fix: refresh IPsec compiler modules and trust store

.github/workflows/codeql-verification.yml

@@ -24,8 +24,8 @@ jobs:
       - name: Install verified Go toolchain
         shell: bash
         env:
-          GO_VERSION: 1.27.0
-          GO_LINUX_AMD64_SHA256: 675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
+          GO_VERSION: 1.27.3
+          GO_LINUX_AMD64_SHA256: 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
         run: |
           set -euo pipefail
           archive="go${GO_VERSION}.linux-amd64.tar.gz"
@@ -53,7 +53,7 @@ jobs:
           cd "$GITHUB_WORKSPACE"
           go test -run '^$' ./...
           go test -run '^$' -tags=integration ./store
-          VERSION_OVERRIDE=0.14.38 ./scripts/build
+          VERSION_OVERRIDE=0.14.39 ./scripts/build
 
       - name: Analyze without publishing temporary alerts
         uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8

.github/workflows/release.yml

@@ -1,6 +1,6 @@
 name: Release IPsec overlay
 
-# A release is dispatched from main only after an annotated v0.14.38 tag and
+# A release is dispatched from main only after an annotated v0.14.39 tag and
 # successful, same-commit Security release gate and CodeQL verification runs.
 # GHCR, registry attestations, and GitHub Releases are not an atomic transaction.
 # All source/product/runtime gates precede the image push. A later failure may
@@ -9,11 +9,11 @@ on:
   workflow_dispatch:
     inputs:
       release_tag:
-        description: Existing annotated, numeric v0.14.38 tag at main HEAD
+        description: Existing annotated, numeric v0.14.39 tag at main HEAD
         required: true
         type: choice
         options:
-          - v0.14.38
+          - v0.14.39
       security_run_id:
         description: Successful same-SHA Security release gate run ID
         required: true
@@ -35,7 +35,7 @@ permissions:
   attestations: write
 
 concurrency:
-  group: ipsec-vxlan-overlay-release-v0.14.38
+  group: ipsec-vxlan-overlay-release-v0.14.39
   cancel-in-progress: false
 
 jobs:
@@ -48,8 +48,8 @@ jobs:
       CODEQL_RUN_ID: ${{ inputs.codeql_run_id }}
       RESUME_DIGEST: ${{ inputs.resume_digest }}
       GH_TOKEN: ${{ github.token }}
-      SERVICE_IMAGE: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.38
-      LOCAL_IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.38
+      SERVICE_IMAGE: ghcr.io/pasturestack/ipsec-vxlan-overlay-network:v0.14.39
+      LOCAL_IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.39
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
       GOFLAGS: -mod=vendor
       GOWORK: off
@@ -67,7 +67,7 @@ jobs:
         run: |
           set -euo pipefail
           test "$GITHUB_REF" = refs/heads/main
-          test "$RELEASE_TAG" = v0.14.38
+          test "$RELEASE_TAG" = v0.14.39
           [[ "$RELEASE_TAG" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]
           [[ "$SECURITY_RUN_ID" =~ ^[0-9]+$ ]]
           [[ "$CODEQL_RUN_ID" =~ ^[0-9]+$ ]]
@@ -134,15 +134,15 @@ jobs:
               select(.Severity == "CRITICAL" or .Severity == "HIGH")] | length' "$report")" -eq 0
           done
 
