chen21019 · Oct 10, 2026 · Oct 9, 2026 · Oct 9, 2026 · Oct 9, 2026
@@ -40,11 +40,11 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          archive="$RUNNER_TEMP/go1.27.0.linux-amd64.tar.gz"
+          archive="$RUNNER_TEMP/go1.27.2.linux-amd64.tar.gz"
           curl --proto '=https' --tlsv1.2 --fail --silent --show-error --location \
-            --output "$archive" https://go.dev/dl/go1.27.0.linux-amd64.tar.gz
+            --output "$archive" https://go.dev/dl/go1.27.2.linux-amd64.tar.gz
           printf '%s  %s\n' \
-            675c26c449cbb18fc24b74650de1eabbae6e16f64326fd85a283fb3b58280685 \
+            ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 \
             "$archive" | sha256sum -c -
           tar -C "$RUNNER_TEMP" -xzf "$archive"
           printf '%s\n' "$RUNNER_TEMP/go/bin" >> "$GITHUB_PATH"
@@ -75,7 +75,7 @@ jobs:
           artifact="dist/vsphere-cli-bundle-${version}-linux-amd64.tar.xz"
           gh release create "$GITHUB_REF_NAME" --repo "$GITHUB_REPOSITORY" --verify-tag \
             --title "vSphere CLI Bundle ${version}" \
-            --notes 'Deterministic Go 1.27.0 build from the pinned govmomi source coordinate, with pure numeric artifact versioning and checksummed provenance.' \
+            --notes 'Deterministic Go 1.27.2 build from the pinned govmomi source coordinate, with pure numeric artifact versioning and checksummed provenance.' \
             "$artifact" dist/SHA256SUMS
 
       - name: Clean generated files

@@ -8,10 +8,11 @@ The packaged `govc` executable is built from:
 - Repository: <https://github.com/vmware/govmomi>
 - Reference release tag: `v0.55.1`
 - Pinned post-release commit: `a668d9c60399552ea96782b8751c956720a0b8fb`
-- Security dependency: `golang.org/x/text v0.39.0`
+- Base upstream dependency: `golang.org/x/text v0.39.0`
+- Packaged security dependency: `golang.org/x/text v0.41.0`
 - License: Apache-2.0
 - License file: `LICENSE.txt`
 
-The pinned commit is the upstream dependency-maintenance commit published after `v0.55.1` that updates `golang.org/x/text` to its security-fixed version. It is recorded as an exact source coordinate, not represented as a direct descendant of the reference tag. The suffix on the previous artifact remains immutable historical evidence; the current publication uses pure numeric version `0.55.2`. The packaging recipe verifies the exact commit, dependency version, and SHA-256 of the upstream license before building.
+The pinned commit is an exact source coordinate, not represented as a direct descendant of the reference tag. The packaging recipe preserves every upstream Go source file and applies only an explicit `govc/go.mod` requirement plus official `govc/go.sum` checksum entries for `golang.org/x/text v0.41.0`, addressing [GO-2026-6629](https://pkg.go.dev/vuln/GO-2026-6629). It verifies the complete two-file change allowlist, exact dependency version and module checksums, and the upstream license SHA-256 before building pure numeric version `0.55.3` with Go 1.27.2.
 
 The root MIT license applies only to PastureStack-authored packaging code and documentation. The upstream copyright and Apache-2.0 terms remain intact and are reproduced in every release archive.
@@ -9,7 +9,7 @@ This repository contains an independent, deterministic packaging recipe for the
 The current recipe produces:
 
 ```text
-vsphere-cli-bundle-0.55.2-linux-amd64.tar.xz
+vsphere-cli-bundle-0.55.3-linux-amd64.tar.xz
 ```
 
 The archive contains:
@@ -21,9 +21,11 @@ vsphere-cli-bundle-SOURCES.txt
 vsphere-cli-bundle-THIRD-PARTY-NOTICES.txt
 ```
 
-Run `scripts/test` in an Ubuntu environment with Git, GNU tar, xz, and Go 1.27.0. The test performs two independent builds, compares the archives byte for byte, verifies the fixed source and license, checks the executable format and build metadata, and exercises the compatibility command surface.
