From 4ee641bc1273cf582a77609af71d00b72f17b628 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Fri, 23 Oct 2026 20:00:20 +0800 Subject: [PATCH] build: refresh October security pins and trust stores --- .github/workflows/codeql-verification.yml | 2 +- .github/workflows/security-release-gate.yml | 4 ++-- .python-version | 2 +- README.md | 10 +++++++--- scripts/toolchain | 2 +- scripts/version | 2 +- 6 files changed, 13 insertions(+), 9 deletions(-) diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml index b736150..52557fa 100644 --- a/.github/workflows/codeql-verification.yml +++ b/.github/workflows/codeql-verification.yml @@ -67,7 +67,7 @@ jobs: shell: bash run: | set -euo pipefail - test "$(python3 --version)" = 'Python 3.14.6' + test "$(python3 --version)" = 'Python 3.14.9' - name: Initialize CodeQL uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8 diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 8858727..3a2c60f 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -20,7 +20,7 @@ jobs: runs-on: ubuntu-24.04 timeout-minutes: 60 env: - CANDIDATE_VERSION: 0.4.3 + CANDIDATE_VERSION: 0.4.4 TRIVY_IMAGE: aquasec/trivy:0.73.0@sha256:7cced7cae583819fc7806d4cbc0dbbc7cad18b99f7d3e235192e6da8c091045c TRIVY_CACHE: /tmp/pasturestack-usage-telemetry-trivy-cache steps: @@ -72,7 +72,7 @@ jobs: export VERSION_OVERRIDE="$CANDIDATE_VERSION" export COMMIT_OVERRIDE="$GITHUB_SHA" test "$(go env GOVERSION)" = 'go1.27.3' - test "$(python3 --version)" = 'Python 3.14.6' + test "$(python3 --version)" = 'Python 3.14.9' make validate make test make build diff --git a/.python-version b/.python-version index 3f0a10f..70c445e 100644 --- a/.python-version +++ b/.python-version @@ -1 +1 @@ -3.14.6 +3.14.9 diff --git a/README.md b/README.md index a055109..ed56ee0 100644 --- a/README.md +++ b/README.md @@ -10,7 +10,7 @@ PastureStack is an independent community effort to preserve, audit, and moderniz Published versions and immutable assets are listed in [GitHub Releases](https://github.com/PastureStack/usage-telemetry-agent/releases/latest). -The maintenance source builds `v0.4.3` with Go 1.27.3, including the +The maintenance source builds `v0.4.4` with Go 1.27.3, including the [crypto/x509 mitigation for CVE-2026-111943](https://pkg.go.dev/vuln/GO-2026-6809). Source identity, publication, and matching Server acceptance are separate checks. @@ -34,7 +34,7 @@ The later upstream cluster collector/server pipeline is intentionally not bundle ## Build and test Published tags and assets remain immutable. -On Linux with Go 1.27.3, Python 3.14.6, `bash`, `tar`, `xz`, and `curl`: +On Linux with Go 1.27.3, Python 3.14.9, `bash`, `tar`, `xz`, and `curl`: ```sh make validate @@ -45,10 +45,14 @@ make integration-test `scripts/check-content-policy` rejects local profile paths, private-network addresses, personal mailbox domains, non-English public text, and legacy names outside the documented legal/compatibility boundary. Maintainers can supply additional local-only literal checks through `PASTURESTACK_PRIVATE_PATTERN_FILE`; that file must remain outside the repository. -The runtime has no third-party Go module dependencies. `make package` produces the deterministic flat archive `usage-telemetry-agent-0.4.3-linux-amd64.tar.xz`. Use only the immutable asset from its matching published GitHub Release; a source version is not proof of publication. The matching Server release must verify that asset's SHA-256 digest before installation, not a previous release's checksum; operators do not need an artifact mirror. +The runtime has no third-party Go module dependencies. `make package` produces the deterministic flat archive `usage-telemetry-agent-0.4.4-linux-amd64.tar.xz`. Use only the immutable asset from its matching published GitHub Release; a source version is not proof of publication. The matching Server release must verify that asset's SHA-256 digest before installation, not a previous release's checksum; operators do not need an artifact mirror. See [COMPATIBILITY.md](COMPATIBILITY.md), [SECURITY.md](SECURITY.md), [ORIGIN.md](ORIGIN.md), [MODIFICATIONS.md](MODIFICATIONS.md), and [THIRD-PARTY-NOTICES.md](THIRD-PARTY-NOTICES.md). ## License and attribution The inherited project remains licensed under the [Apache License 2.0](LICENSE). Copyright and attribution for inherited work remain with their respective authors and contributors. PastureStack contributors claim authorship only for their own changes. + +## October 2026 security maintenance + +Maintained Go builds select the patched Go 1.27.3 compiler without raising the existing Go language requirement. Python tooling uses the patched pip/CA path; CI interpreter pins remain on the Python 3.14 series. Release artifacts must pass the repository's existing checks before publication. diff --git a/scripts/toolchain b/scripts/toolchain index 25cb4ba..30a5ba1 100755 --- a/scripts/toolchain +++ b/scripts/toolchain @@ -2,4 +2,4 @@ # Exact maintenance releases used by local and release verification. GO_VERSION=1.27.3 -PYTHON_VERSION=3.14.6 +PYTHON_VERSION=3.14.9 diff --git a/scripts/version b/scripts/version index 356ae42..742b99c 100755 --- a/scripts/version +++ b/scripts/version @@ -1,7 +1,7 @@ #!/usr/bin/env bash # PastureStack release identity for deterministic local and VM builds. -VERSION="${VERSION_OVERRIDE:-0.4.3}" +VERSION="${VERSION_OVERRIDE:-0.4.4}" if [[ -n "${COMMIT_OVERRIDE:-}" ]]; then COMMIT="${COMMIT_OVERRIDE}" else