From d625a1437da4397442b42e56031cf2fffb5b3ea2 Mon Sep 17 00:00:00 2001 From: kisfenyo Date: Mon, 26 Oct 2026 20:42:35 +0100 Subject: [PATCH] =?UTF-8?q?hub=20build(R-972):=20Go=201.27.3=20+=20golang:?= =?UTF-8?q?1.27.3-alpine3.24=20builder=20(GO-2026-6809)=20=E2=80=94=20govu?= =?UTF-8?q?lncheck=201=20=E2=86=92=200=20called?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit --- hub/CHANGELOG.md | 3 +++ hub/Dockerfile | 2 +- hub/go.mod | 2 +- 3 files changed, 5 insertions(+), 2 deletions(-) diff --git a/hub/CHANGELOG.md b/hub/CHANGELOG.md index 387c9414..47407aa1 100644 --- a/hub/CHANGELOG.md +++ b/hub/CHANGELOG.md @@ -1,5 +1,8 @@ ## Unreleased (next: v0.173.0) — D53: a held app reaches the operator (`08` §10); R-1218: a keyed recovery package is never replaced by a key-less one +- **R-972: Go 1.27.3** (`go.mod` + the builder image `golang:1.27.3-*` pinned by digest; released 2026-10-19 with a + security fix to `crypto/x509`). `govulncheck` v1.8.0: 1 called vulnerability before (GO-2026-6809), 0 after; full + `go build/vet/test` green. `golang.org/x/crypto` v0.58.0 is already the newest. - **R-1218 (P2, key code), the hub half:** `store.SaveHostEscrowWithIdentity` REFUSES (`ErrEscrowWouldDropRepoKey`) an upload that seals no off-site repository password (`restic_pw_sha256` "") over a package that seals one; the escrow PUT answers 409 with the reason and a WARN. Before: the good package was demoted to operator-only custody and the household's code no diff --git a/hub/Dockerfile b/hub/Dockerfile index 5dc7e12b..42c98a3b 100644 --- a/hub/Dockerfile +++ b/hub/Dockerfile @@ -1,5 +1,5 @@ # R-972: a supported, patched Go and the current Alpine, pinned by version and digest (no moving tag). -FROM golang:1.27.2-alpine3.24@sha256:f92b6ef800e499660581efdabdf25d9d817a9d124eaf900924f0504e7e27e12d AS builder +FROM golang:1.27.3-alpine3.24@sha256:b8c9b82affbbb82a020bbcf998dad2ba9516944ac7e883524642a481a9505e9c AS builder WORKDIR /app diff --git a/hub/go.mod b/hub/go.mod index 1c7aadf1..d01a6243 100644 --- a/hub/go.mod +++ b/hub/go.mod @@ -1,6 +1,6 @@ module gitea.dooplex.hu/admin/felhom-hub -go 1.27.2 +go 1.27.3 require ( golang.org/x/crypto v0.58.0