A Go toolchain without known vulnerabilities (0.13.1) #16
No Assignees
Notifications
Due Date
No due date set.
Dependencies
No dependencies set.
Reference: mi/werkdock#16
Reference in New Issue
Block a user
werkdock builds with a fixed Go toolchain without known vulnerabilities; see the PR document under docs/prs/.
🤖 Generated with Claude Code
🟠 werkrevisor ORANGE for
de892ef, superseded by the result for69785ca🟠 werkrevisor: ORANGE / FINDINGS
Change kind:
mixed.Reasons
Findings
[medium] Unpinned Toolchain at
go.mod:5, ORANGE, as a line comment[medium] Rollout Pending at
docs/werkdock.werkbaum:42-43, ORANGE, as a line comment[low] Bootstrap Minimum at
docs/prs/2026-10-20-PR#16-go-toolchain.md:25, hint, as a line commentClassifier
5 of 5 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 11900, calls 1, tokens in 11607 / out 21184 (reasoning included in out), duration 187.4 s, cost 0.0289 USD (reported), classifier `jev-1.13.0` calls 5, tokens in 3616, cost 0.0002 USD, finding judge `jev-1.13.0` calls 2, tokens in 3113, cost 0.0001 USD, build file judge `jev-1.13.0` calls 3, tokens in 2256, cost 0.0001 USD, phases: path_judge 0.3 s, classifier 0.4 s, context 0.2 s, model_review 186.0 s, finding_judge 0.3 s, config: defaults + host + repository (.werkrevisor.toml at main1 answer ignored because of a confidence below [classifier] min_confidence.
c30be8b).Reviewed head `de892ef5666cd28caaab3f2349698d39c3f6927b` against base `c30be8b44192e002aa0d85609154283830d93a5a`, werkrevisor 0.54.1.
werkrevisor: ORANGE / FINDINGS for
de892ef5666cd28caaab3f2349698d39c3f6927b.The result comment of werkrevisor holds the details.
@@ -0,0 +22,4 @@- `go.mod` names the toolchain go1.26.10, the newest Go on 2026-10-20.The `go` line stays at 1.22, the oldest language version the code needs.A Go older than go1.26.10 switches to it by `GOTOOLCHAIN=auto`, the default;[low] Bootstrap Minimum (werkrevisor)
hint
Automatic toolchain switching is implemented only by Go 1.21 and later. A user starting from Go 1.20 receives an unsupported
go.modor unknown-directive error rather than downloading Go 1.26.10, so the statement that any older Go switches automatically needs an explicit bootstrap-version qualification.Fixed in
69785ca: the PR document says that thego 1.22line needs Go 1.22 or newer to start the build, and only such a Go switches.@@ -41,2 +40,3 @@- [^] #workflow.checks: Licenses in each build, vulnerabilities per branch and of main each night (S)" werkdock PR#15: go-licenses and govulncheck.- [ ] #workflow.toolchain: Build with a Go toolchain without known vulnerabilities, and roll it out to mih09 (S) :#workflow.checks- [x] #workflow.toolchain: Build with a Go toolchain without known vulnerabilities, and roll it out to mih09 (S) :#workflow.checks[medium] Rollout Pending (werkrevisor)
ORANGE; Jev: real 0.79, severity 3.0 of 3
This item includes rollout to mih09, but the PR document says the binary is copied and the services are restarted only after merge, while the current mih09 binary still uses Go 1.22.2. Marking the item complete prematurely closes an outstanding manual deployment and can leave the API services running the known-vulnerable toolchain. Keep it pending until rollout or split source-toolchain completion from deployment.
