fix: patch Go standard library and runtime zlib

.github/workflows/codeql-verification.yml

@@ -48,12 +48,12 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"
           curl --fail --silent --show-error --location \
             --output "$archive" \
-            'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz'
+            'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz'
           printf '%s  %s\n' \
-            '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \
+            '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \
             "$archive" | sha256sum --check
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           "$RUNNER_TEMP/go/bin/go" version

.github/workflows/release.yml

@@ -45,11 +45,11 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"
           curl --fail --silent --show-error --location --output "$archive" \
-            'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz'
+            'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz'
           printf '%s  %s\n' \
-            '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \
+            '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \
             "$archive" | sha256sum --check
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           printf '%s\n' "$RUNNER_TEMP/go/bin" >> "$GITHUB_PATH"

.github/workflows/security-release-gate.yml

@@ -33,11 +33,11 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.3.linux-amd64.tar.gz"
           curl --fail --silent --show-error --location --output "$archive" \
-            'https://go.dev/dl/go1.27.0.linux-amd64.tar.gz'
+            'https://go.dev/dl/go1.27.3.linux-amd64.tar.gz'
           printf '%s  %s\n' \
-            '675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685' \
+            '65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40' \
             "$archive" | sha256sum --check
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           export PATH="$RUNNER_TEMP/go/bin:$PATH"

Dockerfile.dapper

@@ -7,9 +7,9 @@ ADD --checksum=sha256:6077d27c6b6f8b23590cb01ff877ed8c804a67a5442cc32b5a33da10d2
 
 ARG DAPPER_HOST_ARCH=amd64
 ARG DOCKER_BUILDX_VERSION=0.36.1
-ARG GO_VERSION=1.27.0
-ARG GO_LINUX_AMD64_SHA256=675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685
-ARG GO_LINUX_ARM64_SHA256=51798d2c42d0e1c6ed7fd9f48728b4193abac9e8aad6dbac2fe96a81f5909bda
+ARG GO_VERSION=1.27.3
+ARG GO_LINUX_AMD64_SHA256=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
+ARG GO_LINUX_ARM64_SHA256=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49
 
 ENV DEBIAN_FRONTEND=noninteractive
 ENV HOST_ARCH=${DAPPER_HOST_ARCH} \

README.md

@@ -14,17 +14,18 @@ ghcr.io/pasturestack/load-balancer-service:v0.9.27
 
 Release deployments pin the image by digest. The image is not intended to be started by itself because the control plane supplies metadata, API credentials, service links, port rules, and health-check configuration.
 
-This branch prepares the `v0.9.30` source candidate for drain weight recovery.
+This branch prepares the `v0.9.31` source candidate for drain weight recovery.
 The candidate has passed the focused local race tests and static checks described
 below. The signed `v0.9.28` tag is retained, but its release build failed because
 Alpine no longer served several locked package versions; no runtime image or
 GitHub release was published. The signed `v0.9.29` tag refreshed those pins and
 built the image, but its version smoke failed with a stdout broken pipe before
-scanning or publication. This candidate captures complete version-command output
-before checking it, preserving command failures and exact-version checks without
-an early-closing pipe. Protected pull-request CI and native PastureStack
-load-balancer QA remain release qualification gates; `v0.9.30` has not been tagged
-or published.
+scanning or publication. The signed `v0.9.30` tag fixed that smoke check and
+passed the build, but its image scan correctly blocked publication on the old Go
+standard library and runtime zlib. This candidate uses checksum-pinned Go 1.27.3
+and explicitly pins runtime zlib 1.3.2-r1; all scanner and attestation gates stay
+in place. Protected pull-request CI and native PastureStack load-balancer QA
+remain release qualification gates; `v0.9.31` has not been tagged or published.
 
 ## Compatibility
 
@@ -39,7 +40,7 @@ It also accepts the generic `CATTLE_ACCESS_KEY` and `CATTLE_SECRET_KEY` pair use
 
 The HAProxy logging helper keeps its configuration under the standard `/etc/rsyslog.d` path and does not require a daemon PID file. Logging initialization is validated independently before HAProxy configuration is applied.
 
