From 581467ba100ddbb2025a71a76fc205a9f484c683 Mon Sep 17 00:00:00 2001 From: Gustavo Ocanto Date: Fri, 23 Oct 2026 12:15:15 +0800 Subject: [PATCH] security - patch Go, CA and x/text/x/image advisories (23 Oct 2026) Move Go 1.26.3 to 1.26.10 and rebuild the Alpine base images on the refreshed digests that carry ca-certificates 20261020-r0 (eMudhra CA, CVE-2026-111943). Refresh the APK pins and checksums the base images need, the postgres:18.4-alpine test digest, and bump golang.org/x/text to v0.41.0 and golang.org/x/image to v0.45.0 for the reachable high advisories govulncheck reports. --- .github/workflows/gofmt.yml | 2 +- .github/workflows/tests.yml | 2 +- database/connection_test.go | 2 +- database/seeder/importer/runner_test.go | 2 +- database/seeder/seeds/seeder_test.go | 2 +- docker-compose.yml | 10 +++++----- go.mod | 10 +++++----- go.sum | 8 ++++++++ infra/docker/base-images/Dockerfile.builder | 10 +++++----- infra/docker/base-images/Dockerfile.runtime | 12 ++++++------ .../base-images/checksums/builder-aarch64.sha256 | 6 +++--- .../base-images/checksums/builder-x86_64.sha256 | 6 +++--- .../base-images/checksums/runtime-aarch64.sha256 | 6 +++--- .../base-images/checksums/runtime-x86_64.sha256 | 6 +++--- infra/docker/base-images/generate-checksums.sh | 12 ++++++------ infra/docker/dockerfile-api | 4 ++-- infra/makefile/app.mk | 2 +- infra/makefile/build.mk | 8 ++++---- internal/testutil/dbtest/helpers.go | 2 +- metal/cli/clitest/helpers.go | 2 +- pkg/middleware/token_middleware_additional_test.go | 2 +- pkg/middleware/token_middleware_test.go | 2 +- 22 files changed, 63 insertions(+), 55 deletions(-) diff --git a/.github/workflows/gofmt.yml b/.github/workflows/gofmt.yml index d7b328cc..adca3e8a 100644 --- a/.github/workflows/gofmt.yml +++ b/.github/workflows/gofmt.yml @@ -14,7 +14,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - go-version: [1.26.3] + go-version: [1.26.10] steps: - name: Checkout code diff --git a/.github/workflows/tests.yml b/.github/workflows/tests.yml index ad67c306..a146d4b1 100644 --- a/.github/workflows/tests.yml +++ b/.github/workflows/tests.yml @@ -11,7 +11,7 @@ jobs: runs-on: ubuntu-latest strategy: matrix: - go-version: [1.26.3] + go-version: [1.26.10] steps: - uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c # v6 diff --git a/database/connection_test.go b/database/connection_test.go index 23ba69b2..9f3aee33 100644 --- a/database/connection_test.go +++ b/database/connection_test.go @@ -37,7 +37,7 @@ func setupPostgresConnection(t *testing.T, models ...interface{}) (*database.Con // Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818 // and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18). pg, err := postgres.Run(ctx, - "postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88", + "postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15", postgres.WithDatabase("testdb"), postgres.WithUsername("test"), postgres.WithPassword("secret"), diff --git a/database/seeder/importer/runner_test.go b/database/seeder/importer/runner_test.go index 58f87541..929080c0 100644 --- a/database/seeder/importer/runner_test.go +++ b/database/seeder/importer/runner_test.go @@ -712,7 +712,7 @@ func setupPostgresConnection(t *testing.T) (*database.Connection, *env.Environme // Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818 // and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18). pg, err := postgres.Run(ctx, - "postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88", + "postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15", postgres.WithDatabase("testdb"), postgres.WithUsername("test"), postgres.WithPassword("secret"), diff --git a/database/seeder/seeds/seeder_test.go b/database/seeder/seeds/seeder_test.go index 2ef40c16..f87f9c8e 100644 --- a/database/seeder/seeds/seeder_test.go +++ b/database/seeder/seeds/seeder_test.go @@ -26,7 +26,7 @@ func testConnection(t *testing.T, e *env.Environment) *database.Connection { // Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818 // and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18). pg, err := postgres.Run(ctx, - "postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88", + "postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15", postgres.WithDatabase("testdb"), postgres.WithUsername("test"), postgres.WithPassword("secret"), diff --git a/docker-compose.yml b/docker-compose.yml index 8818c330..13e57a2e 100644 --- a/docker-compose.yml +++ b/docker-compose.yml @@ -344,7 +344,7 @@ services: dockerfile: ./infra/docker/dockerfile-api target: builder args: - - BASE_IMAGE_VERSION=${BASE_IMAGE_VERSION:-1.26.3-alpine3.23-r4} + - BASE_IMAGE_VERSION=${BASE_IMAGE_VERSION:-1.26.10-alpine3.23-r7} volumes: - .:/app - go_mod_cache:/go/pkg/mod @@ -357,7 +357,7 @@ services: GOPATH: /go GOMODCACHE: /go/pkg/mod GOCACHE: /tmp/go-build - GOTOOLCHAIN: ${GO_LOCAL_TOOLCHAIN:-go1.26.3} + GOTOOLCHAIN: ${GO_LOCAL_TOOLCHAIN:-go1.26.10} ENV_DB_HOST: api-db ENV_SPA_DIR: ${ENV_SPA_DIR} ENV_DB_PORT: ${ENV_DB_PORT:-5432} @@ -386,7 +386,7 @@ services: - ${API_LOGS_PATH:-./storage/logs/api}:/app/storage/logs environment: CGO_ENABLED: 1 - GOTOOLCHAIN: ${GO_LOCAL_TOOLCHAIN:-go1.26.3} + GOTOOLCHAIN: ${GO_LOCAL_TOOLCHAIN:-go1.26.10} # --- This ensures the Go web server listens for connections from other # containers (like Caddy), not just from within itself. ENV_APP_LOGS_DIR: /app/storage/logs/logs_%s.log @@ -396,7 +396,7 @@ services: context: . dockerfile: ./infra/docker/dockerfile-api args: - - BASE_IMAGE_VERSION=${BASE_IMAGE_VERSION:-1.26.3-alpine3.23-r4} + - BASE_IMAGE_VERSION=${BASE_IMAGE_VERSION:-1.26.10-alpine3.23-r7} - APP_VERSION=0.0.0.1 - APP_HOST_PORT=${ENV_HTTP_PORT} - APP_USER=${ENV_DOCKER_USER} @@ -464,7 +464,7 @@ services: # Pinning to postgres:18.4-alpine to avoid CVE-2025-12817/12818 and ensure # consistent checksum behaviour (initdb enables checksums by default in PG 18). # This matches the version used in test environments for consistency. - image: postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88 + image: postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15 container_name: oullin_db env_file: diff --git a/go.mod b/go.mod index a7457d30..40c83c4f 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/oullin -go 1.26.3 +go 1.26.10 require ( github.com/DATA-DOG/go-sqlmock v1.5.2 @@ -18,9 +18,9 @@ require ( github.com/testcontainers/testcontainers-go v0.42.0 github.com/testcontainers/testcontainers-go/modules/postgres v0.42.0 golang.org/x/crypto v0.52.0 - golang.org/x/image