From d1d953c7c12e058de4b0c21daee1e0021e48b211 Mon Sep 17 00:00:00 2001 From: chen21019 <19357113+chen21019@users.noreply.github.com> Date: Wed, 21 Oct 2026 11:39:05 +0800 Subject: [PATCH] fix: patch Go standard library and runtime zlib --- .github/workflows/codeql-verification.yml | 6 +++--- .github/workflows/release.yml | 6 +++--- .github/workflows/security-release-gate.yml | 6 +++--- Dockerfile.dapper | 6 +++--- README.md | 15 ++++++++------- package/haproxy/Dockerfile | 3 ++- package/haproxy/alpine-apk.lock | 1 + scripts/supply-chain-check | 4 +++- 8 files changed, 26 insertions(+), 21 deletions(-) diff --git a/.github/workflows/codeql-verification.yml b/.github/workflows/codeql-verification.yml index 714c7145..01109a66 100644 --- a/.github/workflows/codeql-verification.yml +++ b/.github/workflows/codeql-verification.yml @@ -48,12 +48,12 @@ jobs: shell: bash run: | set -euo pipefail - archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz" + archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz" curl --fail --silent --show-error --location \ --output "$archive" \ - 'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz' + 'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz' printf '%s %s\n' \ - '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \ + '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \ "$archive" | sha256sum --check tar -C "$RUNNER_TEMP" -xzf "$archive" "$RUNNER_TEMP/go/bin/go" version diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index c049adf3..1edb400c 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -45,11 +45,11 @@ jobs: shell: bash run: | set -euo pipefail - archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz" + archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz" curl --fail --silent --show-error --location --output "$archive" \ - 'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz' + 'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz' printf '%s %s\n' \ - '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \ + '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \ "$archive" | sha256sum --check tar -C "$RUNNER_TEMP" -xzf "$archive" printf '%s\n' "$RUNNER_TEMP/go/bin" >> "$GITHUB_PATH" diff --git a/.github/workflows/security-release-gate.yml b/.github/workflows/security-release-gate.yml index 7672db47..dd3f6c69 100644 --- a/.github/workflows/security-release-gate.yml +++ b/.github/workflows/security-release-gate.yml @@ -33,11 +33,11 @@ jobs: shell: bash run: | set -euo pipefail - archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz" + archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz" curl --fail --silent --show-error --location --output "$archive" \ - 'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz' + 'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz' printf '%s %s\n' \ - '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \ + '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \ "$archive" | sha256sum --check tar -C "$RUNNER_TEMP" -xzf "$archive" export PATH="$RUNNER_TEMP/go/bin:$PATH" diff --git a/Dockerfile.dapper b/Dockerfile.dapper index 67762dbd..f076c940 100644 --- a/Dockerfile.dapper +++ b/Dockerfile.dapper @@ -7,9 +7,9 @@ ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2 ARG DAPPER_HOST_ARCH=amd64 ARG DOCKER_BUILDX_VERSION=0.36.1 -ARG GO_VERSION=1.27.0 -ARG GO_LINUX_AMD64_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685 -ARG GO_LINUX_ARM64_SHA256=51798d2c42d0e1c6ed7fd9f48728b4193abac9e8aad6dbac2fe96a81f5909bda +ARG GO_VERSION=1.27.3 +ARG GO_LINUX_AMD64_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 +ARG GO_LINUX_ARM64_SHA256=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49 ENV DEBIAN_FRONTEND=noninteractive ENV HOST_ARCH=${DAPPER_HOST_ARCH} \ diff --git a/README.md b/README.md index 39f8a353..479c745e 100644 --- a/README.md +++ b/README.md @@ -14,17 +14,18 @@ ghcr.io/pasturestack/load-balancer-service:v0.9.27 Release deployments pin the image by digest. The image is not intended to be started by itself because the control plane supplies metadata, API credentials, service links, port rules, and health-check configuration. -This branch prepares the `v0.9.30` source candidate for drain weight recovery. +This branch prepares the `v0.9.31` source candidate for drain weight recovery. The candidate has passed the focused