claude-code
03312d484e
werkator build succeeded after 00:10
Co-authored-by: claude-code <claude-code@javagil.de>
52 lines
2.5 KiB
Markdown
52 lines
2.5 KiB
Markdown
# PR#16: A Go Toolchain without Known Vulnerabilities
|
|
|
|
> **WARNING:** This document describes only the change applied in this PR.
|
|
> It may already be outdated once the next PR is merged.
|
|
> Historic PR documentation is not maintained along with new PRs; treat it as a snapshot.
|
|
|
|
## Related Links
|
|
|
|
- [werkdock PR#15](https://git.javagil.de/mi/werkdock/pulls/15): the required checks, with `tools/vulncheck`.
|
|
|
|
## Problem
|
|
|
|
`go run ./tools/vulncheck` fails on `main`: the code calls vulnerable symbols of the Go standard library.
|
|
Which ones the code calls depends on the Go that builds werkdock, since `go.mod` names none.
|
|
|
|
## Non-Goals
|
|
|
|
- No change of the code.
|
|
- No automatic update of the toolchain; a newer Go comes with a PR, e.g. when the nightly build `vulnerability-data` turns red.
|
|
|
|
## Solution
|
|
|
|
- `go.mod` names go1.26.10, the newest Go on 2026-10-20, as its toolchain.
|
|
The `go` line stays at 1.22, the oldest language version the code needs, so Go 1.22 or newer can start the build.
|
|
Such a Go older than go1.26.10 switches to it by `GOTOOLCHAIN=auto`, the default;
|
|
so does the Go 1.24.4 of the CI's build image.
|
|
A newer Go builds with itself; it carries the fixes of go1.26.10, and `tools/vulncheck` checks the Go that builds.
|
|
`GOTOOLCHAIN=local` lets an older Go build, as before; the CI and the release binary do not set it.
|
|
- Measured with `go run ./tools/vulncheck`:
|
|
go1.26.8 has 7 called vulnerabilities, e.g. GO-2026-6617 in `net/http`; go1.26.9 and go1.26.10 have none.
|
|
The CI built with go1.24.4 so far, the binary on mih09 came from go1.22.2.
|
|
- Version 0.13.1 with a section in `CHANGELOG.md`: the binary changes, the CLI does not.
|
|
- `docs/risk-analysis.md` names the toolchain as a measure, and the manual rollout as an open risk:
|
|
until it is done, mih09 runs the binary of go1.22.2.
|
|
- `docs/werkdock.werkbaum`: the workflow nodes of PR#15 are in use, the toolchain node is merged.
|
|
|
|
`tools/check-licenses` now runs go-licenses on the toolchain that builds the module:
|
|
`go env GOVERSION` in the module names it, go1.26.10 also where the Go in `PATH` is older.
|
|
Built with the Go 1.24.4 of the build image, go-licenses took each package of the go1.26.10 standard library
|
|
for a package without module information, and the CI build failed.
|
|
|
|
After the merge, the binary goes to mih09:
|
|
`~/.werkator/bin/werkdock` of `mih09-werkator`, then a restart of the units `werkdock-api-*.service`.
|
|
|
|
## Open Questions
|
|
|
|
None.
|
|
|
|
## Additional Changes
|
|
|
|
- `docs/werkdock.werkbaum`: the Dockerfile build of werkdock PR#14 is merged.
|