v0.41.0 + golang.org/x/image v0.45.0 golang.org/x/term v0.43.0 - golang.org/x/text v0.37.0 + golang.org/x/text v0.41.0 gopkg.in/yaml.v3 v3.0.1 // Application code uses v3; Prometheus uses v2 (go.yaml.in/yaml/v2) internally - both versions coexist safely gorm.io/driver/postgres v1.6.0 gorm.io/gorm v1.31.1 @@ -86,8 +86,8 @@ require ( go.opentelemetry.io/otel/metric v1.43.0 // indirect go.opentelemetry.io/otel/trace v1.43.0 // indirect go.yaml.in/yaml/v2 v2.4.4 // indirect; Required by prometheus/client_golang; no type conflicts with our gopkg.in/yaml.v3 usage - golang.org/x/sync v0.20.0 // indirect - golang.org/x/sys v0.45.0 // indirect + golang.org/x/sync v0.22.0 // indirect + golang.org/x/sys v0.47.0 // indirect google.golang.org/protobuf v1.36.11 // indirect ) diff --git a/go.sum b/go.sum index e16101ab..d059c0ec 100644 --- a/go.sum +++ b/go.sum @@ -194,18 +194,26 @@ golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= golang.org/x/image v0.41.0 h1:8wS72eGJMJaBxK6okTzd4WaXumUlTVlb753MlsSvTCo= golang.org/x/image v0.41.0/go.mod h1:uIc348UZMSvS5Z65CVZ7iDPaNobNFEPeJ4kbqTOszmA= +golang.org/x/image v0.45.0 h1:FMb1nTbH5H9vF55SriQHgFw5GnNL9Jg6L25BwXKzhB0= +golang.org/x/image v0.45.0/go.mod h1:n62x/7RqlwXDvGsSU4u6IUTUf6KghUZ9Bt7cG/T9Fx4= golang.org/x/sync v0.20.0 h1:e0PTpb7pjO8GAtTs2dQ6jYa5BWYlMuX047Dco/pItO4= golang.org/x/sync v0.20.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= +golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek= +golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0= golang.org/x/sys v0.0.0-20190916202348-b4ddaad3f8a3/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20201204225414-ed752295db88/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20210616094352-59db8d763f22/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/term v0.43.0 h1:S4RLU2sB31O/NCl+zFN9Aru9A/Cq2aqKpTZJ6B+DwT4= golang.org/x/term v0.43.0/go.mod h1:lrhlHNdQJHO+1qVYiHfFKVuVioJIheAc3fBSMFYEIsk= golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= google.golang.org/protobuf v1.36.11 h1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE= google.golang.org/protobuf v1.36.11/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0= diff --git a/infra/docker/base-images/Dockerfile.builder b/infra/docker/base-images/Dockerfile.builder index bb7a9fc1..1a852af4 100644 --- a/infra/docker/base-images/Dockerfile.builder +++ b/infra/docker/base-images/Dockerfile.builder @@ -7,9 +7,9 @@ # against committed SHA256 checksums, and installed via an ephemeral RSA-signed # APKINDEX so `apk add` never contacts the live Alpine package index. -ARG GO_VERSION=1.26.3 +ARG GO_VERSION=1.26.10 ARG GO_IMAGE_VARIANT=alpine3.23 -ARG GO_IMAGE_DIGEST=sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d +ARG GO_IMAGE_DIGEST=sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e FROM golang:${GO_VERSION}-${GO_IMAGE_VARIANT}@${GO_IMAGE_DIGEST} @@ -75,11 +75,11 @@ RUN apk add --no-cache openssl=3.5.9-r0 && \ make-4.4.1-r3.apk \ mpc1-1.3.1-r1.apk \ mpfr4-4.2.2-r0.apk \ - musl-1.2.5-r23.apk \ - musl-dev-1.2.5-r23.apk \ + musl-1.2.5-r24.apk \ + musl-dev-1.2.5-r24.apk \ patch-2.8-r0.apk \ pkgconf-2.5.1-r0.apk \ - zlib-1.3.2-r0.apk \ + zlib-1.3.2-r1.apk \ zstd-libs-1.5.7-r2.apk \ ; do \ wget -qO "/tmp/local-repo/${apk_arch}/${apk_pkg}" "${APK_BASE_URL}/${apk_arch}/${apk_pkg}" || exit 1; \ diff --git a/infra/docker/base-images/Dockerfile.runtime b/infra/docker/base-images/Dockerfile.runtime index e08723e6..ea2d3ce6 100644 --- a/infra/docker/base-images/Dockerfile.runtime +++ b/infra/docker/base-images/Dockerfile.runtime @@ -8,7 +8,7 @@ # SHA256 checksum verification, ephemeral RSA-signed APKINDEX. ARG ALPINE_VERSION=3.23 -ARG ALPINE_IMAGE_DIGEST=sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 +ARG ALPINE_IMAGE_DIGEST=sha256:21f3e19bafab57a9ff7aa9dd571dac72f868370472c10f450cc0416cc1aca553 FROM alpine:${ALPINE_VERSION}@${ALPINE_IMAGE_DIGEST} @@ -47,9 +47,9 @@ RUN apk add --no-cache openssl=3.5.9-r0 && \ for apk_pkg in \ libsharpyuv-1.6.0-r0.apk \ libwebp-1.6.0-r0.apk \ - musl-1.2.5-r23.apk \ - tzdata-2026d-r0.apk \ - zlib-1.3.2-r0.apk \ + musl-1.2.5-r24.apk \ + tzdata-2026e-r0.apk \ + zlib-1.3.2-r1.apk \ ; do \ wget -qO "/tmp/local-repo/${apk_arch}/${apk_pkg}" "${APK_BASE_URL}/${apk_arch}/${apk_pkg}" || exit 1; \ done && \ @@ -67,7 +67,7 @@ RUN apk add --no-cache openssl=3.5.9-r0 && \ | gzip -9 \ | cat - /tmp/APKINDEX.unsigned.tar.gz \ > "/tmp/local-repo/${apk_arch}/APKINDEX.tar.gz" && \ - apk add --no-cache --no-network --repositories-file /dev/null --repository /tmp/local-repo musl=1.2.5-r23 libwebp && \ - apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/tzdata-2026d-r0.apk" && \ + apk add --no-cache --no-network --repositories-file /dev/null --repository /tmp/local-repo musl=1.2.5-r24 libwebp && \ + apk add --no-cache --no-network "/tmp/local-repo/${apk_arch}/tzdata-2026e-r0.apk" && \ apk del --no-cache openssl && \ rm -rf /tmp/local-repo /tmp/checksums /tmp/apk-sign.rsa /tmp/sig /tmp/sig.tar /tmp/APKINDEX.unsigned.tar.gz /etc/apk/keys/apk-sign.rsa.pub diff --git a/infra/docker/base-images/checksums/builder-aarch64.sha256 b/infra/docker/base-images/checksums/builder-aarch64.sha256 index b908386d..8991c9d6 100644 --- a/infra/docker/base-images/checksums/builder-aarch64.sha256 +++ b/infra/docker/base-images/checksums/builder-aarch64.sha256 @@ -21,9 +21,9 @@ e9a504ac218c00fa5c1fc83c7d5b94a3d26e2c2314404b3d101b22710bf752ec libwebpmux-1.6 e15217cadc367b7fc52871e3cc82fe7193bc82f75087db0598aa2e5e941f734c make-4.4.1-r3.apk 753858c93308a54fd2c578e67ce5f3947e4b7946052b1e66a892cd5ee7efd4a4 mpc1-1.3.1-r1.apk da8b196bad532b4a82ea62f0b1609fc4bbdadb8ac9fed7c7792a84be8084a04f mpfr4-4.2.2-r0.apk -6a3edd924ead1fad88a69e28c5775809af3026b322f58428001cd02fedc5299e musl-1.2.5-r23.apk -19032a762b8c6967d3789de1bf540754a0121e517402022eebd3ae6f1c9965a4 musl-dev-1.2.5-r23.apk +d7043c549029c98d438e9bc94213b006e5c88540eb58d1f5b0f0d1d56dbf9c98 musl-1.2.5-r24.apk +8e3a2e5b78069ebd1307cb092972de2f95deb0b21b866a788d1ac7d6972db43e musl-dev-1.2.5-r24.apk ed4ec83a16470de9087e295f53d3b2e1a666a684cc117ea017adb969ba044c4b patch-2.8-r0.apk 68a8cbd9901184caf0c4cf86c54ae199eae6110c313457ad34adb8ce1d929816 pkgconf-2.5.1-r0.apk -ecda4cc94fd18f90182f1d3a615889df5e0db9cf78926d11627dd23e06d2e6e8 zlib-1.3.2-r0.apk +82d52fa82a46c73aae8b9f95d7f31a196137f3ce4a000980cdbbfc05c245e7bf zlib-1.3.2-r1.apk 50a998e56e4bf31504996e49c1b4a23eed5e0cd4e24b8a1356a54daf1a6eabbe zstd-libs-1.5.7-r2.apk diff --git a/infra/docker/base-images/checksums/builder-x86_64.sha256 