local race tests and static checks described below. The signed `v0.9.28` tag is retained, but its release build failed because Alpine no longer served several locked package versions; no runtime image or GitHub release was published. The signed `v0.9.29` tag refreshed those pins and built the image, but its version smoke failed with a stdout broken pipe before -scanning or publication. This candidate captures complete version-command output -before checking it, preserving command failures and exact-version checks without -an early-closing pipe. Protected pull-request CI and native PastureStack -load-balancer QA remain release qualification gates; `v0.9.30` has not been tagged -or published. +scanning or publication. The signed `v0.9.30` tag fixed that smoke check and +passed the build, but its image scan correctly blocked publication on the old Go +standard library and runtime zlib. This candidate uses checksum-pinned Go 1.27.3 +and explicitly pins runtime zlib 1.3.2-r1; all scanner and attestation gates stay +in place. Protected pull-request CI and native PastureStack load-balancer QA +remain release qualification gates; `v0.9.31` has not been tagged or published. ## Compatibility @@ -39,7 +40,7 @@ It also accepts the generic `CATTLE_ACCESS_KEY` and `CATTLE_SECRET_KEY` pair use The HAProxy logging helper keeps its configuration under the standard `/etc/rsyslog.d` path and does not require a daemon PID file. Logging initialization is validated independently before HAProxy configuration is applied. -### Drain weight recovery (v0.9.30 source candidate) +### Drain weight recovery (v0.9.31 source candidate) The controller records each backend's runtime weight before setting it to zero for `target.drain`, including drains that already have zero active sessions. diff --git a/package/haproxy/Dockerfile b/package/haproxy/Dockerfile index 848623b3..b0035065 100644 --- a/package/haproxy/Dockerfile +++ b/package/haproxy/Dockerfile @@ -64,7 +64,8 @@ RUN set -eux; \ "procps-ng=${ALPINE_PROCPS_NG_VERSION}" \ "rsyslog=${ALPINE_RSYSLOG_VERSION}" \ "su-exec=${ALPINE_SU_EXEC_VERSION}" \ - "tini=${ALPINE_TINI_VERSION}"; \ + "tini=${ALPINE_TINI_VERSION}" \ + "zlib=${ALPINE_ZLIB_VERSION}"; \ { \ printf 'repository\thttps://dl-cdn.alpinelinux.org/alpine/v3.24/main\n'; \ apk info -v | LC_ALL=C sort; \ diff --git a/package/haproxy/alpine-apk.lock b/package/haproxy/alpine-apk.lock index b51b925e..a61368ae 100644 --- a/package/haproxy/alpine-apk.lock +++ b/package/haproxy/alpine-apk.lock @@ -17,4 +17,5 @@ ALPINE_PROCPS_NG_VERSION='4.0.6-r0' ALPINE_RSYSLOG_VERSION='8.2604.0-r0' ALPINE_SU_EXEC_VERSION='0.3-r0' ALPINE_TINI_VERSION='0.19.0-r3' +ALPINE_ZLIB_VERSION='1.3.2-r1' ALPINE_ZLIB_DEV_VERSION='1.3.2-r1' diff --git a/scripts/supply-chain-check b/scripts/supply-chain-check index a15a9606..7ba53473 100755 --- a/scripts/supply-chain-check +++ b/scripts/supply-chain-check @@ -16,7 +16,7 @@ require_text go.mod 'github.com/gorilla/websocket v1.5.3' require_text go.mod 'github.com/sirupsen/logrus v1.10.2' require_text go.mod 'github.com/urfave/cli/v3 v3.11.0' require_text go.mod 'golang.org/x/sys v0.47.0' -require_text Dockerfile.dapper 'ARG GO_VERSION=1.27.0' +require_text Dockerfile.dapper 'ARG GO_VERSION=1.27.3' require_text Dockerfile.dapper 'FROM docker:29.7.2-cli@sha256:000bb62ff495f986c9f5578eb67cc2cb98b91138eda81d7762d5371eb8a497fe AS docker-cli' require_text package/haproxy/Dockerfile 'ARG HAPROXY_VERSION=3.4.3' require_text package/haproxy/Dockerfile 'ARG ALPINE_IMAGE=docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b' @@ -24,6 +24,8 @@ require_text package/haproxy/Dockerfile '"libcrypto3=${ALPINE_LIBCRYPTO3_VERSION require_text package/haproxy/Dockerfile '"libssl3=${ALPINE_LIBSSL3_VERSION}"' require_text package/haproxy/alpine-apk.lock "ALPINE_LIBCRYPTO3_VERSION='3.5.9-r0'" require_text package/haproxy/alpine-apk.lock "ALPINE_LIBSSL3_VERSION='3.5.9-r0'" +require_text package/haproxy/Dockerfile '"zlib=${ALPINE_ZLIB_VERSION}"' +require_text package/haproxy/alpine-apk.lock "ALPINE_ZLIB_VERSION='1.3.2-r1'" require_text package/haproxy/Dockerfile 'TARGET=linux-musl' require_text package/haproxy/Dockerfile '"tini=${ALPINE_TINI_VERSION}"' require_text .github/workflows/security-release-gate.yml 'TRIVY_IMAGE: ghcr.io/aquasecurity/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969'