diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index ef33b14..d6beb19 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -16,7 +16,7 @@ jobs: env: SOURCE_DATE_EPOCH: "0" TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:ee940acbf1f58ebadb42d01434ce4609530bf1b52536afbd1eee66cd7123c5c9 - ARTIFACT_NAME: machine-driver-bundle-0.16.5-linux-amd64.tar.xz + ARTIFACT_NAME: machine-driver-bundle-0.16.6-linux-amd64.tar.xz steps: - name: Check out the reviewed source diff --git a/README.md b/README.md index 86d92fe..f61ca04 100644 --- a/README.md +++ b/README.md @@ -3,10 +3,10 @@ PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE. This repository builds the Linux AMD64 machine-management bundle consumed by -the PastureStack compatibility server. The current public GitHub Release is -[`v0.16.5`](https://github.com/PastureStack/machine-driver-bundle/releases/tag/v0.16.5), -and the generated archive and both rebuilt executables use numeric version -`0.16.5` without a product or maintenance suffix. +the PastureStack compatibility server. This source selects numeric version +`0.16.6` for the bundle and both rebuilt executables. Checkout builds are review +candidates; the matching [GitHub Release](https://github.com/PastureStack/machine-driver-bundle/releases/tag/v0.16.6) +is the immutable distribution after its protected-main release gate completes. ## Reviewed inputs @@ -41,14 +41,14 @@ make test Output: ```text -dist/artifacts/machine-driver-bundle-0.16.5-linux-amd64.tar.xz +dist/artifacts/machine-driver-bundle-0.16.6-linux-amd64.tar.xz ``` Artifacts built directly from a checkout are review candidates. A GitHub Release, when present, is the reviewed distribution and its package is covered by GitHub Artifact Attestation generated from the protected default branch. Catalog changes, container-registry changes, and deployment remain intentionally excluded from this workflow. ## October 2026 security maintenance -The source patches select `golang.org/x/net v0.60.0` and its required x/crypto, x/sys, x/term, and x/text updates. The patched module manifests and sums remain checksum-locked; CI rebuilds and checks the exact binaries before release. +The source patches select official `golang.org/x/net v0.62.0` and its required x/crypto, x/sys, x/term, x/text and x/sync updates. This fixes [CVE-2026-78661](https://pkg.go.dev/vuln/GO-2026-6860) and [CVE-2026-97045](https://pkg.go.dev/vuln/GO-2026-6866) in the HTML parser/renderer without changing Docker Machine transport or provider APIs. The patched module manifests and sums remain checksum-locked; CI rebuilds and checks the exact binaries before release. Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Python tooling uses the patched pip/CA path; CI interpreter pins remain on the Python 3.14 series. Release artifacts must pass the repository's existing checks before publication. @@ -59,5 +59,5 @@ finding with an official fix blocks release, regardless of severity. Unknown findings block unless a separately reviewed, exact not-affected statement is proved by the actual product dependency graph. LOW/MEDIUM findings without an official fix require the repository's exact CVE/package/version/PURL review ledger; -new or changed findings fail closed. This policy-only update does not replace any +new or changed findings fail closed. This new numeric release is qualified separately and does not replace any already published immutable artifact. diff --git a/patches/README.md b/patches/README.md index 62168cf..f4efe57 100644 --- a/patches/README.md +++ b/patches/README.md @@ -1,10 +1,12 @@ # Reviewed source patches -Both patches are applied with zero fuzz to immutable, SHA-256-pinned upstream source archives. +All patches are applied with zero fuzz to immutable, SHA-256-pinned upstream source archives. - `docker-machine-go-security.patch` replaces EOL cloud and Docker clients with their maintained APIs. Its reviewed runtime changes are limited to the CLI compatibility layer (including normalized string-slice RPC values), AWS EC2, Azure, Exoscale, vSphere, Docker client wiring, and the corresponding module locks