b/infra/docker/base-images/checksums/builder-x86_64.sha256 index b1780726..320043ad 100644 --- a/infra/docker/base-images/checksums/builder-x86_64.sha256 +++ b/infra/docker/base-images/checksums/builder-x86_64.sha256 @@ -21,9 +21,9 @@ ac19a7d33d4e7d4e14a6d6ca9481d3291eb7ef37759d9dc9226ccb47d3c752eb libwebpmux-1.6 db47019dc9ebbfec1c0224efb8c30b3e26f22728b6f433b492af57da622787d5 make-4.4.1-r3.apk 114dcb18a4e5c7739fdab19414e156295c2783d56cdd226bcee4b5afc6a88c76 mpc1-1.3.1-r1.apk 4361c9084ae95e3987cee87fed35bbaca10c75907eb1900365707196d250bdc8 mpfr4-4.2.2-r0.apk -4f3c4a7bf9f51d2c91007e333b17459362ffd881b4a343e8da07b6c50c4f4a0d musl-1.2.5-r23.apk -2ea566b665ebaea4f84cee1e4b7ef093b0aa67356006e84deb26d9bd7a716c6b musl-dev-1.2.5-r23.apk +d49d703392f1a6d2fe822db1b57e61735063077e1ad846d5f40d79fe507ec727 musl-1.2.5-r24.apk +9a45a27051991319c020abd2e4f300f01b85febd745634d9e71cdbf133363448 musl-dev-1.2.5-r24.apk e7104a7dd5c4a8a0e4a1df2ff8ff0fd9a1587d8de791dffc18d8dae1c0e7ec3f patch-2.8-r0.apk 01244a680c1db46539f7e6160ba56476a18f53aefb86cc18354c8d283b6dda71 pkgconf-2.5.1-r0.apk -f56dea63692059bd65854bb179b7551971a441000b0d98c5b031291ca0450b56 zlib-1.3.2-r0.apk +ee62e1864c235901e2aa4d1868c7ae8f7cc5d0740a98c48a2525332eb4bfda73 zlib-1.3.2-r1.apk d5fcc58f7f071a5658d97b09838668e4443203217631992915b8e60656904104 zstd-libs-1.5.7-r2.apk diff --git a/infra/docker/base-images/checksums/runtime-aarch64.sha256 b/infra/docker/base-images/checksums/runtime-aarch64.sha256 index 31dcb191..e5db209e 100644 --- a/infra/docker/base-images/checksums/runtime-aarch64.sha256 +++ b/infra/docker/base-images/checksums/runtime-aarch64.sha256 @@ -1,5 +1,5 @@ 5b5009c66c47bd7a49a1b0eb236b526a14b2ed6c0802cb82d41eb6f9ea852a59 libsharpyuv-1.6.0-r0.apk 808eac0eba50a5a7de86e280f4337281eace15a6b10301ee04de3d39f212cfb9 libwebp-1.6.0-r0.apk -6a3edd924ead1fad88a69e28c5775809af3026b322f58428001cd02fedc5299e musl-1.2.5-r23.apk -b9421d401a00c7d88503bd22646a5d09df7ba7e34949a5cc009e54de93a1e25f tzdata-2026d-r0.apk -ecda4cc94fd18f90182f1d3a615889df5e0db9cf78926d11627dd23e06d2e6e8 zlib-1.3.2-r0.apk +d7043c549029c98d438e9bc94213b006e5c88540eb58d1f5b0f0d1d56dbf9c98 musl-1.2.5-r24.apk +011514b53806fd660507958aaa28af8b896060bc10c4c4507fab1a13fff37da0 tzdata-2026e-r0.apk +82d52fa82a46c73aae8b9f95d7f31a196137f3ce4a000980cdbbfc05c245e7bf zlib-1.3.2-r1.apk diff --git a/infra/docker/base-images/checksums/runtime-x86_64.sha256 b/infra/docker/base-images/checksums/runtime-x86_64.sha256 index 7e77d348..815e443e 100644 --- a/infra/docker/base-images/checksums/runtime-x86_64.sha256 +++ b/infra/docker/base-images/checksums/runtime-x86_64.sha256 @@ -1,5 +1,5 @@ 68b1787f41c36e7b6d9def855c5663f2f1ab62fbcc599d38ce3487e75fc883ec libsharpyuv-1.6.0-r0.apk 4d5303958ee38a978501c330c23b62ef98993ae3c30afcd62444723f33da2477 libwebp-1.6.0-r0.apk -4f3c4a7bf9f51d2c91007e333b17459362ffd881b4a343e8da07b6c50c4f4a0d musl-1.2.5-r23.apk -4967fbaa3919df716ec7a21c2a0465479425b34a99d5165b80fc3d677ed34ee8 tzdata-2026d-r0.apk -f56dea63692059bd65854bb179b7551971a441000b0d98c5b031291ca0450b56 zlib-1.3.2-r0.apk +d49d703392f1a6d2fe822db1b57e61735063077e1ad846d5f40d79fe507ec727 musl-1.2.5-r24.apk +b317a4fa0a6ce0bc9f2a62349e205ed9faf5c89cb80c817fdc9cedca53e78da1 tzdata-2026e-r0.apk +ee62e1864c235901e2aa4d1868c7ae8f7cc5d0740a98c48a2525332eb4bfda73 zlib-1.3.2-r1.apk diff --git a/infra/docker/base-images/generate-checksums.sh b/infra/docker/base-images/generate-checksums.sh index ee194c60..0f63dd11 100755 --- a/infra/docker/base-images/generate-checksums.sh +++ b/infra/docker/base-images/generate-checksums.sh @@ -45,20 +45,20 @@ BUILDER_PACKAGES=( make-4.4.1-r3.apk mpc1-1.3.1-r1.apk mpfr4-4.2.2-r0.apk - musl-1.2.5-r23.apk - musl-dev-1.2.5-r23.apk + musl-1.2.5-r24.apk + musl-dev-1.2.5-r24.apk patch-2.8-r0.apk pkgconf-2.5.1-r0.apk - zlib-1.3.2-r0.apk + zlib-1.3.2-r1.apk zstd-libs-1.5.7-r2.apk ) RUNTIME_PACKAGES=( libsharpyuv-1.6.0-r0.apk libwebp-1.6.0-r0.apk - musl-1.2.5-r23.apk - tzdata-2026d-r0.apk - zlib-1.3.2-r0.apk + musl-1.2.5-r24.apk + tzdata-2026e-r0.apk + zlib-1.3.2-r1.apk ) # Architectures for which we generate checksums (multi-platform support). diff --git a/infra/docker/dockerfile-api b/infra/docker/dockerfile-api index b7e42bf0..2d33dbcf 100644 --- a/infra/docker/dockerfile-api +++ b/infra/docker/dockerfile-api @@ -32,10 +32,10 @@ ARG BINARY_NAME=oullin_api # can work without registry access. CI/maintainers can override these args with # digest-pinned registry references after running `make push-base-images`. # -ARG BASE_IMAGE_VERSION=1.26.3-alpine3.23-r4 +ARG BASE_IMAGE_VERSION=1.26.10-alpine3.23-r7 ARG BUILDER_BASE_IMAGE=oullin-api-builder-base:${BASE_IMAGE_VERSION} ARG RUNTIME_BASE_IMAGE=oullin-api-runtime-base:${BASE_IMAGE_VERSION} -ARG GO_TOOLCHAIN=go1.26.3 +ARG GO_TOOLCHAIN=go1.26.10 # Non-root user/group settings. ARG APP_USER=appuser diff --git a/infra/makefile/app.mk b/infra/makefile/app.mk index 5de80637..56adafbf 100644 --- a/infra/makefile/app.mk +++ b/infra/makefile/app.mk @@ -11,7 +11,7 @@ DB_SECRETS_DIR := $(ROOT_PATH)/database/infra/secrets # "auto" lets the local Go installation download the toolchain required by go.mod, # so developers don't need to install the exact Go version manually. -# Override with a pinned version (e.g., GO_LOCAL_TOOLCHAIN=go1.26.3) for deterministic builds. +# Override with a pinned version (e.g., GO_LOCAL_TOOLCHAIN=go1.26.10) for deterministic builds. # Note: docker-compose reads GO_LOCAL_TOOLCHAIN from the environment separately. GO_LOCAL_TOOLCHAIN ?= auto GOIMPORTS_VERSION ?= v0.43.0 diff --git a/infra/makefile/build.mk b/infra/makefile/build.mk index 3fb5efda..c08d8582 100644 --- a/infra/makefile/build.mk +++ b/infra/makefile/build.mk @@ -1,12 +1,12 @@ .PHONY: build-local watch-local build-ci build-prod build-release build-deploy build-local-restart build-prod-force build-fresh ensure-caddy-net ensure-base-images ensure-builder-base-image ensure-runtime-base-image build-base-images push-base-images generate-apk-checksums build-cli-docker prewarm-cli-docker BUILD_VERSION ?= latest -BASE_GO_VERSION ?= 1.26.3 +BASE_GO_VERSION ?= 1.26.10 BASE_ALPINE_VERSION ?= 3.23 -BASE_IMAGE_REVISION ?= 6 +BASE_IMAGE_REVISION ?= 7 BASE_GO_IMAGE_VARIANT ?= alpine$(BASE_ALPINE_VERSION) -BASE_GO_IMAGE_DIGEST ?= sha256:91eda9776261207ea25fd06b5b7fed8d397dd2c0a283e77f2ab6e91bfa71079d -BASE_ALPINE_IMAGE_DIGEST ?= sha256:5b10f432ef3da1b8d4c7eb6c487f2f5a8f096bc91145e68878dd4a5019afde11 +BASE_GO_IMAGE_DIGEST ?= sha256:0525c952defebc693cdaf62cdf43afa32be5a7f377e99260642ea19c240c708e +BASE_ALPINE_IMAGE_DIGEST ?