-      - name: Install checksum-pinned Go 1.27.0
+      - name: Install checksum-pinned Go 1.27.3
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"
           curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
-            --output "$archive" 'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz'
+            --output "$archive" 'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz'
           printf '%s  %s\n' \
-            '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \
+            '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \
             "$archive" | sha256sum --check
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           printf '%s\n' "$RUNNER_TEMP/go/bin" >> "$GITHUB_PATH"
@@ -152,15 +152,15 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          VERSION_OVERRIDE=0.14.38 ./scripts/build
+          VERSION_OVERRIDE=0.14.39 ./scripts/build
           sha256sum --check evidence/product.sha256
           if [ -z "$RESUME_DIGEST" ]; then
-            VERSION_OVERRIDE=0.14.38 TAG=0.14.38 REPO=local/pasturestack \
+            VERSION_OVERRIDE=0.14.39 TAG=0.14.39 REPO=local/pasturestack \
               IMAGE_REVISION="$SOURCE_SHA" ./scripts/package
             test "$(wc -l < dist/images)" -eq 1
             grep -Fx "$LOCAL_IMAGE" dist/images
             test "$(docker image inspect "$LOCAL_IMAGE" \
-              --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.38
+              --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.39
             test "$(docker image inspect "$LOCAL_IMAGE" \
               --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SOURCE_SHA"
             docker tag "$LOCAL_IMAGE" "$SERVICE_IMAGE"
@@ -178,7 +178,7 @@ jobs:
             docker pull "$SERVICE_IMAGE@$RESUME_DIGEST"
             docker tag "$SERVICE_IMAGE@$RESUME_DIGEST" "$SERVICE_IMAGE"
             test "$(docker image inspect "$SERVICE_IMAGE" \
-              --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.38
+              --format '{{index .Config.Labels "org.opencontainers.image.version"}}')" = 0.14.39
             test "$(docker image inspect "$SERVICE_IMAGE" \
               --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')" = "$SOURCE_SHA"
             verification_container="$(docker create "$SERVICE_IMAGE")"
@@ -315,7 +315,7 @@ jobs:
         run: |
           set -euo pipefail
           release_dir="dist/release"
-          product_dir="$release_dir/ipsec-vxlan-overlay-network-0.14.38-linux-amd64"
+          product_dir="$release_dir/ipsec-vxlan-overlay-network-0.14.39-linux-amd64"
           mkdir -p "$product_dir"
           cp bin/ipsec-vxlan-overlay-network bin/ipsec-vxlan-overlay-topology bin/pasture-cni-resolver \
             LICENSE ORIGIN.md SECURITY.md THIRD_PARTY_NOTICES.md "$product_dir/"
@@ -327,11 +327,11 @@ jobs:
           find "$product_dir" -exec touch -h -d "@$source_epoch" {} +
           tar --sort=name --mtime="@$source_epoch" --owner=0 --group=0 \
             --numeric-owner -C "$release_dir" \
-            -cJf "$release_dir/ipsec-vxlan-overlay-network-0.14.38-linux-amd64.tar.xz" \
-            ipsec-vxlan-overlay-network-0.14.38-linux-amd64
+            -cJf "$release_dir/ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz" \
+            ipsec-vxlan-overlay-network-0.14.39-linux-amd64
           (
             cd "$release_dir"
-            sha256sum ipsec-vxlan-overlay-network-0.14.38-linux-amd64.tar.xz \
+            sha256sum ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz \
               source-sbom.cdx.json image-sbom.cdx.json product.sha256 \
               runtime-security.json gate-security-summary.txt image-digest.txt \
               release-identity.txt > SHA256SUMS
@@ -355,9 +355,9 @@ jobs:
         run: |
           set -euo pipefail
           gh release create "$RELEASE_TAG" --repo "$GITHUB_REPOSITORY" --verify-tag \
-            --title 'IPsec Overlay v0.14.38' \
+            --title 'IPsec Overlay v0.14.39' \
             --notes "Source ${SOURCE_SHA}; Security gate run ${SECURITY_RUN_ID}; CodeQL run ${CODEQL_RUN_ID}. GHCR image ${SERVICE_IMAGE}@$(cat dist/release/image-digest.txt | sed 's/^.*@//')." \
-            dist/release/ipsec-vxlan-overlay-network-0.14.38-linux-amd64.tar.xz \
+            dist/release/ipsec-vxlan-overlay-network-0.14.39-linux-amd64.tar.xz \
             dist/release/source-sbom.cdx.json \
             dist/release/image-sbom.cdx.json \
             dist/release/product.sha256 \

