From 9d6f3b46373e6a467008cb21c961f81b69eef537 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Fri, 16 Oct 2026 18:44:52 +0200 Subject: [PATCH] hub v0.156.0: Go 1.27.2, x/crypto v0.58.0, alpine 3.24.2 (R-972); README drops four actions with no code Claude-Session: https://claude.ai/code/session_0159rPz1ZhFKsS53msqPYxtS --- hub/CHANGELOG.md | 9 +++++++++ hub/Dockerfile | 5 +++-- hub/README.md | 4 ---- hub/go.mod | 6 +++--- hub/go.sum | 10 ++++++---- 5 files changed, 21 insertions(+), 13 deletions(-) diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md index 995f4902..858a8faf 100644 --- a/hub/CHANGELOG.md +++ b/hub/CHANGELOG.md @@ -1,3 +1,12 @@ +## v0.156.0 — a supported Go: 1.27.2, x/crypto v0.58.0, alpine 3.24.2 (R-972) (2026-10-16) + +- Built on Go 1.27.2 (was 1.24.13 — no security fixes left) with golang.org/x/crypto v0.58.0 (was v0.31.0) and + `alpine:3.24.2` (was 3.21); both images pinned by version AND digest. No code change; full green gate on the new Go. + Scanner before/after: felhom.eu `documentation/audits/burndown2-2026-10-16/P4/`. +- README: the „Push Config", „Pull Config", „Show Diff" and „Trigger Update" customer actions are gone from the table — + the hub has had no code for them (it never connects to a box); the controller routes they called are removed in + controller v0.322.0 (R-970). + ## v0.155.0 — the floor can never deliver a withdrawn controller build (R-1085) (2026-10-16) `documentation/architecture/09-update-architecture.md` §0 (the [DESIGN] paragraph on withdrawn builds). diff --git a/hub/Dockerfile b/hub/Dockerfile index f6a502b5..5dc7e12b 100644 --- a/hub/Dockerfile +++ b/hub/Dockerfile @@ -1,4 +1,5 @@ -FROM golang:1.24-alpine AS builder +# R-972: a supported, patched Go and the current Alpine, pinned by version and digest (no moving tag). +FROM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS builder WORKDIR /app @@ -18,7 +19,7 @@ RUN go mod tidy && \ -ldflags "-s -w -X main.Version=${VERSION} -X main.BuildTime=${BUILD_TIME}" \ -o /felhom-hub ./cmd/hub/ -FROM alpine:3.21 +FROM alpine:3.24.2@sha256:294b683cb724975bec92580e1e685676bd4b50bda910ddb8c51d4cabeaec77e6 RUN apk add --no-cache ca-certificates tzdata diff --git a/hub/README.md b/hub/README.md index a996051e..11cd3c17 100644 --- a/hub/README.md +++ b/hub/README.md @@ -273,11 +273,7 @@ Enrollment mints the host's API key exactly once (Day-0 passphrase flow); host r | Action | Description | |--------|-------------| | **Block/Unblock** | Toggle blocked status — blocked customers are hidden from dashboard and notifications are suppressed, but reports are still accepted and stored | -| **Push Config** | Generate YAML from Hub config and POST it to the controller's `/api/config/apply` endpoint (requires controller URL from reports) | -| **Pull Config** | Import controller's current config into Hub — fetches live YAML via `GET /api/config`, extracts identity and override fields, updates Hub's stored config | -| **Show Diff** | Compare Hub-generated config with controller's live config — shows per-key differences in a color-coded table (value-based comparison, ignores key ordering and volatile fields) | | **Create Config** | Auto-create a managed config from a manual customer's report data, then redirect to edit form | -| **Trigger Update** | Instruct controller to self-update to the latest version | | **Delete** | Remove customer config (customer reappears as manual if reports continue) | ### Status Logic diff --git a/hub/go.mod b/hub/go.mod index 14f20b22..1c7aadf1 100644 --- a/hub/go.mod +++ b/hub/go.mod @@ -1,9 +1,9 @@ module gitea.dooplex.hu/admin/felhom-hub -go 1.24.0 +go 1.27.2 require ( - golang.org/x/crypto v0.31.0 + golang.org/x/crypto v0.58.0 gopkg.in/yaml.v3 v3.0.1 modernc.org/sqlite v1.45.0 ) @@ -15,7 +15,7 @@ require ( github.com/ncruces/go-strftime v1.0.0 // indirect github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec // indirect golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 // indirect - golang.org/x/sys v0.37.0 // indirect + golang.org/x/sys v0.49.0 // indirect modernc.org/libc v1.67.6 // indirect modernc.org/mathutil v1.7.1 // indirect modernc.org/memory v1.11.0 // indirect diff --git a/hub/go.sum b/hub/go.sum index 47741945..3393428e 100644 --- a/hub/go.sum +++ b/hub/go.sum @@ -12,8 +12,8 @@ github.com/ncruces/go-strftime v1.0.0 h1:HMFp8mLCTPp341M/ZnA4qaf7ZlsbTc+miZjCLOF github.com/ncruces/go-strftime v1.0.0/go.mod h1:Fwc5htZGVVkseilnfgOVb9mKy6w1naJmn9CehxcKcls= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec h1:W09IVJc94icq4NjY3clb7Lk8O1qJ8BdBEF8z0ibU0rE= github.com/remyoudompheng/bigfft v0.0.0-20230129092748-24d4a6f8daec/go.mod h1:qqbHyh8v60DhA7CoWK5oRCqLrMHRGoxYCSS9EjAz6Eo= -golang.org/x/crypto v0.31.0 h1:ihbySMvVjLAeSH1IbfcRTkD/iNscyz8rGzjF/E5hV6U= -golang.org/x/crypto v0.31.0/go.mod h1:kDsLvtWBEx7MV9tJOj9bnXsPbxwJQ6csT/x4KIN4Ssk= +golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= +golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546 h1:mgKeJMpvi0yx/sU5GsxQ7p6s2wtOnGAHZWCHUM4KGzY= golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546/go.mod h1:j/pmGrbnkbPtQfxEe5D0VQhZC6qKbfKifgD0oM7sR70= golang.org/x/mod v0.29.0 h1:HV8lRxZC4l2cr3Zq1LvtOsi/ThTgWnUk/y64QSs8GwA= @@ -21,8 +21,10 @@ golang.org/x/mod v0.29.0/go.mod h1:NyhrlYXJ2H4eJiRy/WDBO6HMqZQ6q9nk4JzS3NuCK+w= golang.org/x/sync v0.17.0 h1:l60nONMj9l5drqw6jlhIELNv9I0A4OFgRsG9k2oT9Ug= golang.org/x/sync v0.17.0/go.mod h1:9KTHXmSnoGruLpwFjVSX0lNNA75CykiMECbovNTZqGI= golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.37.0 h1:fdNQudmxPjkdUTPnLn5mdQv7Zwvbvpaxqs831goi9kQ= -golang.org/x/sys v0.37.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks= +golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= +golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= +golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= golang.org/x/tools v0.38.0 h1:Hx2Xv8hISq8Lm16jvBZ2VQf+RLmbd7wVUsALibYI/IQ= golang.org/x/tools v0.38.0/go.mod h1:yEsQ/d/YK8cjh0L6rZlY8tgtlKiBNTL14pGDJPJpYQs= gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405 h1:yhCVgyC4o1eVCa2tZl7eS0r+SDo693bJlVdllGtEeKM=