DO NOT MERGE: OCPBUGS-103516: posix_fadvise variant for perfscale comparison #399
There are no files selected for viewing
| Original file line number | Diff line number | Diff line change |
|---|---|---|
|
|
@@ -102,4 +102,4 @@ require ( | |
| sigs.k8s.io/yaml v1.4.0 // indirect | ||
| ) | ||
|
|
||
| replace go.etcd.io/bbolt => github.com/hasbro17/bbolt v1.3.7-0.20260811212650-b0af58f3a325 | ||
|
There was a problem hiding this comment. 🔒 Security & Privacy | 🟠 Major | 🏗️ Heavy lift 🧩 Analysis chain🏁 Script executed: #!/usr/bin/env bash
set -euo pipefail
repo="hasbro17/bbolt"
module="github.com/${repo}"
version="v1.3.7-0.20260811212650-b0af58f3a325"
commit="b0af58f3a325"
curl -fsSL "https://api.github.com/repos/${repo}/commits/${commit}" |
jq -e --arg prefix "${commit}" '.sha | startswith($prefix)'
curl -fsSL "https://api.github.com/repos/${repo}/license?ref=${commit}" |
jq -r '.license.spdx_id // "UNKNOWN"'
curl -fsSL -X POST "https://api.osv.dev/v1/query" \
-H "content-type: application/json" \
-d "{\"package\":{\"name\":\"${module}\",\"ecosystem\":\"Go\"},\"version\":\"${version}\"}" |
jq '{vulnerabilities: [.vulns[]?.id]}'
while IFS= read -r file; do
rg -n -F "replace go.etcd.io/bbolt => ${module} ${version}" "$file"
done < <(fd -HI -t f '^go\.mod$')
while IFS= read -r file; do
rg -n -F "${module} ${version}" "$file"
done < <(fd -HI -t f '^go\.sum$')
fd -HI -t f |
rg '(^|/)(Makefile|.*\.(yaml|yml|sh|toml|json))$' |
while IFS= read -r file; do
rg -n -i 'sbom|cyclonedx|spdx|provenance|slsa|cosign|sigstore|attest' "$file" || true
doneRepository: openshift/etcd Length of output: 201 🏁 Script executed: #!/usr/bin/env bash
set -u
printf '%s\n' '--- replacement declarations ---'
for file in go.mod etcdutl/go.mod server/go.mod tests/go.mod; do
if [ -f "$file" ]; then
rg -n -C 2 'go\.etcd\.io/bbolt|github\.com/hasbro17/bbolt' "$file"
fi
done
printf '%s\n' '--- fork version in sums and module files ---'
rg -n -F 'github.com/hasbro17/bbolt' --glob 'go.sum' --glob 'go.mod' . || true
printf '%s\n' '--- dependency and release metadata files ---'
git ls-files | rg '(^|/)(go\.sum|Makefile|.*\.(yaml|yml|sh|toml|json))$' | sed -n '1,240p'
printf '%s\n' '--- supply-chain controls ---'
rg -n -i 'sbom|cyclonedx|spdx|provenance|slsa|cosign|sigstore|attest|license|osv|vulnerabilit' \
--glob 'Makefile' --glob '*.yaml' --glob '*.yml' --glob '*.sh' --glob '*.toml' --glob '*.json' . || trueRepository: openshift/etcd Length of output: 18225 🌐 Web query:
💡 Result: The GitHub repository hasbro17/bbolt is an unofficial fork of the bbolt key/value database [1]. The primary, authoritative repository for bbolt is etcd-io/bbolt [2][3][4]. The specific identifier v1.3.7-0.20260811212650-b0af58f3a325 is a pseudo-version string typically generated by the Go module system (Go Modules) [3]. This format indicates a dependency on a specific commit (b0af58f3a325) from the repository, dated August 11, 2026 [1][3]. Because hasbro17/bbolt is not the official repository, this version string likely reflects a user-specific fork or a dependency resolution quirk rather than an official release from the maintainers of the bbolt project [1][4]. The official bbolt project uses semantic versioning and is managed under the etcd-io organization [4]. As of August 2026, the latest official release for bbolt is v1.5.0 [4]. Users are strongly advised to use the official module path, go.etcd.io/bbolt, which points to the etcd-io/bbolt repository, to ensure they are using the maintained and stable version of the software [3]. Citations:
🌐 Web query:
💡 Result: The bbolt database project is licensed under the MIT License [1]. This is a permissive free software license that allows for broad use, modification, and distribution of the software [1]. Citations: 🌐 Web query:
💡 Result: The OSV (Open Source Vulnerabilities) database does not contain a specific entry for the fork github.com/hasbro17/bbolt [1]. However, the primary upstream library for bbolt, go.etcd.io/bbolt, has been associated with vulnerability GO-2026-4923 (also tracked as CVE-2026-33817) [2][3][4]. This vulnerability involves an index out-of-range panic when calling Bucket.Stats on a branch page with zero elements, typically caused by database corruption [4]. While this issue was patched in the official etcd-io/bbolt repository [4], it is important to verify if the hasbro17 fork has incorporated these or other upstream security patches, as independent forks may diverge from the official maintenance track [1]. Citations:
🏁 Script executed: #!/usr/bin/env bash
set -u
module='github.com/hasbro17/bbolt'
version='v1.3.7-0.20260811212650-b0af58f3a325'
encoded_module='github.com/hasbro17/bbolt'
printf '%s\n' '--- Go proxy metadata ---'
for suffix in info mod zip; do
url="https://proxy.golang.org/${encoded_module}/@v/${version}.${suffix}"
printf '%s\n' "$url"
curl -fsSL "$url" | if [ "$suffix" = zip ]; then wc -c; else sed -n '1,80p'; fi || true
done
printf '%s\n' '--- Go checksum database record ---'
curl -fsSL "https://sum.golang.org/lookup/${module}@${version}" | sed -n '1,120p' || true
printf '%s\n' '--- Fork source metadata at the pinned commit ---'
for path in LICENSE COPYING go.mod; do
url="https://raw.githubusercontent.com/hasbro17/bbolt/b0af58f3a325/${path}"
printf '%s\n' "$url"
curl -fsSL "$url" | sed -n '1,40p' || true
done
printf '%s\n' '--- BOM entries for bbolt ---'
for file in bill-of-materials.json bill-of-materials.override.json; do
if [ -f "$file" ]; then
printf '%s\n' "$file"
jq -r '.. | objects | select((tostring | test("bbolt"; "i"))) ' "$file" 2>/dev/null | sed -n '1,100p'
fi
done
printf '%s\n' '--- release and security workflow controls ---'
for file in .github/workflows/verify-released-assets.yaml .github/workflows/scorecards.yml .github/workflows/codeql-analysis.yml Makefile scripts/build-release.sh scripts/release.sh scripts/updatebom.sh; do
if [ -f "$file" ]; then
printf '%s\n' "--- $file"
rg -n -i -C 2 'sbom|cyclonedx|spdx|provenance|slsa|cosign|sigstore|attest|license|vulnerabil|bill-of-materials' "$file" || true
fi
doneRepository: openshift/etcd Length of output: 5198 🏁 Script executed: #!/usr/bin/env bash
set -u
python3 - <<'PY'
from pathlib import Path
import re
version = "v1.3.7-0.20260811212650-b0af58f3a325"
want = f"github.com/hasbro17/bbolt {version}"
files = ["go.sum", "etcdutl/go.sum", "server/go.sum", "tests/go.sum"]
for path in files:
text = Path(path).read_text()
matches = [line for line in text.splitlines()
if line.startswith(want + " ")]
print(f"{path}: {len(matches)} content checksum line(s)")
for line in matches:
print(" " + line)
mod_matches = [line for line in text.splitlines()
if line.startswith(want + "/go.mod ")]
print(f"{path}: {len(mod_matches)} go.mod checksum line(s)")
PYRepository: openshift/etcd Length of output: 922 🌐 Web query:
💡 Result: The repository hasbro17/bbolt is a fork of the popular embedded key/value database for Go [1][2]. The project is licensed under the MIT License, which is standard for the bbolt project [1][3]. The specific reference "b0af58f3a325" appears to be an abbreviated git commit hash associated with the bbolt codebase, though it does not map to a primary branch or tag in the main etcd-io/bbolt repository [2]. Projects like this often maintain fork-specific history, but the core license terms for bbolt projects remain consistent with the original MIT license created by Ben Johnson [4][5][1][2]. If you are inspecting this file from a raw GitHub URL, it is retrieving the MIT license text from that specific point in the repository's history [4][5]. For production or development purposes, it is recommended to use the actively maintained version at github.com/etcd-io/bbolt [2][3]. Citations:
Record the fork in the supply-chain manifest before merging. The four 📍 Affects 4 files
🤖 Prompt for AI AgentsSource: Path instructions |
||
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
🗄️ Data Integrity & Integration | 🟠 Major | 🏗️ Heavy lift
🧩 Analysis chain
🏁 Script executed:
Repository: openshift/etcd
Length of output: 254
🏁 Script executed:
Repository: openshift/etcd
Length of output: 2267
🏁 Script executed:
Repository: openshift/etcd
Length of output: 1676
🏁 Script executed:
Repository: openshift/etcd
Length of output: 396
🏁 Script executed:
Repository: openshift/etcd
Length of output: 2195
🏁 Script executed:
Repository: openshift/etcd
Length of output: 10033
🏁 Script executed:
Repository: openshift/etcd
Length of output: 909
🏁 Script executed:
Repository: openshift/etcd
Length of output: 2175
Document the fork provenance and validate the Linux mmap change.
The fork matches upstream
go.etcd.io/bbolt v1.4.3except for themmapadvice files. Run theetcdutlandservertests, plus Linux compaction, recovery, and performance checks. Document the need for this fork and provide provenance, SBOM, and artifact-signing evidence.go.sumpins the content, the fork uses the MIT license, and OSV reports no advisories.📍 Affects 2 files
etcdutl/go.mod#L98-L98(this comment)server/go.mod#L94-L94🤖 Prompt for AI Agents