.github/workflows/security-release-gate.yml

@@ -1,6 +1,8 @@
 name: Security release gate
 
 on:
+  pull_request:
+    branches: [main]
   push:
     branches:
       - 'verification/ipsec-vxlan-overlay-network-*'
@@ -18,14 +20,14 @@ jobs:
     runs-on: ubuntu-24.04
     timeout-minutes: 120
     env:
-      CANDIDATE_VERSION: 0.14.38
-      VERSION_OVERRIDE: 0.14.38
-      TAG: 0.14.38
+      CANDIDATE_VERSION: 0.14.39
+      VERSION_OVERRIDE: 0.14.39
+      TAG: 0.14.39
       IMAGE_REVISION: ${{ github.sha }}
       REPO: local/pasturestack
-      IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.38
-      GO_VERSION: 1.27.0
-      GO_LINUX_AMD64_SHA256: 675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
+      IMAGE: local/pasturestack/ipsec-vxlan-overlay-network:0.14.39
+      GO_VERSION: 1.27.3
+      GO_LINUX_AMD64_SHA256: 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
       TRIVY_IMAGE: aquasec/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969
       TRIVY_CACHE: /tmp/pasturestack-ipsec-vxlan-overlay-trivy-cache
       GOFLAGS: '-mod=vendor'
@@ -136,7 +138,7 @@ jobs:
             /licenses/IPSEC-VXLAN-OVERLAY-RUNTIME-UBUNTU-APT-PACKAGES.tsv \
             > evidence/runtime-ubuntu-apt-packages.tsv
           docker run --rm --entrypoint docker "$dapper_image" --version \
-            | grep -F 'Docker version 29.8.0' \
+            | grep -F 'Docker version 29.9.2' \
             > evidence/docker-cli-version.txt
           printf 'DAPPER_IMAGE=%s\n' "$dapper_image" >> "$GITHUB_ENV"
 
@@ -226,7 +228,7 @@ jobs:
             --cache-dir /root/.cache/trivy --skip-db-update --offline-scan \
             --format cyclonedx --output /evidence/dapper-sbom.cdx.json /scan
 
-          dapper_purl='pkg:deb/ubuntu/linux-libc-dev@7.0.0-29.29?arch=amd64&distro=ubuntu-26.04'
+          dapper_purl='pkg:deb/ubuntu/linux-libc-dev@7.0.0-38.38?arch=amd64&distro=ubuntu-26.04'
           jq -r '
             .Results[]?.Vulnerabilities[]?
             | select(.Severity == "CRITICAL" or .Severity == "HIGH")
@@ -254,7 +256,7 @@ jobs:
             echo 'Unreviewed non-header vulnerability in Dapper tooling' >&2
             exit 1
           fi
-          grep -Fx $'linux-libc-dev:amd64\t7.0.0-29.29' \
+          grep -Fx $'linux-libc-dev:amd64\t7.0.0-38.38' \
             evidence/dapper-ubuntu-apt-packages.tsv >/dev/null
           if grep -Eq '^linux-(image|modules)([-:]|[[:space:]])' \
             evidence/dapper-ubuntu-apt-packages.tsv; then
@@ -281,7 +283,7 @@ jobs:
               impact_statement:$impact
             }] | {
               "@context":"https://openvex.dev/ns/v0.2.0",
-              "@id":"https://github.com/PastureStack/ipsec-vxlan-overlay-network/security/openvex/dapper/0.14.38",
+              "@id":"https://github.com/PastureStack/ipsec-vxlan-overlay-network/security/openvex/dapper/0.14.39",
               author:"PastureStack Security",
               timestamp:$timestamp,
               version:1,

.gitignore

@@ -12,3 +12,4 @@
 /package/per-host-subnet
 /package/mount-propagation
 /package/licenses
+__pycache__/

Dockerfile.dapper

@@ -1,16 +1,19 @@
 FROM ubuntu:26.04@sha256:2260313b31c8c011cd2eebe728008efac1b3982be73eb71348ea2648d2c0e09b
 
 COPY ubuntu-apt.lock /licenses/ubuntu-apt.lock
-ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2bd0e90 https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260601~26.04.1_all.deb /tmp/ca-certificates.deb
+COPY security/install-ubuntu-security-updates.sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh
+COPY security/ubuntu-security-packages.lock /usr/share/pasturestack/ubuntu-security-packages.lock
+
+ADD --checksum=sha256:5b6326f1932cfd7be57130561dc78192f09ed9f58bfbe6606ed0c50510c3b6cd https://archive.ubuntu.com/ubuntu/pool/main/c/ca-certificates/ca-certificates_20260816ubuntu0.26.04.1_all.deb /tmp/ca-certificates.deb
 ADD --checksum=sha256:44742b1e9c947ebb3b82215c13d968bd54e2e60bc42244af69301c5d057bb340 https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/libssl3t64_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-libssl3t64.deb
 ADD --checksum=sha256:588e7f17afb9263a348c9587330805fc856536402328bec1660ff3a95e61bb4c https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl.deb
 ADD --checksum=sha256:1b582b937a1f7a8f987da9e1bbfcc806faea714267631ce0fbbd352c924b7daf https://snapshot.ubuntu.com/ubuntu/20260930T000000Z/pool/main/o/openssl/openssl-provider-legacy_3.5.5-1ubuntu3.6_amd64.deb /tmp/pasturestack-openssl-provider-legacy.deb
 