Stays: in this plan
[x]means "merged, not yet deployed" (header of docs/werkdock.werkbaum and docs/agentic-workflow.md, "The Plan in Werkbaum"); the node turns[^]after the rollout to mih09, which the PR document lists as the step after the merge.@@ -2,2 +2,4 @@go 1.22toolchain go1.26.10[medium] Unpinned Toolchain (werkrevisor)
ORANGE; Jev: real 0.65, severity 2.6 of 3
A
toolchaindirective is not an exact pin: when the host Go is newer thango1.26.10, the Go command keeps that local toolchain, andtools/check-licensespreserves the same selection. Such builds are not made with the measured toolchain and conflict with the PR's fixed-toolchain guarantee. EnforceGOTOOLCHAIN=go1.26.10in release and CI builds, or describe the directive as only a minimum-version requirement.Fixed in
69785caas a description: go1.26.10 is the minimum toolchain. A newer Go carries its fixes, and tools/vulncheck checks the Go that actually builds, in each branch and each night; an exact pin would block a newer Go without a security reason.🟡 werkrevisor YELLOW for
69785ca, superseded by the result fore813858🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Findings
Doc/code mismatch at
docs/prs/2026-10-20-PR#16-go-toolchain.md:35, severity unknown, counted as mediumhint; Jev: real 0.82, severity 2.0 of 3
The PR document states "
tools/check-licensesnow runs go-licenses on the toolchain ofgo.mod", but the script does the opposite: it setsGOTOOLCHAIN=$(go env GOVERSION), which forces go-licenses to run on the local Go (e.g., 1.24.4 in the CI image), bypassing thetoolchain go1.26.10directive ingo.mod. The script's own comment speaks of "the toolchain that builds the module" and the surrounding paragraph explains that go-licenses was failing because it pulled in 1.26.10's stdlib; the lead sentence as written is misleading and contradicts the code.Classifier
5 of 5 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 11819, calls 1, tokens in 11512 / out 18134 (reasoning included in out), duration 236.1 s, cost 0.0252 USD (reported), classifier `jev-1.13.0` calls 5, tokens in 3671, cost 0.0002 USD, finding judge `jev-1.13.0` calls 1, tokens in 1902, cost 0.0001 USD, build file judge `jev-1.13.0` calls 3, tokens in 2253, cost 0.0001 USD, phases: path_judge 0.3 s, classifier 0.5 s, context 0.3 s, model_review 234.4 s, finding_judge 0.2 s, config: defaults + host + repository (.werkrevisor.toml at mainc30be8b).Reviewed head `69785ca8ba16b4474ac3a74b48b1d1260db47b11` against base `c30be8b44192e002aa0d85609154283830d93a5a`, werkrevisor 0.54.1.
🟠 werkrevisor ORANGE for
e813858, superseded by the result forcf83fd4🟠 werkrevisor: ORANGE / FINDINGS
Gate: the approval of mi came before this result; review requested again, please approve again after reading it; merge already scheduled.
Change kind:
mixed.Reasons
Findings
[medium] Pending Rollout at
docs/risk-analysis.md:58-61, ORANGE, as a line comment[low] Incorrect Minimum at
docs/prs/2026-10-20-PR#16-go-toolchain.md:23-27hint
A Go
toolchaindirective names a suggested, not minimum, toolchain. The same paragraph says a newer Go builds with itself, whileGOTOOLCHAIN=localcan also let an older Go build; calling go1.26.10 the minimum therefore overstates the guarantee and may lead source builders to overlook builds made with an older vulnerable standard library. Describe it as the default-selected toolchain or enforce the intended minimum.Classifier
5 of 5 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 11988, calls 1, tokens in 11692 / out 18820 (reasoning included in out), duration 146.1 s, cost 0.0261 USD (reported), classifier `jev-1.13.0` calls 5, tokens in 3703, cost 0.0002 USD, finding judge `jev-1.13.0` calls 1, tokens in 1833, cost 0.0001 USD, build file judge `jev-1.13.0` calls 3, tokens in 2253, cost 0.0001 USD, phases: path_judge 0.3 s, classifier 0.5 s, context 0.2 s, model_review 144.5 s, finding_judge 0.2 s, config: defaults + host + repository (.werkrevisor.toml at main1 answer ignored because of a confidence below [classifier] min_confidence.
c30be8b).Reviewed head `e81385827423f3f7ac19c9a3384333c36734f695` against base `c30be8b44192e002aa0d85609154283830d93a5a`, werkrevisor 0.54.1.
werkrevisor: ORANGE / FINDINGS for
e81385827423f3f7ac19c9a3384333c36734f695.The result comment of werkrevisor holds the details.