and tests. - `packet-driver-go-security.patch` updates the retired provider's dependencies and replaces its machine library with the sibling, reviewed source tree used for the primary executable. The build verifies the resulting `go.mod` and `go.sum` files against fixed hashes before downloading modules. `scripts/validate` enforces an exact path boundary for the primary patch and keeps the retired provider patch limited to `go.mod` and `go.sum`. -The external source tags retain their upstream spelling for provenance. The PastureStack bundle and both rebuilt executables expose only the numeric candidate version `0.16.4`. +The external source tags retain their upstream spelling for provenance. The PastureStack bundle and both rebuilt executables expose only the numeric candidate version `0.16.6`. + +The `docker-machine-xnet062.patch` and `packet-driver-xnet062.patch` follow the existing security patches and only change `go.mod`/`go.sum`. They select official x/net 0.62.0 and the minimum Go module dependency closure for CVE-2026-78661 and CVE-2026-97045; provider and transport implementation code is unchanged. diff --git a/patches/docker-machine-xnet062.patch b/patches/docker-machine-xnet062.patch new file mode 100644 index 0000000..f386681 --- /dev/null +++ b/patches/docker-machine-xnet062.patch @@ -0,0 +1,84 @@ +diff --git a/go.mod b/go.mod +--- a/go.mod ++++ b/go.mod +@@ -30,11 +30,11 @@ + github.com/urfave/cli v1.22.17 + github.com/vmware/govcloudair v0.0.2 + github.com/vmware/govmomi v0.56.0 +- golang.org/x/crypto v0.57.0 +- golang.org/x/net v0.60.0 ++ golang.org/x/crypto v0.58.0 ++ golang.org/x/net v0.62.0 + golang.org/x/oauth2 v0.36.0 +- golang.org/x/sys v0.48.0 +- golang.org/x/term v0.46.0 ++ golang.org/x/sys v0.49.0 ++ golang.org/x/term v0.47.0 + google.golang.org/api v0.293.0 + ) + +@@ -95,8 +95,8 @@ + go.opentelemetry.io/otel/metric v1.45.0 // indirect + go.opentelemetry.io/otel/trace v1.45.0 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect +- golang.org/x/sync v0.23.0 // indirect +- golang.org/x/text v0.42.0 // indirect ++ golang.org/x/sync v0.24.0 // indirect ++ golang.org/x/text v0.43.0 // indirect + golang.org/x/time v0.15.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260807164820-c8921c73eeea // indirect + google.golang.org/grpc v1.83.2 // indirect +diff --git a/go.sum b/go.sum +--- a/go.sum ++++ b/go.sum +@@ -279,6 +279,8 @@ + golang.org/x/crypto v0.0.0-20210921155107-089bfa567519/go.mod h1:GvvjBRRGRdwPK5ydBHafDWAxML/pGHZbMvKqRZ5+Abc= + golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= + golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= ++golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= ++golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= + golang.org/x/mod v0.3.0/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= + golang.org/x/mod v0.4.1/go.mod h1:s0Qsj1ACt9ePp/hMypM3fl4fZqREWJwdYDEqhRiZZUA= + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= +@@ -289,6 +291,8 @@ + golang.org/x/net v0.0.0-20210913180222-943fd674d43e/go.mod h1:9nx3DQGgdP8bBQD5qxJ1jj9UTztislL4KSBs9R2vV5Y= + golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= + golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= ++golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= ++golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= + golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs= + golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q= + golang.org/x/sync v0.0.0-20190423024810-112230192c58/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= +@@ -296,6 +300,8 @@ + golang.org/x/sync v0.0.0-20201020160332-67f06af15bc9/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= + golang.org/x/sync v0.23.0 h1:KameEIfc1IkluZyXWLn39Wd4tURc6GbCiISGiZm2bQk= + golang.org/x/sync v0.23.