 ARG DAPPER_HOST_ARCH=amd64
-ARG GO_VERSION=1.27.0
-ARG DOCKER_VERSION=29.8.0
-ARG GO_LINUX_AMD64_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
-ARG DOCKER_LINUX_AMD64_SHA256=cc21815cf1e2efed867dc9c8b96b46ffed8ea176ffab32b0aacb54726ded8f25
+ARG GO_VERSION=1.27.3
+ARG DOCKER_VERSION=29.9.2
+ARG GO_LINUX_AMD64_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
+ARG DOCKER_LINUX_AMD64_SHA256=9ac225999fd5e863f7694c728ef23d480616b1e5639328fa309befd4243d69eb
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV HOST_ARCH=${DAPPER_HOST_ARCH} ARCH=${DAPPER_HOST_ARCH}
@@ -34,7 +37,7 @@ RUN set -eux; \
         /tmp/pasturestack-libssl3t64.deb \
         /tmp/pasturestack-openssl.deb \
         /tmp/pasturestack-openssl-provider-legacy.deb \
-        ca-certificates="${UBUNTU_APT_CA_CERTIFICATES_VERSION}" \
+        /tmp/ca-certificates.deb \
         curl="${UBUNTU_APT_CURL_VERSION}" \
         file="${UBUNTU_APT_FILE_VERSION}" \
         gcc="${UBUNTU_APT_GCC_VERSION}" \
@@ -44,9 +47,12 @@ RUN set -eux; \
         make="${UBUNTU_APT_MAKE_VERSION}" \
         tar="${UBUNTU_APT_TAR_VERSION}" \
         xz-utils="${UBUNTU_APT_XZ_UTILS_VERSION}"; \
+    test "$(dpkg-query -W -f='${Version}' ca-certificates)" = "${UBUNTU_APT_CA_CERTIFICATES_VERSION}"; \
     for package in openssl libssl3t64 openssl-provider-legacy; do \
         test "$(dpkg-query -W -f='${Version}' "$package")" = "${UBUNTU_APT_OPENSSL_VERSION}"; \
     done; \
+    sh /usr/local/lib/pasturestack/install-ubuntu-security-updates.sh /usr/share/pasturestack/ubuntu-security-packages.lock /etc/ssl/certs/ca-certificates.crt; \
+    dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort > /usr/share/pasturestack/ubuntu-security-packages.tsv; \
     { printf 'snapshot\t%s\n' "${UBUNTU_APT_SNAPSHOT}"; dpkg-query -W -f='${binary:Package}\t${Version}\n' | LC_ALL=C sort; } \
         > /licenses/IPSEC-VXLAN-OVERLAY-DAPPER-UBUNTU-APT-PACKAGES.tsv; \
     rm -rf /var/lib/apt/lists/* && \

Makefile

@@ -3,7 +3,7 @@ TARGETS := $(shell ls scripts)
 
 DAPPER_IMAGE ?= pasturestack-overlay-network-dapper:ubuntu26
 DAPPER_HOST_ARCH ?= amd64
-DOCKER_VERSION ?= 29.8.0
+DOCKER_VERSION ?= 29.9.2
 DOCKER_BUILD_NETWORK ?= host
 DAPPER_SOURCE ?= /go/src/github.com/PastureStack/ipsec-vxlan-overlay-network
 

README.md

@@ -1,11 +1,26 @@
 # PastureStack IPsec/VXLAN Overlay Network
 
+Current source builds use Go 1.27.3 while the Go language minimum remains 1.26.0. The selected `golang.org/x/net` version is v0.60.0; its required `golang.org/x/sys` version is v0.48.0. Ubuntu 26.04 images install the checksum-pinned `ca-certificates` 20260816ubuntu0.26.04.1 package with only officially fixed, already-installed packages advanced by the reviewed security overlay. These source inputs take effect in newly built artifacts; existing published release coordinates below describe their original artifacts.
+
 This repository provides the privileged network data plane used by PastureStack. It contains IPsec and VXLAN overlay processes, connectivity checks, CNI runtime assets, and an audit-only topology planner.
 
 PastureStack is an independent community effort to preserve, audit, and modernize the Rancher 1.6 ecosystem. It is not affiliated with or endorsed by Rancher Labs or SUSE.
 