+Run `scripts/test` in an Ubuntu environment with Git, GNU tar, xz, and Go 1.27.2. The test performs two independent builds, compares the archives byte for byte, verifies the fixed source and license, checks the executable format and build metadata, and exercises the compatibility command surface.
 
-The package pins the first upstream commit published after `v0.55.1` that updates `golang.org/x/text` to the security-fixed `v0.39.0`. Earlier publications remain immutable historical evidence. The current publication rebuilds and verifies the bundle as `v0.55.2`; every current and future PastureStack publication uses a pure numeric version, while product identity and provenance remain in package metadata rather than the version string.
+Every current and future PastureStack publication uses a pure numeric version, while product identity and provenance remain in package metadata rather than the version string. Earlier publications remain immutable historical evidence.
+
+The package preserves the exact govmomi source commit and uses Go 1.27.2. Its dependency-only override updates `golang.org/x/text` from `v0.39.0` to `v0.41.0` for [GO-2026-6629](https://pkg.go.dev/vuln/GO-2026-6629), changing only `govc/go.mod` and the verified official `govc/go.sum` entries; upstream Go source remains unchanged. The current recipe produces pure numeric version `0.55.3`. It is an unpublished recipe candidate; package publication is a separate reviewed step.
 
 ## Distribution model
 
@@ -37,4 +39,4 @@ See [ORIGIN.md](ORIGIN.md) for exact attribution and [sources.lock.env](sources.
 
 ## Current release gate
 
-Package reproducibility and offline command-surface checks do not prove a live vSphere lifecycle. Authenticated inventory, clone, power, delete, upgrade, rollback, and failure recovery remain required integration gates before production publication.
+This dependency-only release checks reproducible packaging, the unchanged upstream Go source, the fixed module and the existing offline CLI contracts. It does not claim a new live vSphere lifecycle test. Existing integration evidence is carried only for unchanged paths; live operations not exercised in this release remain explicitly untested. The assembled Server's artifact gate must confirm the fixed dependency.
@@ -5,6 +5,14 @@ set -euo pipefail
 repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 # shellcheck disable=SC1091
 source "$repo_root/sources.lock.env"
+discovery=${PASTURESTACK_GOVC_SHA256_DISCOVERY:-0}
+case "$discovery" in 0|1) ;; *) echo 'Invalid SHA-256 discovery mode' >&2; exit 2 ;; esac
+if [ "$discovery" = 0 ]; then
+    [[ $GOVC_BINARY_SHA256 =~ ^[0-9a-f]{64}$ ]] || {
+        echo 'A locked binary SHA-256 is required for formal packaging' >&2
+        exit 2
+    }
+fi
 
 output_dir=${1:-"$repo_root/dist"}
 work_root=${2:-}
@@ -48,6 +56,33 @@ if [ "$actual_commit" != "$GOVMOMI_COMMIT" ]; then
     exit 1
 fi
 
+module_dir="$source_dir/govc"
+base_x_text_version=$(cd "$module_dir" && go list -mod=readonly -m -f '{{.Version}}' golang.org/x/text)
+test "$base_x_text_version" = "v${GOVMOMI_BASE_X_TEXT_VERSION}"
+# Preserve immutable upstream Go source; only the requirement and official
+# checksum entries are updated for GO-2026-6629.
