= ++google.golang.org/grpc v1.83.2/go.mod h1:YPI1hK3kDked6iHvgX3tR0y+nX/qpMFKhPgFsokw1S8= + google.golang.org/protobuf v1.26.0-rc.1/go.mod h1:jlhhOSvTdKEhbULTjvd4ARK9grFBp09yW+WbY/TyQbw= + google.golang.org/protobuf v1.26.0/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= + google.golang.org/protobuf v1.27.1/go.mod h1:9q0QmTI4eRPtz6boOQmLYwt+qCgq0jsYwAQnmE0givc= diff --git a/patches/docker-machine-http2.patch b/patches/docker-machine-http2.patch new file mode 100644 index 0000000..8b73f1c --- /dev/null +++ b/patches/docker-machine-http2.patch @@ -0,0 +1,92 @@ +diff --git a/go.mod b/go.mod +index 1f18684..c8790bc 100644 +--- a/go.mod ++++ b/go.mod +@@ -30,11 +30,11 @@ require ( + github.com/urfave/cli v1.22.17 + github.com/vmware/govcloudair v0.0.2 + github.com/vmware/govmomi v0.56.0 +- golang.org/x/crypto v0.55.0 +- golang.org/x/net v0.58.0 ++ golang.org/x/crypto v0.57.0 ++ golang.org/x/net v0.60.0 + golang.org/x/oauth2 v0.36.0 +- golang.org/x/sys v0.47.0 +- golang.org/x/term v0.45.0 ++ golang.org/x/sys v0.48.0 ++ golang.org/x/term v0.46.0 + google.golang.org/api v0.293.0 + ) + +@@ -95,8 +95,8 @@ require ( + go.opentelemetry.io/otel/metric v1.45.0 // indirect + go.opentelemetry.io/otel/trace v1.45.0 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect +- golang.org/x/sync v0.22.0 // indirect +- golang.org/x/text v0.41.0 // indirect ++ golang.org/x/sync v0.23.0 // indirect ++ golang.org/x/text v0.42.0 // indirect + golang.org/x/time v0.15.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea // indirect + google.golang.org/grpc v1.83.1 // indirect +diff --git a/go.sum b/go.sum +index d2fb282..4fe372e 100644 +--- a/go.sum ++++ b/go.sum +@@ -277,8 +277,8 @@ golang.org/x/crypto v0.0.0-20201217014255-9d1352758620/go.mod h1:jdWPYTVW3xRLrWP + golang.org/x/crypto v0.0.0-20210711020723-a769d52b0f97/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= + golang.org/x/crypto v0.0.0-20210817164053-32db794688a5/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= + golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= +-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= ++golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= ++golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= + golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= + golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +@@ -287,15 +287,15 @@ golang.org/x/net v0.0.0-20200822124328-c89045814202/go.mod h1:/O7V0waA8r7cgGh81R + golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= + golang.org/x/net v0.0.0-20210226172049-e18ecbb05110/go.mod h1:m0MpNAwzfU5UDzcl9v0D8zg8gWTRqZa9RBIspLL5mdg= + golang.org/x/net v0.0.0-20210913180222-943fd674d43e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= +-golang.org/x/net v0.58.0 h1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To= +-golang.org/x/net v0.58.0/go.mod h1:YwCddHnFlT7eLQqVprV19OnhLGtc5xOKgE0RyqgfWAU= ++golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= ++golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= + golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= + golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= + golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20200625203802-6e8e738ad208/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= ++golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= ++golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= + golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +@@ -310,19 +310,19 @@ golang.org/x/sys v0.0.0-20210806184541-e5e7981a1069/go.mod h1:oPkhp1MJrh7nUepCBc + golang.org/x/sys v0.0.0-20210927094055-39ccf1dd6fa6/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.0.0-20211103235746-7861aae1554b/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= +-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= ++golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= ++golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= + golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= + golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= +-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= ++golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= ++golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= + golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= + golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= + golang.org/x/text