 ## Release status
 
+Candidate `v0.14.39` refreshes the compiler, effective Go dependencies,
+official Ubuntu security packages, and checksum-pinned companion binaries.
+The companions are metadata CNI IPAM `v0.2.8`, host-local CNI IPAM `v0.1.6`,
+flat CNI IPAM `v0.1.6`, mount propagation `v1.0.12`, and per-host subnet
+`v0.2.5`. The last is an official Go 1.27.3 rebuild whose Go implementation
+and tests are byte-identical to the historical `v0.2.8` prerelease companion;
+the numeric tag difference does not remove a runtime feature. The security
+APT overlay uses private index/cache paths and verifies that the original
+strongSwan source index remains readable. Networking, CLI/API, CNI, and
+firewall ownership contracts are unchanged. Candidate inputs are not proof
+of publication; require the final release's same-source checks, scan results,
+and immutable image digest before deployment.
+
 The prior `v0.14.27` source and image were published with manifest digest
 `sha256:917c4369ee22808c100dd890d17296fe341e0dda4b2ad2923050f4fca5c22386`
 and release SBOM/provenance attestations. On an isolated Ubuntu 26.04.1 / Docker 29.8 VM, that
@@ -203,3 +218,5 @@ bridge firewall must accept mark `0x1068/0x1068`. See
 The official upstream history and original copyright notices are preserved. See [ORIGIN.md](ORIGIN.md), [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md), and [LICENSE](LICENSE) before redistributing this source or its image.
 
 The repository source is licensed under Apache License 2.0. The runtime image also contains separately licensed operating-system packages, including strongSwan under GPL-2.0-or-later with the OpenSSL exception. Those components are not relicensed by PastureStack.
+
+Security micro-updates are constrained by `security/ubuntu-security-packages.lock` to the signed Ubuntu 26.04 snapshot of 2026-10-23; the general package snapshot remains unchanged. Builds record the resulting package versions in `/usr/share/pasturestack/ubuntu-security-packages.tsv`. Existing runtime and firewall contracts are unchanged.

THIRD_PARTY_NOTICES.md

@@ -8,11 +8,11 @@ PastureStack does not relicense third-party work. Copyright, license, and attrib
 | CNI reference plugins | 0.3.0 | [containernetworking/plugins](https://github.com/containernetworking/plugins) | Apache-2.0 |
 | CNI bridge compatibility binary | 0.7.2 | [rancher/rancher-cni-bridge](https://github.com/rancher/rancher-cni-bridge) | Apache-2.0 |
 | Weave router helper | r-v0.0.4 | [rancher-archives/weave](https://github.com/rancher-archives/weave) | Apache-2.0 |
-| Metadata CNI IPAM | 0.2.7 | [PastureStack/metadata-cni-ipam](https://github.com/PastureStack/metadata-cni-ipam) | Apache-2.0 |
-| Host-local CNI IPAM | 0.1.4 | [PastureStack/host-local-cni-ipam](https://github.com/PastureStack/host-local-cni-ipam) | Apache-2.0 |
-| Flat CNI IPAM | 0.1.4 | [PastureStack/flat-cni-ipam](https://github.com/PastureStack/flat-cni-ipam) | Apache-2.0 |
-| Per-host subnet | 0.2.8 | [PastureStack/per-host-subnet](https://github.com/PastureStack/per-host-subnet) | Apache-2.0 |
-| Mount propagation | 1.0.11 | [PastureStack/mount-propagation](https://github.com/PastureStack/mount-propagation) | Apache-2.0 |
+| Metadata CNI IPAM | 0.2.8 | [PastureStack/metadata-cni-ipam](https://github.com/PastureStack/metadata-cni-ipam) | Apache-2.0 |
+| Host-local CNI IPAM | 0.1.6 | [PastureStack/host-local-cni-ipam](https://github.com/PastureStack/host-local-cni-ipam) | Apache-2.0 |
+| Flat CNI IPAM | 0.1.6 | [PastureStack/flat-cni-ipam](https://github.com/PastureStack/flat-cni-ipam) | Apache-2.0 |
+| Per-host subnet | 0.2.5 | [PastureStack/per-host-subnet](https://github.com/PastureStack/per-host-subnet) | Apache-2.0 |
+| Mount propagation | 1.0.12 | [PastureStack/mount-propagation](https://github.com/PastureStack/mount-propagation) | Apache-2.0 |
 
 The reachable Go dependency graph is declared in [`go.mod`](go.mod), checksum-bound by [`go.sum`](go.sum), and materialized in the standard module-aware `vendor` tree. Unreachable historical test-server dependencies are not shipped.