Skip to content

Commit 01bf8a7

Browse files
chen21019chen21019
committed
Build CLI 0.6.19 with official Go and Docker CVE fixes
1 parent 4585336 commit 01bf8a7

8 files changed

Lines changed: 51 additions & 25 deletions

File tree

‎.github/workflows/security-release-gate.yml‎

Lines changed: 13 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -21,7 +21,7 @@ jobs:
2121
DAPPER_IMAGE: pasturestack/cli-dapper:${{ github.sha }}
2222
RUNTIME_IMAGE: pasturestack/cli-runtime:${{ github.sha }}
2323
TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
24-
VERSION_OVERRIDE: 0.6.18
24+
VERSION_OVERRIDE: 0.6.19
2525
CROSS: 'true'
2626
SKIP_IMAGE_BUILD: 'true'
2727

@@ -79,15 +79,15 @@ jobs:
7979
}
8080
8181
run_ci
82-
artifact="dist/artifacts/0.6.18/pasturestack-cli-linux-amd64-0.6.18.tar.gz"
82+
artifact="dist/artifacts/0.6.19/pasturestack-cli-linux-amd64-0.6.19.tar.gz"
8383
test -s "$artifact"
84-
find dist/artifacts/0.6.18 -type f -print0 \
84+
find dist/artifacts/0.6.19 -type f -print0 \
8585
| LC_ALL=C sort -z \
8686
| xargs -0 sha256sum > /tmp/first-artifacts.sha256
8787
8888
rm -rf bin build dist
8989
run_ci
90-
find dist/artifacts/0.6.18 -type f -print0 \
90+
find dist/artifacts/0.6.19 -type f -print0 \
9191
| LC_ALL=C sort -z \
9292
| xargs -0 sha256sum > /tmp/second-artifacts.sha256
9393
diff -u /tmp/first-artifacts.sha256 /tmp/second-artifacts.sha256
@@ -96,15 +96,19 @@ jobs:
9696
mkdir -p evidence/product
9797
tar -xzf "$artifact" -C evidence/product --strip-components=1
9898
test -x evidence/product/pasturestack
99-
evidence/product/pasturestack --version | grep -F '0.6.18' >/dev/null
100-
find dist/artifacts/0.6.18 -type f -print0 \
99+
evidence/product/pasturestack --version | grep -F '0.6.19' >/dev/null
100+
find dist/artifacts/0.6.19 -type f -print0 \
101101
| LC_ALL=C sort -z \
102102
| xargs -0 sha256sum > evidence/artifacts.sha256
103103
docker run --rm --entrypoint go \
104104
--volume "$PWD:/work:ro" \
105105
"$DAPPER_IMAGE" \
106106
version -m /work/evidence/product/pasturestack \
107107
> evidence/product-go-version.txt
108+
grep -Fx '/work/evidence/product/pasturestack: go1.27.3' evidence/product-go-version.txt
109+
docker run --rm --entrypoint go "$DAPPER_IMAGE" \
110+
version -m /usr/bin/docker > evidence/docker-cli-go-version.txt
111+
grep -Fx '/usr/bin/docker: go1.26.10' evidence/docker-cli-go-version.txt
108112
109113
- name: Build and smoke-test runtime image
110114
shell: bash
@@ -115,7 +119,7 @@ jobs:
115119
--tag "$RUNTIME_IMAGE" \
116120
--file package/Dockerfile \
117121
.
118-
docker run --rm "$RUNTIME_IMAGE" --version | grep -F '0.6.18' >/dev/null
122+
docker run --rm "$RUNTIME_IMAGE" --version | grep -F '0.6.19' >/dev/null
119123
120124
- name: Record resolved build inputs
121125
shell: bash
@@ -222,9 +226,9 @@ jobs:
222226
if: success()
223227
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
224228
with:
225-
name: cli-release-candidate-0.6.18-${{ github.sha }}
229+
name: cli-release-candidate-0.6.19-${{ github.sha }}
226230
path: |
227-
dist/artifacts/0.6.18/
231+
dist/artifacts/0.6.19/
228232
evidence/artifacts.sha256
229233
evidence/source-revision.txt
230234
evidence/source-tree.txt