v0.3.6/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= + golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= +-golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +-golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= ++golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= ++golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= + golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= + golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= + golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= diff --git a/patches/packet-driver-http2.patch b/patches/packet-driver-http2.patch new file mode 100644 index 0000000..bb1c155 --- /dev/null +++ b/patches/packet-driver-http2.patch @@ -0,0 +1,43 @@ +diff --git a/go.mod b/go.mod +index 879ff0e..d82434c 100644 +--- a/go.mod ++++ b/go.mod +@@ -14,9 +14,9 @@ require ( + github.com/google/go-cmp v0.7.0 // indirect + go.yaml.in/yaml/v2 v2.4.4 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect +- golang.org/x/crypto v0.55.0 // indirect +- golang.org/x/sys v0.47.0 // indirect +- golang.org/x/term v0.45.0 // indirect ++ golang.org/x/crypto v0.57.0 // indirect ++ golang.org/x/sys v0.48.0 // indirect ++ golang.org/x/term v0.46.0 // indirect + gopkg.in/yaml.v2 v2.4.0 // indirect + ) + +diff --git a/go.sum b/go.sum +index 17ab13a..bab3754 100644 +--- a/go.sum ++++ b/go.sum +@@ -25,15 +25,15 @@ go.yaml.in/yaml/v3 v3.0.5 h1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw= + go.yaml.in/yaml/v3 v3.0.5/go.mod h1:HVTZu1O7/Vkt2N+BFy8Zza+lnLsABggaTM2ZpNIGuKg= + golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= + golang.org/x/crypto v0.0.0-20200420201142-3c4aac89819a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= +-golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +-golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= ++golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= ++golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0= +-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w= ++golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= ++golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= ++golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= ++golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= + golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= + gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/provider-lifecycle.json b/provider-lifecycle.json index d5a2ae2..80740a0 100644 --- a/provider-lifecycle.json +++ b/provider-lifecycle.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "bundleVersion": "0.16.4", + "bundleVersion": "0.16.5", "machineTool": { "sourceTag": "v0.16.2-gitlab.52", "sourceCommit": "95d190cbe55757b4212b69d0a278151d1faaaf66", diff --git a/scripts/build-binaries b/scripts/build-binaries index f659c12..432ffc0 100755 --- a/scripts/build-binaries +++ b/scripts/build-binaries @@ -60,6 +60,7 @@ export GOFLAGS="-mod=readonly -p=$go_parallelism" ) chmod 0755 "$machine_binary" "$packet_binary" +sha256sum "$machine_binary" "$packet_binary" printf '%s %s\n' "$DOCKER_MACHINE_BINARY_SHA256" "$machine_binary" | sha256sum -c - >/dev/null printf '%s %s\n' "$PACKET_DRIVER_BINARY_SHA256" "$packet_binary" | sha256sum -c - >/dev/null diff --git a/scripts/prepare-sources b/scripts/prepare-sources index 4276d99..db6a6d0 100755 --- a/scripts/prepare-sources +++ b/scripts/prepare-sources @@ -132,6 +132,12 @@ patch --batch --forward --fuzz=0 --reject-file=- \ -d "$destination/source" -p1 <"$repo_root/patches/docker-machine-go-security.patch" patch --batch --forward --fuzz=0 --reject-file=- \ -d "$destination/packet-source" -p1 <"$repo_root/patches/packet-driver-go-security.patch" +patch --batch --forward --fuzz=0 --reject-file=- \ + -d "$destination/source" -p1 <"$repo_root/patches/docker-machine-http2.patch" +patch --batch --forward --fuzz=0 --reject-file=- \ + -d "$destination/source" -p1 <"$repo_root/patches/docker-machine-grpc-security.patch" +patch --batch --forward --fuzz=0 --reject-file=- \ + -d "$destination/packet-source" -p1 <"$repo_root/patches/packet-driver-http2.patch" printf '%s %s\n' "$DOCKER_MACHINE_LICENSE_SHA256" \ "$destination/source/LICENSE" | sha256sum -c - >/dev/null diff --git a/scripts/verify-govulncheck.py b/scripts/verify-govulncheck.py index 1c13742..8a7bcd9 100755 --- a/scripts/verify-govulncheck.py +++ b/scripts/verify-govulncheck.py @@ -9,14 +9,14 @@ from typing import Any -CRYPTO_PURL = "pkg:golang/golang.org/x/crypto@v0.55.0" +CRYPTO_PURL = "pkg:golang/golang.org/x/crypto@v0.57.0" EXPECTED_VEX = { ("GO-2026-5932", CRYPTO_PURL), } EXPECTED_MODULE_ONLY = { - ("GO-2026-5932", "golang.org/x/crypto", "v0.55.0"), + ("GO-2026-5932", "golang.org/x/crypto", "v0.57.0"), } @@ -63,7 +63,7 @@ def analyze_scan(path: Path) -> tuple[set[str], set[tuple[str, str, str]], dict[ sboms = [message["SBOM"] for message in messages if "SBOM" in message] assert len(sboms) == 1 - assert sboms[0]["go_version"] == "go1.27.0" + assert sboms[0]["go_version"] == "go1.27.3" reachable: set[str] = set() module_only: set[tuple[str, str, str]] = set() diff --git a/security/openvex.json b/security/openvex.json index 9278bd7..3c883fe 100644 --- a/security/openvex.json +++ b/security/openvex.json @@ -1,13 +1,13 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://github.com/PastureStack/machine-driver-bundle/security/openvex/0.16.4", + "@id": "https://github.com/PastureStack/machine-driver-bundle/security/openvex/0.16.5", "author": "PastureStack Security", "timestamp": "2026-08-25T08:00:00Z", "version": 1, "statements": [ { "vulnerability": {"name": "GO-2026-5932"}, - "products": [{"@id": "pkg:golang/golang.org/x/crypto@v0.55.0"}], + "products": [{"@id": "pkg:golang/golang.org/x/crypto@v0.57.0"}], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Source-mode govulncheck reports no reachable package or function, and neither command imports the unmaintained OpenPGP package." diff --git a/sources.lock.env b/sources.lock.env index e25834d..96d52d0 100644 --- a/sources.lock.env +++ b/sources.lock.env @@ -1,10 +1,10 @@ -BUNDLE_VERSION=0.16.4 +BUNDLE_VERSION=0.16.5 TARGET_PLATFORM=linux-amd64 -GO_VERSION=1.27.0 -PYTHON_VERSION=3.14.6 -GO_LICENSE_URL=https://raw.githubusercontent.com/golang/go/go1.27.0/LICENSE +GO_VERSION=1.27.3 +PYTHON_VERSION=3.14.9 +GO_LICENSE_URL=https://raw.githubusercontent.com/golang/go/go1.27.3/LICENSE GO_LICENSE_SHA256=911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad -DEPENDENCY_LICENSES_SHA256=70e99c6fc2288f06b6dac8eaa918ac9197d28db9294c1fb91cbfb70b4cf315b8 +DEPENDENCY_LICENSES_SHA256=db5b08bd79ea7037b2c142fa230e88b9b36be3df3a9d574d5def698b2f61fe85 DOCKER_MACHINE_UPSTREAM_TAG=v0.16.2-gitlab.52 DOCKER_MACHINE_UPSTREAM_COMMIT=95d190cbe55757b4212b69d0a278151d1faaaf66 @@ -13,9 +13,9 @@ DOCKER_MACHINE_SOURCE_ROOT=docker-machine-v0.16.2-gitlab.52 DOCKER_MACHINE_SOURCE_URL=https://gitlab.com/gitlab-org/ci-cd/docker-machine/-/archive/v0.16.2-gitlab.52/docker-machine-v0.16.2-gitlab.52.tar.gz DOCKER_MACHINE_SOURCE_SHA256=5f15a2cbfc2b426cbd89b9911e65cba2eacfd19670984001e796c3a8b45cb03c DOCKER_MACHINE_LICENSE_SHA256=552a739c3b25792263f731542238b92f6f8d07e9a488eae27e6c4690038a8243 -DOCKER_MACHINE_PATCHED_GO_MOD_SHA256=5065882479d29bdf3da76b55e7b1d9455daac3332ac493272371578557dadfeb -DOCKER_MACHINE_PATCHED_GO_SUM_SHA256=c2f63e70424dd23644b4ca26d66a3b92d672d7f18be601aa20f9b94d108625a0 -DOCKER_MACHINE_BINARY_SHA256=b6e86e745dfaefdb0bf09296c68c07a6176fcda2332b3d0c4bc2a345efd8bc47 +DOCKER_MACHINE_PATCHED_GO_MOD_SHA256=e5034669f69589037b75e48756460b95e17253024388df7c6d038a34de6fa345 +DOCKER_MACHINE_PATCHED_GO_SUM_SHA256=802c79aafde4950028937fe651732599dcdea4a417046d3be8e18612afe32dc6 +DOCKER_MACHINE_BINARY_SHA256=9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31 GITLAB_RELEASE_CHECKSUM_URL=https://gitlab-docker-machine-downloads.s3.amazonaws.com/v0.16.2-gitlab.52/release.sha256 GITLAB_RELEASE_CHECKSUM_SHA256=0de7557542a176b42e5a89a0b0e931781db805b3a1f819a0640dac00d4f749f2 @@ -33,9 +33,9 @@ PACKET_DRIVER_SOURCE_ROOT=docker-machine-driver-metal-0.6.0 PACKET_DRIVER_SOURCE_URL=https://github.com/equinix/docker-machine-driver-metal/archive/refs/tags/v0.6.0.tar.gz PACKET_DRIVER_SOURCE_SHA256=da2e123f98e2f19cfd31f03dbfc29a84fe6b00c5a61187dae4a8aa31f449f6d9 PACKET_DRIVER_LICENSE_SHA256=d9ee35ce0e43fbd281cb7a2fe4825867f12a2bf2949c177ecdf41816fea87aba -PACKET_DRIVER_PATCHED_GO_MOD_SHA256=373e93c7afae0eb859bd20d2df2166b25eaa5bce53b6f779a8534df203cc4682 -PACKET_DRIVER_PATCHED_GO_SUM_SHA256=ce3a184b0e777a6b49b2a337b0c6f4ead748a76355617f1ead370edfb9d8eaf4 -PACKET_DRIVER_BINARY_SHA256=34eace3dec088dc6992033211ee9fa22434279ab02e532356860a24291e91992 +PACKET_DRIVER_PATCHED_GO_MOD_SHA256=f90ccb3b10666151e3097b5cb8b509111ecae685b9877972a1a991009d10d9a0 +PACKET_DRIVER_PATCHED_GO_SUM_SHA256=d8cb6009843d90ae315b201c86aa1df46e647fe494ff02eeb44e963e4e2b7dae +PACKET_DRIVER_BINARY_SHA256=b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100 PACKET_DRIVER_STATUS=retired-compatibility-only PACKET_DRIVER_NEW_INSTALL_DEFAULT=false PACKET_SERVICE_END_DATE=2026-06-30