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= ++golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= ++golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= + golang.org/x/sys v0.0.0-20191026070338-33540a1f6037/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= +@@ -312,10 +318,14 @@ + golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= + golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= + golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= ++golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= ++golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= + golang.org/x/term v0.0.0-20201117132131-f5c789dd3221/go.mod h1:Nr5EML6q2oocZ2LXRh80K7BxOlk5/8JxuGnuhpl+muw= + golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo= + golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= + golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= ++golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= ++golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= + golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= + golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= +@@ -323,6 +333,8 @@ + golang.org/x/text v0.3.7/go.mod h1:u+2+/6zg+i71rQMx5EYifcz6MCKuco9NR6JIITiCfzQ= + golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= + golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= ++golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= ++golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= + golang.org/x/time v0.0.0-20201208040808-7e3f01d25324/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= + golang.org/x/time v0.0.0-20210220033141-f8bda1e9f3ba/go.mod h1:tRJNPiyCQ0inRvYxbN9jk5I+vvW/OXSQhTDSoE431IQ= + golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U= diff --git a/patches/packet-driver-xnet062.patch b/patches/packet-driver-xnet062.patch new file mode 100644 index 0000000..88f5f8b --- /dev/null +++ b/patches/packet-driver-xnet062.patch @@ -0,0 +1,47 @@ +diff --git a/go.mod b/go.mod +--- a/go.mod ++++ b/go.mod +@@ -14,9 +14,10 @@ + github.com/google/go-cmp v0.7.0 // indirect + go.yaml.in/yaml/v2 v2.4.4 // indirect + go.yaml.in/yaml/v3 v3.0.5 // indirect +- golang.org/x/crypto v0.57.0 // indirect +- golang.org/x/sys v0.48.0 // indirect +- golang.org/x/term v0.46.0 // indirect ++ golang.org/x/crypto v0.58.0 // indirect ++ golang.org/x/net v0.62.0 // indirect ++ golang.org/x/sys v0.49.0 // indirect ++ golang.org/x/term v0.47.0 // indirect + gopkg.in/yaml.v2 v2.4.0 // indirect + ) + +diff --git a/go.sum b/go.sum +--- a/go.sum ++++ b/go.sum +@@ -27,14 +27,26 @@ + golang.org/x/crypto v0.0.0-20200420201142-3c4aac89819a/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= + golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= + golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= ++golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= ++golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= + golang.org/x/net v0.0.0-20190404232315-eb5bcb51f2a3/go.mod h1:t9HGtf8HONx5eT2rtn7q6eTqICYqUVnKs3thJo3Qplg= ++golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= ++golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= ++golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= ++golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= + golang.org/x/sys v0.0.0-20190215142949-d0b11bdaac8a/go.mod h1:STP8DvDyc/dI5b8T5hshtkjS+E42TnysNCUPdjciGhY= + golang.org/x/sys v0.0.0-20190412213103-97732733099d/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= + golang.org/x/sys v0.48.0 h1:bbX/i/6MgT9BVLM9RT1thmxL04yeTAhbEz4SyadbXoo= + golang.org/x/sys v0.48.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= ++golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= ++golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= + golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= + golang.org/x/term v0.46.0/go.mod h1:+K02xbkittuwc0Am4abfA3Fc+XRGXkvBXNO88NCXPoc= ++golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= ++golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= + golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= ++golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= ++golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= + golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= + gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= + gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI= diff --git a/provider-lifecycle.json b/provider-lifecycle.json