‎Dockerfile.dapper‎

Lines changed: 6 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -4,12 +4,12 @@ COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
44
ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb
55

66
ARG DAPPER_HOST_ARCH=amd64
7-
ARG GO_VERSION=1.27.2
8-
ARG GO_SHA256_amd64=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
9-
ARG GO_SHA256_arm64=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8
10-
ARG DOCKER_VERSION=29.9.1
11-
ARG DOCKER_SHA256_amd64=c158ecc55adb3afb01bbd3539ed3b997d20c26dbdc418080506cc1bf5243ff57
12-
ARG DOCKER_SHA256_arm64=3e93cc6d1a686456a3b18eefdde26467a837a7a2b257af22e27cba1dbc1b2018
7+
ARG GO_VERSION=1.27.3
8+
ARG GO_SHA256_amd64=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
9+
ARG GO_SHA256_arm64=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49
10+
ARG DOCKER_VERSION=29.9.2
11+
ARG DOCKER_SHA256_amd64=9ac225999fd5e863f7694c728ef23d480616b1e5639328fa309befd4243d69eb
12+
ARG DOCKER_SHA256_arm64=873b3e0207857c3b2f28392fb922f3ea6efe37620c16d4d4aaf2fef409c90b73
1313

1414
ENV HOST_ARCH=${DAPPER_HOST_ARCH} \
1515
ARCH=${DAPPER_HOST_ARCH} \

‎RELEASE-0.6.19.md‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
# CLI 0.6.19
2+
3+
This compiler-only security maintenance release preserves CLI functionality,
4+
configuration aliases, API-key permissions, schema handling and Compose delegation.
5+
6+
- The CLI compiler is exact Go 1.27.3, including the
7+
[crypto/x509 fix for CVE-2026-111943](https://pkg.go.dev/vuln/GO-2026-6809).
8+
Both supported builder architectures retain checksum-pinned official Go archives.
9+
- The builder's official Docker CLI is 29.9.2 with Go 1.26.10, applying the
10+
[same upstream security fix](https://docs.docker.com/engine/release-notes/29/#2992).
11+
Architecture-specific archive bytes remain pinned; no vendored behavior is changed.
12+
- The existing four-scope source/product/builder/runtime gate, race tests,
13+
reproducibility checks, SBOMs and immutable publisher are retained. Critical/High,
14+
official available fixes, secrets and unregistered records still block release.
15+
Only exact, currently reviewed, officially unfixed Medium/Low records may be tracked.
16+
Builder header VEX is not an exemption for the runtime or a Go executable.
17+
18+
Publication requires the complete exact-main release gate and anonymous asset
19+
readback. The numeric archives retain Server-compatible platform-before-version
20+
names, including `pasturestack-cli-linux-amd64-0.6.19.tar.gz`. Original licenses and
21+
upstream attribution remain unchanged. A component release is not Server deployment
22+
or whole compatibility-matrix acceptance; previous tags and assets are not overwritten.

‎go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ module github.com/PastureStack/cli
22

33
go 1.26.0
44

5-
toolchain go1.27.2
5+
toolchain go1.27.3
66

77
require (
88
github.com/Microsoft/go-winio v0.6.2

‎scripts/check-pasturestack-source‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -50,10 +50,10 @@ printf '%s\n' "$module_packages" | grep -Fx 'github.com/go-viper/mapstructure/v2
5050
printf '%s\n' "$module_packages" | grep -Fx 'github.com/sirupsen/logrus v1.10.2' >/dev/null || fail logrus_version_mismatch
5151