-### Drain weight recovery (v0.9.30 source candidate)
+### Drain weight recovery (v0.9.31 source candidate)
 
 The controller records each backend's runtime weight before setting it to zero
 for `target.drain`, including drains that already have zero active sessions.

package/haproxy/Dockerfile

@@ -64,7 +64,8 @@ RUN set -eux; \
         "procps-ng=${ALPINE_PROCPS_NG_VERSION}" \
         "rsyslog=${ALPINE_RSYSLOG_VERSION}" \
         "su-exec=${ALPINE_SU_EXEC_VERSION}" \
-        "tini=${ALPINE_TINI_VERSION}"; \
+        "tini=${ALPINE_TINI_VERSION}" \
+        "zlib=${ALPINE_ZLIB_VERSION}"; \
     { \
         printf 'repository\thttps://dl-cdn.alpinelinux.org/alpine/v3.24/main\n'; \
         apk info -v | LC_ALL=C sort; \

package/haproxy/alpine-apk.lock

@@ -17,4 +17,5 @@ ALPINE_PROCPS_NG_VERSION='4.0.6-r0'
 ALPINE_RSYSLOG_VERSION='8.2604.0-r0'
 ALPINE_SU_EXEC_VERSION='0.3-r0'
 ALPINE_TINI_VERSION='0.19.0-r3'
+ALPINE_ZLIB_VERSION='1.3.2-r1'
 ALPINE_ZLIB_DEV_VERSION='1.3.2-r1'

scripts/supply-chain-check

@@ -16,14 +16,16 @@ require_text go.mod 'github.com/gorilla/websocket v1.5.3'
 require_text go.mod 'github.com/sirupsen/logrus v1.10.2'
 require_text go.mod 'github.com/urfave/cli/v3 v3.11.0'
 require_text go.mod 'golang.org/x/sys v0.47.0'
-require_text Dockerfile.dapper 'ARG GO_VERSION=1.27.0'
+require_text Dockerfile.dapper 'ARG GO_VERSION=1.27.3'
 require_text Dockerfile.dapper 'FROM docker:29.7.2-cli@sha256:000bb62ff495f986c9f5578eb67cc2cb98b91138eda81d7762d5371eb8a497fe AS docker-cli'
 require_text package/haproxy/Dockerfile 'ARG HAPROXY_VERSION=3.4.3'
 require_text package/haproxy/Dockerfile 'ARG ALPINE_IMAGE=docker.io/library/alpine:3.24@sha256:28bd5fe8b56d1bd048e5babf5b10710ebe0bae67db86916198a6eec434943f8b'
 require_text package/haproxy/Dockerfile '"libcrypto3=${ALPINE_LIBCRYPTO3_VERSION}"'
 require_text package/haproxy/Dockerfile '"libssl3=${ALPINE_LIBSSL3_VERSION}"'
 require_text package/haproxy/alpine-apk.lock "ALPINE_LIBCRYPTO3_VERSION='3.5.9-r0'"
 require_text package/haproxy/alpine-apk.lock "ALPINE_LIBSSL3_VERSION='3.5.9-r0'"
+require_text package/haproxy/Dockerfile '"zlib=${ALPINE_ZLIB_VERSION}"'
+require_text package/haproxy/alpine-apk.lock "ALPINE_ZLIB_VERSION='1.3.2-r1'"
 require_text package/haproxy/Dockerfile 'TARGET=linux-musl'
 require_text package/haproxy/Dockerfile '"tini=${ALPINE_TINI_VERSION}"'
 require_text .github/workflows/security-release-gate.yml 'TRIVY_IMAGE: ghcr.io/aquasecurity/trivy:0.74.0@sha256:62b1e65e8869bc4b4c6aa4fa2b21595256c7c2f6018a9d9ad61caf87187c1969'