Repository navigation
fix: clear govulncheck findings and drop x/crypto/openpgp - #546
Conversation
Replace rhysd/go-github-selfupdate with a GitHub-only implementation built on google/go-github/v93 and minio/selfupdate. The old library pulled google/go-github/v30, whose github package imports the unmaintained x/crypto/openpgp package (GO-2026-5932). Since x/crypto removed openpgp in v0.59.0, the dependency had to be replaced rather than upgraded. The new implementation keeps per-asset .sha256 validation, matches kool's exact kool-<os>-<arch> asset names (fixing arm6/arm7 asset selection) and avoids pulling the Gitea/GitLab SDKs. It also removes x/crypto, oauth2 and the archive dependencies from the module graph, and the release binary only grows by about 0.7 MB. Align the Go toolchain with 1.26.11 so the stdlib advisories fixed in 1.26.9-1.26.11 are cleared, address the stricter go vet checks that come with the go 1.26 language version, and bump golangci-lint to v2.15.0 for Go 1.26 support. After this change govulncheck reports no vulnerabilities.
github-actions
Bot
added
release-drafter:changed
Alpine 3.24 in docker:29-cli still ships zlib 1.3.2-r1, which grype flags as CVE-2026-4738 (critical). The Alpine v3.24 repository already provides 1.4-r0, so upgrade just that package when building the runtime image instead of waiting for a base image rebuild. Verified with grype v0.97.1: the image no longer reports the zlib finding. The remaining x/net critical comes from the docker-buildx plugin bundled in docker:29-cli, not from kool.
|
Reviewed the dependency/toolchain upgrade and replacement updater. Fixed the blockers in 8675725: validate the release version before downloading/installing, skip equal/older releases, select only compatible ARM assets from build metadata, bound HTTP requests, and surface rollback failures. Added update-path regression tests using temporary executable targets, including checksum failures, missing assets, HTTP failures, cancellation, and unchanged binaries on failures/no-ops. Validation passed with Go 1.26.11: Waiting for CI on the pushed revision before merge. The separate Node LTS issue #545 is not addressed by this PR. |
|
Published in 3.9.0, with all six binaries and verified SHA-256 files attached. Release-guide checks passed; isolated live upgrade from the old 3.8.1 updater to 3.9.0 passed and matched the release artifact, and the new updater correctly left an equal-version binary unchanged. |
govulncheckCI jobDescription
govulncheckreported 12 reachable vulnerabilities: 11 Go stdlib advisories andGO-2026-5932(x/crypto/openpgp, reached throughrhysd/go-github-selfupdate→google/go-github/v30).The openpgp finding cannot be fixed by bumping
x/crypto: openpgp was removed inx/crypto v0.59.0, sogo-github/v30— and therefore the current self-update library — no longer compiles against a fixed version. This replaces the self-update implementation instead of upgrading it.rhysd/go-github-selfupdatewith a GitHub-only updater built ongoogle/go-github/v93andminio/selfupdate..sha256validation.kool-<os>-<arch>release assets, which also fixes 32-bit ARM self-update (kool-linux-arm6/arm7were never matched before).openpgp,oauth2,xzandgo-github/v30from the module graph, and avoids the Gitea/GitLab SDKs that thecreativeprojects/go-selfupdatealternative pulls in.x/cryptoremains only as an indirect dependency at v0.59.0 (without openpgp). The module graph goes from 92 to 79 modules and the release binary grows by ~0.65 MB (+3.7%), versus ~+9 MB for the alternative.1.26.11(Dockerfile, CI, local helpers andgo.mod), clearing the stdlib advisories fixed in Go 1.26.9–1.26.11.go vetchecks enabled by the Go 1.26 language version (constant format strings and variadic forwarding).golangci-linttov2.15.0for Go 1.26 support.govulnchecknow reports zero vulnerabilities.Notes
Validation:
gofmt -l .,go vet ./...,go build ./...go test -race ./...— all packages, including new updater unit testsgolangci-lint run ./...— 0 issuesgovulncheck ./...— No vulnerabilities foundgolang:1.26.11) andkool --version3.8.1): asset selected and SHA-256 verifiedBehavior notes:
kool self-updatekeeps the same UX, asset naming convention and.sha256validation. No public commands, flags or output formats change.core/shell(Println/Printf) also corrects output when multiple arguments are passed; existing tests pass.go.modnow declarestoolchain go1.26.11, so local builds with an older toolchain auto-download it (GOTOOLCHAIN=auto).govulncheckworkflow stays report-only; it can be made gating in a follow-up now that the baseline is clean.