+(
+    cd "$module_dir"
+    go mod edit -require="golang.org/x/text@v${GOVMOMI_X_TEXT_VERSION}"
+    GOSUMDB=sum.golang.org GOPROXY=https://proxy.golang.org \
+        GONOSUMDB= GONOPROXY= GOPRIVATE= \
+        go mod download "golang.org/x/text@v${GOVMOMI_X_TEXT_VERSION}"
+)
+printf 'govc/go.mod\ngovc/go.sum\n' > "$work_root/expected-changed-files"
+git -C "$source_dir" diff --name-only | LC_ALL=C sort > "$work_root/actual-changed-files"
+cmp "$work_root/expected-changed-files" "$work_root/actual-changed-files"
+test -z "$(git -C "$source_dir" ls-files --others --exclude-standard)"
+git -C "$source_dir" show HEAD:govc/go.mod |
+    sed "s|^\([[:space:]]*golang.org/x/text \)v${GOVMOMI_BASE_X_TEXT_VERSION}\(.*\)$|\1v${GOVMOMI_X_TEXT_VERSION}\2|" \
+    > "$work_root/expected-go.mod"
+cmp "$work_root/expected-go.mod" "$module_dir/go.mod"
+{
+    git -C "$source_dir" show HEAD:govc/go.sum
+    printf 'golang.org/x/text v%s %s\n' "$GOVMOMI_X_TEXT_VERSION" "$GOVMOMI_X_TEXT_SUM"
+    printf 'golang.org/x/text v%s/go.mod %s\n' "$GOVMOMI_X_TEXT_VERSION" "$GOVMOMI_X_TEXT_GO_MOD_SUM"
+} | LC_ALL=C sort -u > "$work_root/expected-go.sum"
+LC_ALL=C sort -u "$module_dir/go.sum" > "$work_root/actual-go.sum"
+cmp "$work_root/expected-go.sum" "$work_root/actual-go.sum"
 actual_x_text_version=$(cd "$source_dir/govc" && go list -mod=readonly -m -f '{{.Version}}' golang.org/x/text)
 if [ "$actual_x_text_version" != "v${GOVMOMI_X_TEXT_VERSION}" ]; then
     printf 'Unexpected golang.org/x/text version: %s\n' "$actual_x_text_version" >&2
@@ -64,6 +99,12 @@ ldflags="-s -w -buildid= -X github.com/vmware/govmomi/cli/flags.BuildVersion=v${
         -ldflags "$ldflags" -o "$stage_dir/govc" .
 )
 
+if [ "$discovery" = 1 ]; then
+    printf 'GOVC_SHA256_DISCOVERY '
+    sha256sum "$stage_dir/govc"
+    printf 'Discovery only: no release archive produced\n'
+    exit 0
+fi
 printf '%s  %s\n' "$GOVC_BINARY_SHA256" "$stage_dir/govc" | sha256sum -c -
 
 {
@@ -80,7 +121,12 @@ Component: govc from vmware/govmomi
 Repository: $GOVMOMI_REPOSITORY
 Reference release tag: $GOVMOMI_REFERENCE_TAG
 Pinned source commit: $GOVMOMI_COMMIT
+Base upstream security dependency: golang.org/x/text v$GOVMOMI_BASE_X_TEXT_VERSION
+Dependency-only override: govc/go.mod and govc/go.sum; upstream Go source unchanged
 Security dependency: golang.org/x/text v$GOVMOMI_X_TEXT_VERSION
+Module checksum: $GOVMOMI_X_TEXT_SUM
+Module go.mod checksum: $GOVMOMI_X_TEXT_GO_MOD_SUM
+Security advisory: https://pkg.go.dev/vuln/GO-2026-6629
 License: Apache-2.0
 License path: $GOVMOMI_LICENSE_PATH
 License SHA-256: $GOVMOMI_LICENSE_SHA256
@@ -90,8 +136,9 @@ EOF
 
 cat > "$stage_dir/vsphere-cli-bundle-THIRD-PARTY-NOTICES.txt" <<EOF
 The govc executable is built from vmware/govmomi at the immutable post-release
-source coordinate recorded in vsphere-cli-bundle-SOURCES.txt. The pinned source
-includes the upstream golang.org/x/text security update. The upstream project
+source coordinate recorded in vsphere-cli-bundle-SOURCES.txt. The packaging
+recipe applies only the documented golang.org/x/text module requirement and
+official checksum override; upstream Go source is unchanged. The upstream project
 and its contributors retain their copyright and Apache-2.0 license rights.