@@ -56,3 +56,3 @@| a new third-party Go dependency | standard library only; a dependency needs an RFC (RFC 0001) |Open risks:Open risk:[medium] Pending Rollout (werkrevisor)
ORANGE; Jev: real 0.60, severity 2.8 of 3
The PR removes the deployed binary's old-toolchain vulnerabilities from the open risks before the rollout occurs. Repository policy and the PR's own solution defer installation and service restarts until after merge, so
werkdock-api-*.servicestill serves the vulnerable go1.22.2 binary until those manual steps finish. Retain an explicit pending-deployment risk until the rollout is confirmed.Fixed in
cf83fd4: the open risks name the manual rollout; until it is done, mih09 runs the previous binary, on 2026-10-20 one of go1.22.2.New commits pushed, approval review dismissed automatically according to repository settings
🟡 werkrevisor YELLOW for
cf83fd4, superseded by the result fore9701fe🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Findings
Subject-Verb Disagreement at
docs/prs/2026-10-20-PR#16-go-toolchain.md:14, severity unknown, counted as mediumhint; Jev: real 0.70, severity 1.0 of 3
In the "Problem" section, the sentence "Which ones depends on the Go that builds werkdock, since
go.modnames none." has a plural subject ("Which ones") paired with the singular verb "depends", and reads as if a complement such as "are called" is missing ("Which ones [are called] depends..."). The reader must reconstruct the intended clause, so the wording should be tightened (e.g. "Which ones are called depends on the Go that builds werkdock" or "They depend on the Go that builds werkdock").Classifier
5 of 5 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 12022, calls 1, tokens in 11707 / out 12837 (reasoning included in out), duration 171.4 s, cost 0.0189 USD (reported), classifier `jev-1.13.0` calls 5, tokens in 3753, cost 0.0002 USD, finding judge `jev-1.13.0` calls 1, tokens in 1992, cost 0.0001 USD, build file judge `jev-1.13.0` calls 3, tokens in 2253, cost 0.0001 USD, phases: path_judge 0.3 s, classifier 0.4 s, context 0.2 s, model_review 169.7 s, finding_judge 0.2 s, config: defaults + host + repository (.werkrevisor.toml at main1 answer ignored because of a confidence below [classifier] min_confidence.
c30be8b).Reviewed head `cf83fd4b4d95813f2da8ec1646cc7f962f25a891` against base `c30be8b44192e002aa0d85609154283830d93a5a`, werkrevisor 0.54.1.
A Go toolchain without known vulnerabilities (0.12.2)to A Go toolchain without known vulnerabilities (0.13.1)737ee6df81toe9701feabf🟡 werkrevisor: YELLOW / HUMAN_REVIEW
Change kind:
mixed.Reasons
Classifier
6 of 6 units passed all questions (1 PR document(s)).
Usage: model `openrouter/minimax/minimax-m3`, LLM done, tokens counted before the call 13152, calls 1, tokens in 12772 / out 29192 (reasoning included in out), duration 336.5 s, cost 0.0388 USD (reported), classifier `jev-1.13.0` calls 6, tokens in 4397, cost 0.0002 USD, build file judge `jev-1.13.0` calls 3, tokens in 2253, cost 0.0001 USD, phases: path_judge 0.2 s, classifier 0.4 s, context 0.2 s, model_review 335.2 s, config: defaults + host + repository (.werkrevisor.toml at main7504b97).Reviewed head `e9701feabf79063cdfd563da8555b99b4d81f22f` against base `7504b97235d0ac1be84c73369e0f629a02bd672a`, werkrevisor 0.54.1.