index 80740a0..5d72544 100644 --- a/provider-lifecycle.json +++ b/provider-lifecycle.json @@ -1,6 +1,6 @@ { "schemaVersion": 1, - "bundleVersion": "0.16.5", + "bundleVersion": "0.16.6", "machineTool": { "sourceTag": "v0.16.2-gitlab.52", "sourceCommit": "95d190cbe55757b4212b69d0a278151d1faaaf66", diff --git a/scripts/build-binaries b/scripts/build-binaries index 432ffc0..1e8f6c8 100755 --- a/scripts/build-binaries +++ b/scripts/build-binaries @@ -60,6 +60,26 @@ export GOFLAGS="-mod=readonly -p=$go_parallelism" ) chmod 0755 "$machine_binary" "$packet_binary" +if [ "${GITHUB_ACTIONS:-}" = true ] && { + [ "$(sha256sum "$machine_binary" | awk '{print $1}')" != "$DOCKER_MACHINE_BINARY_SHA256" ] || + [ "$(sha256sum "$packet_binary" | awk '{print $1}')" != "$PACKET_DRIVER_BINARY_SHA256" ]; +}; then + # Preserve qualification bytes; the checksum gates below still reject them. + qualification="$repo_root/evidence/hash-qualification" + mkdir -p "$qualification" + install -m 0755 "$machine_binary" "$qualification/docker-machine" + install -m 0755 "$packet_binary" "$qualification/docker-machine-driver-packet" + python3 "$repo_root/scripts/collect-licenses.py" \ + --machine-source "$machine_source" --packet-source "$packet_source" \ + --machine-binary "$machine_binary" --packet-binary "$packet_binary" \ + > "$qualification/machine-driver-bundle-DEPENDENCY-LICENSES.txt" + cp "$machine_source/go.mod" "$qualification/docker-machine.go.mod" + cp "$machine_source/go.sum" "$qualification/docker-machine.go.sum" + cp "$packet_source/go.mod" "$qualification/packet-driver.go.mod" + cp "$packet_source/go.sum" "$qualification/packet-driver.go.sum" + (cd "$qualification" && sha256sum docker-machine docker-machine-driver-packet \ + machine-driver-bundle-DEPENDENCY-LICENSES.txt > SHA256SUMS) +fi sha256sum "$machine_binary" "$packet_binary" printf '%s %s\n' "$DOCKER_MACHINE_BINARY_SHA256" "$machine_binary" | sha256sum -c - >/dev/null printf '%s %s\n' "$PACKET_DRIVER_BINARY_SHA256" "$packet_binary" | sha256sum -c - >/dev/null diff --git a/scripts/prepare-sources b/scripts/prepare-sources index db6a6d0..e3d9cc4 100755 --- a/scripts/prepare-sources +++ b/scripts/prepare-sources @@ -138,6 +138,10 @@ patch --batch --forward --fuzz=0 --reject-file=- \ -d "$destination/source" -p1 <"$repo_root/patches/docker-machine-grpc-security.patch" patch --batch --forward --fuzz=0 --reject-file=- \ -d "$destination/packet-source" -p1 <"$repo_root/patches/packet-driver-http2.patch" +patch --batch --forward --fuzz=0 --reject-file=- \ + -d "$destination/source" -p1 <"$repo_root/patches/docker-machine-xnet062.patch" +patch --batch --forward --fuzz=0 --reject-file=- \ + -d "$destination/packet-source" -p1 <"$repo_root/patches/packet-driver-xnet062.patch" printf '%s %s\n' "$DOCKER_MACHINE_LICENSE_SHA256" \ "$destination/source/LICENSE" | sha256sum -c - >/dev/null diff --git a/scripts/validate b/scripts/validate index 0466e72..c87deba 100755 --- a/scripts/validate +++ b/scripts/validate @@ -73,6 +73,12 @@ text = open(packet_patch, encoding="utf-8").read() files = re.findall(r"^diff --git a/(\S+) b/(\S+)$", text, re.MULTILINE) assert files, packet_patch assert all(left in {"go.mod", "go.sum"} and right == left for left, right in files), packet_patch + +for name in ("docker-machine-xnet062.patch", "packet-driver-xnet062.patch"): + path = __import__("pathlib").Path(machine_patch).with_name(name) + text = path.read_text(encoding="utf-8") + files = re.findall(r"^diff --git a/(\S+) b/(\S+)$", text, re.MULTILINE) + assert files and all(left in {"go.mod", "go.sum"} and right == left for left, right in files), path PY python3 - "$repo_root/scripts/collect-licenses.py" <<'PY' diff --git a/scripts/verify-govulncheck.py b/scripts/verify-govulncheck.py index 8a7bcd9..2400127 100755 --- a/scripts/verify-govulncheck.py +++ b/scripts/verify-govulncheck.py @@ -9,14 +9,14 @@ from typing import Any -CRYPTO_PURL = "pkg:golang/golang.org/x/crypto@v0.57.0" +CRYPTO_PURL = "pkg:golang/golang.org/x/crypto@v0.58.0" EXPECTED_VEX = { ("GO-2026-5932", CRYPTO_PURL), } EXPECTED_MODULE_ONLY = { - ("GO-2026-5932", "golang.org/x/crypto", "v0.57.0"), + ("GO-2026-5932", "golang.org/x/crypto", "v0.58.0"), } diff --git a/security/openvex.json b/security/openvex.json index 3c883fe..c61c149 100644 --- a/security/openvex.json +++ b/security/openvex.json @@ -1,13 +1,19 @@ { "@context": "https://openvex.dev/ns/v0.2.0", - "@id": "https://github.com/PastureStack/machine-driver-bundle/security/openvex/0.16.5", + "@id": "https://github.com/PastureStack/machine-driver-bundle/security/openvex/0.16.6", "author": "PastureStack Security", - "timestamp": "2026-08-25T08:00:00Z", - "version": 1, + "timestamp": "2026-10-29T10:37:19.322581+00:00", + "version": 2, "statements": [ { - "vulnerability": {"name": "GO-2026-5932"}, - "products": [{"@id": "pkg:golang/golang.org/x/crypto@v0.57.0"}], + "vulnerability": { + "name": "GO-2026-5932" + }, + "products": [ + { + "@id": "pkg:golang/golang.org/x/crypto@v0.58.0" + } + ], "status": "not_affected", "justification": "vulnerable_code_not_present", "impact_statement": "Source-mode govulncheck reports no reachable package or function, and neither command imports the unmaintained OpenPGP package." diff --git a/sources.lock.env b/sources.lock.env index 96d52d0..b435733 100644 --- a/sources.lock.env +++ b/sources.lock.env @@ -1,10 +1,10 @@ -BUNDLE_VERSION=0.16.5 +BUNDLE_VERSION=0.16.6 TARGET_PLATFORM=linux-amd64 GO_VERSION=1.27.3 PYTHON_VERSION=3.14.9 GO_LICENSE_URL=https://raw.githubusercontent.com/golang/go/go1.27.3/LICENSE GO_LICENSE_SHA256=911f8f5782931320f5b8d1160a76365b83aea6447ee6c04fa6d5591467db9dad -DEPENDENCY_LICENSES_SHA256=db5b08bd79ea7037b2c142fa230e88b9b36be3df3a9d574d5def698b2f61fe85 +DEPENDENCY_LICENSES_SHA256=05c8798b06f89622680226cb74296039ec34cc42037c7460b4afd2f202e09526 DOCKER_MACHINE_UPSTREAM_TAG=v0.16.2-gitlab.52 DOCKER_MACHINE_UPSTREAM_COMMIT=95d190cbe55757b4212b69d0a278151d1faaaf66 @@ -13,9 +13,9 @@ DOCKER_MACHINE_SOURCE_ROOT=docker-machine-v0.16.2-gitlab.52 DOCKER_MACHINE_SOURCE_URL=https://gitlab.com/gitlab-org/ci-cd/docker-machine/-/archive/v0.16.2-gitlab.52/docker-machine-v0.16.2-gitlab.52.tar.gz DOCKER_MACHINE_SOURCE_SHA256=5f15a2cbfc2b426cbd89b9911e65cba2eacfd19670984001e796c3a8b45cb03c DOCKER_MACHINE_LICENSE_SHA256=552a739c3b25792263f731542238b92f6f8d07e9a488eae27e6c4690038a8243 -DOCKER_MACHINE_PATCHED_GO_MOD_SHA256=e5034669f69589037b75e48756460b95e17253024388df7c6d038a34de6fa345 -DOCKER_MACHINE_PATCHED_GO_SUM_SHA256=802c79aafde4950028937fe651732599dcdea4a417046d3be8e18612afe32dc6 -DOCKER_MACHINE_BINARY_SHA256=9d379214de116542cb0e2b1a09c17409fd59fd2b0109428896d81de9cf9c0d31 +DOCKER_MACHINE_PATCHED_GO_MOD_SHA256=1429faf4024a6551318301f6fded8669dbfe98af73c94fd4e42fee1a23a9110d +DOCKER_MACHINE_PATCHED_GO_SUM_SHA256=b30760a2ac64cdf42cf9ac2c0e37b8d4dbfa1b5c4b270ebbf54bb054c46da202 +DOCKER_MACHINE_BINARY_SHA256=8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c GITLAB_RELEASE_CHECKSUM_URL=https://gitlab-docker-machine-downloads.s3.amazonaws.com/v0.16.2-gitlab.52/release.sha256 GITLAB_RELEASE_CHECKSUM_SHA256=0de7557542a176b42e5a89a0b0e931781db805b3a1f819a0640dac00d4f749f2 @@ -33,9 +33,9 @@ PACKET_DRIVER_SOURCE_ROOT=docker-machine-driver-metal-0.6.0 PACKET_DRIVER_SOURCE_URL=https://github.com/equinix/docker-machine-driver-metal/archive/refs/tags/v0.6.0.tar.gz PACKET_DRIVER_SOURCE_SHA256=da2e123f98e2f19cfd31f03dbfc29a84fe6b00c5a61187dae4a8aa31f449f6d9 PACKET_DRIVER_LICENSE_SHA256=d9ee35ce0e43fbd281cb7a2fe4825867f12a2bf2949c177ecdf41816fea87aba -PACKET_DRIVER_PATCHED_GO_MOD_SHA256=f90ccb3b10666151e3097b5cb8b509111ecae685b9877972a1a991009d10d9a0 -PACKET_DRIVER_PATCHED_GO_SUM_SHA256=d8cb6009843d90ae315b201c86aa1df46e647fe494ff02eeb44e963e4e2b7dae -PACKET_DRIVER_BINARY_SHA256=b3e5c71928fcebe1bb648f79ebbf38af9ad32d6f6dbb87587e1b92c6c331e100 +PACKET_DRIVER_PATCHED_GO_MOD_SHA256=cdd0fa2770995b1ea088694b2ddcc55e0165f6c4fecc724cd036138459e367c0 +PACKET_DRIVER_PATCHED_GO_SUM_SHA256=f9642e8aaf9e2ace763675b4f331b331baf0d1fdda230fece20628677d2fe1f9 +PACKET_DRIVER_BINARY_SHA256=a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79 PACKET_DRIVER_STATUS=retired-compatibility-only PACKET_DRIVER_NEW_INSTALL_DEFAULT=false PACKET_SERVICE_END_DATE=2026-06-30