5252
require_line go.mod 'go 1.26.0'
53-
require_line go.mod 'toolchain go1.27.2'
53+
require_line go.mod 'toolchain go1.27.3'
5454
require_line Dockerfile.dapper 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b'
55-
require_line Dockerfile.dapper 'ARG GO_VERSION=1.27.2'
56-
require_line Dockerfile.dapper 'ARG DOCKER_VERSION=29.9.1'
55+
require_line Dockerfile.dapper 'ARG GO_VERSION=1.27.3'
56+
require_line Dockerfile.dapper 'ARG DOCKER_VERSION=29.9.2'
5757
require_line Dockerfile.dapper ' GO111MODULE=on \'
5858
require_line Dockerfile.dapper ' GOFLAGS=-mod=vendor \'
5959
require_line package/Dockerfile 'FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b'

‎scripts/check-reproducible-artifacts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@
22
set -euo pipefail
33

44
repo=$(cd "$(dirname "$0")/.." && pwd)
5-
version=${VERSION_OVERRIDE:-0.6.18}
5+
version=${VERSION_OVERRIDE:-0.6.19}
66
: "${SOURCE_DATE_EPOCH:?SOURCE_DATE_EPOCH must be set to the authoritative commit epoch}"
77

88
workspace=$(mktemp -d)

‎scripts/publish-reviewed-release.py‎

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,5 @@
11
#!/usr/bin/env python3
2-
"""Publish only checked numeric CLI0.6.18 bytes from an exact successful main run.
2+
"""Publish only checked numeric CLI0.6.19 bytes from an exact successful main run.
33
44
Default --plan has no network activity. Explicit --execute requires normal
55
protected/signed merge, exact required checks, complete security/repro gate,
@@ -17,7 +17,7 @@
1717
import tempfile
1818
from urllib.request import Request, urlopen
1919

20-
REPO, VERSION, TAG = 'PastureStack/cli', '0.6.18', 'v0.6.18'
20+
REPO, VERSION, TAG = 'PastureStack/cli', '0.6.19', 'v0.6.19'
2121

2222

2323
def need(ok, code):
@@ -127,7 +127,7 @@ def main():
127127
not command('git', '-C', str(root), 'status', '--porcelain').stdout, 'CLEAN_EXACT_SOURCE_CHECKOUT')
128128
tree, merged_pr, workflow = checked_source(source, args.run_id)
129129
need(not api('git/matching-refs/tags/' + TAG), 'IMMUTABLE_TAG_ALREADY_EXISTS')
130-
with tempfile.TemporaryDirectory(prefix='pasturestack-cli018-release-') as temporary:
130+
with tempfile.TemporaryDirectory(prefix='pasturestack-cli019-release-') as temporary:
131131
staging = Path(temporary)
132132
candidate, evidence, assets = [staging / name for name in ('candidate', 'evidence', 'assets')]
133133
for directory in (candidate, evidence, assets): directory.mkdir()
@@ -157,7 +157,7 @@ def main():
157157
need(original.is_file(), 'SERVER_PLATFORM_ASSET_REQUIRED')
158158
for name in ('security-summary.json', 'source.cdx.json', 'product.cdx.json', 'runtime.cdx.json',
159159
'source-security.json', 'product-security.json', 'dapper-image-raw.json', 'runtime-image-security.json',
160-
'dapper-dpkg.tsv', 'runtime-dpkg.tsv', 'product-go-version.txt', 'source-locks.sha256',
160+
'dapper-dpkg.tsv', 'runtime-dpkg.tsv', 'product-go-version.txt', 'docker-cli-go-version.txt', 'source-locks.sha256',
161161
'vendor-pending.json', 'dapper.openvex.json', 'cli018-review-evidence.json'):
162162
shutil.copyfile(unique(evidence, name), assets / ('cli-' + name))
163163
binary_archive = assets / ('pasturestack-cli-linux-amd64-' + VERSION + '.tar.gz')

‎security/vendor-pending.json‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,6 @@
11
{
22
"schemaVersion": 1,
3-
"release": "0.6.18",
3+
"release": "0.6.19",
44
"generatedAt": "2026-10-15T03:53:56Z",
55
"policy": {
66
"allowedSeverities": [

0 commit comments

Comments
 (0)