= sha256:21f3e19bafab57a9ff7aa9dd571dac72f868370472c10f450cc0416cc1aca553 BASE_APK_BASE_URL ?= https://dl-cdn.alpinelinux.org/alpine/v$(BASE_ALPINE_VERSION)/main BASE_IMAGE_VERSION ?= $(BASE_GO_VERSION)-alpine$(BASE_ALPINE_VERSION)-r$(BASE_IMAGE_REVISION) BUILD_CADDY_NET := caddy_net diff --git a/internal/testutil/dbtest/helpers.go b/internal/testutil/dbtest/helpers.go index f59fe01c..61facaab 100644 --- a/internal/testutil/dbtest/helpers.go +++ b/internal/testutil/dbtest/helpers.go @@ -305,7 +305,7 @@ func newPostgresConnection(t *testing.T, models ...interface{}) (*database.Conne // Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818 // and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18). pg, err := postgres.Run(ctx, - "postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88", + "postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15", postgres.WithUsername(username), postgres.WithPassword(password), postgres.WithDatabase(dbname), diff --git a/metal/cli/clitest/helpers.go b/metal/cli/clitest/helpers.go index 16711ae5..211e6a8c 100644 --- a/metal/cli/clitest/helpers.go +++ b/metal/cli/clitest/helpers.go @@ -29,7 +29,7 @@ func NewTestConnection(t *testing.T, models ...interface{}) *database.Connection // Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818 // and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18). pg, err := postgres.Run(ctx, - "postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88", + "postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15", postgres.WithDatabase("testdb"), postgres.WithUsername("test"), postgres.WithPassword("secret"), diff --git a/pkg/middleware/token_middleware_additional_test.go b/pkg/middleware/token_middleware_additional_test.go index 585c5f66..00bc9d7a 100644 --- a/pkg/middleware/token_middleware_additional_test.go +++ b/pkg/middleware/token_middleware_additional_test.go @@ -33,7 +33,7 @@ func makeRepo(t *testing.T, account string) (*repository.ApiKeys, *auth.TokenHan // Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818 // and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18). pgC, err := postgrescontainer.Run(ctx, - "postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88", + "postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15", postgrescontainer.WithDatabase("testdb"), postgrescontainer.WithUsername("test"), postgrescontainer.WithPassword("test"), diff --git a/pkg/middleware/token_middleware_test.go b/pkg/middleware/token_middleware_test.go index fc19c022..df9dbee5 100644 --- a/pkg/middleware/token_middleware_test.go +++ b/pkg/middleware/token_middleware_test.go @@ -185,7 +185,7 @@ func setupDB(t *testing.T) *database.Connection { // Pinning to postgres:18.4-alpine by digest to avoid CVE-2025-12817/12818 // and ensure consistent checksum behaviour (initdb enables checksums by default in PG 18). pgC, err := postgrescontainer.Run(ctx, - "postgres:18.4-alpine@sha256:96d56f7f57c6aacd1fcb908bc83b345ec5f83231ee486dd66a1baadce274db88", + "postgres:18.4-alpine@sha256:9a8afca54e7861fd90fab5fdf4c42477a6b1cb7d293595148e674e0a3181de15", postgrescontainer.WithDatabase("testdb"), postgrescontainer.WithUsername("test"), postgrescontainer.WithPassword("secret"),