 PastureStack provides only the independent packaging recipe and does not claim
 authorship of the upstream project or endorsement by its maintainers.

@@ -5,6 +5,7 @@ set -euo pipefail
 repo_root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)
 # shellcheck disable=SC1091
 source "$repo_root/sources.lock.env"
+test "${PASTURESTACK_GOVC_SHA256_DISCOVERY:-0}" = 0
 
 test_root=${1:-$(mktemp -d "${TMPDIR:-/tmp}/pasturestack-vsphere-cli-test.XXXXXX")}
 created_root=0
@@ -65,6 +66,10 @@ printf '%s\n' "$version_long" | grep -Fx "Build Date: ${GOVMOMI_RELEASE_DATE}" >
 
 grep -F "Pinned source commit: $GOVMOMI_COMMIT" "$test_root/extracted/vsphere-cli-bundle-SOURCES.txt" >/dev/null
 grep -F "Security dependency: golang.org/x/text v$GOVMOMI_X_TEXT_VERSION" "$test_root/extracted/vsphere-cli-bundle-SOURCES.txt" >/dev/null
+grep -Fx 'Dependency-only override: govc/go.mod and govc/go.sum; upstream Go source unchanged' "$test_root/extracted/vsphere-cli-bundle-SOURCES.txt" >/dev/null
+grep -Fx "Module checksum: $GOVMOMI_X_TEXT_SUM" "$test_root/extracted/vsphere-cli-bundle-SOURCES.txt" >/dev/null
+grep -Fx "Module go.mod checksum: $GOVMOMI_X_TEXT_GO_MOD_SUM" "$test_root/extracted/vsphere-cli-bundle-SOURCES.txt" >/dev/null
+grep -Fx 'Security advisory: https://pkg.go.dev/vuln/GO-2026-6629' "$test_root/extracted/vsphere-cli-bundle-SOURCES.txt" >/dev/null
 grep -F "License SHA-256: $GOVMOMI_LICENSE_SHA256" "$test_root/extracted/vsphere-cli-bundle-SOURCES.txt" >/dev/null
 grep -F 'Apache License' "$test_root/extracted/vsphere-cli-bundle-LICENSES.txt" >/dev/null
 grep -F 'MIT License' "$test_root/extracted/vsphere-cli-bundle-LICENSES.txt" >/dev/null

@@ -1,12 +1,15 @@
-GOVMOMI_VERSION=0.55.2
+GOVMOMI_VERSION=0.55.3
 GOVMOMI_REFERENCE_TAG=v0.55.1
 GOVMOMI_COMMIT=a668d9c60399552ea96782b8751c956720a0b8fb
 GOVMOMI_SHORT_COMMIT=a668d9c60399
 GOVMOMI_REPOSITORY=https://github.com/vmware/govmomi.git
 GOVMOMI_LICENSE_PATH=LICENSE.txt
 GOVMOMI_LICENSE_SHA256=cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30
 GOVMOMI_RELEASE_DATE=2026-07-07T14:02:15Z
-GOVMOMI_X_TEXT_VERSION=0.39.0
+GOVMOMI_BASE_X_TEXT_VERSION=0.39.0
+GOVMOMI_X_TEXT_VERSION=0.41.0
+GOVMOMI_X_TEXT_SUM=h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
+GOVMOMI_X_TEXT_GO_MOD_SUM=h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
 SOURCE_DATE_EPOCH=1783432935
-BUILD_GO_VERSION=1.27.0
-GOVC_BINARY_SHA256=f8c7d82a614655c83ee119e3f170a302a9b35d9ca7efd13bbc226df2d68e5d31
+BUILD_GO_VERSION=1.27.2
+GOVC_BINARY_SHA256=d3c4f4fab44403ec4110743b52da99f5ce3d7e3773c4661db8a87dec3ead8990