External/SnapOtter
1
0
Fork 0
mirror of https://github.com/snapotter-hq/SnapOtter.git synced 2026-08-03 07:46:42 +02:00
Code Issues Packages Projects Releases Wiki Activity

ci(release): fix the archive tsx path and patch the go-tools x/text HIGH (#665)

Browse Source 
Two latent bugs the v2.2.0 release run surfaced, both added by #649 and never run
in a real release (v2.1.0 had no archive-security job).

archive-security asserted tsx at the workspace root, but tsx is a prod dependency
of apps/api, so pnpm places its bin at apps/api/node_modules/.bin/tsx, where the
Docker CMD runs it. The root path never existed and failed the extract step on
both arches. Fixed to the apps/api path, proven against the real prebuilt-amd64
artifact.

The blocking Trivy scans would then have failed on CVE-2026-56852,
golang.org/x/text v0.38.0 -> v0.39.0, the only fixed CRITICAL/HIGH in the image,
compiled into caire and pdfcpu. Pinned to v0.39.0 in both go-tools modules,
verified building in the golang:1.25.12 toolchain with -mod=readonly and linking
v0.39.0, with a clean Trivy rescan.

Guards added for both the tsx path and the x/text pin. Non-releasable type so a
re-dispatch re-runs 2.2.0.
This commit is contained in:
SnapOtter
2026-07-29 19:05:30 +08:00
committed by GitHub
parent 4ae03b441b
commit 5c75a93484
7 changed files with 36 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
.github/workflows/release.yml
+7 -2
View File
@@ -367,8 +367,13 @@ jobs:
PY
test -s /tmp/prebuilt-root/snapotter/apps/web/dist/index.html
test -s /tmp/prebuilt-root/snapotter/apps/api/src/index.ts
test -x /tmp/prebuilt-root/snapotter/node_modules/.bin/tsx
/tmp/prebuilt-root/snapotter/node_modules/.bin/tsx --version
# tsx is a prod dependency of apps/api, so pnpm's workspace layout puts
# its bin under apps/api/node_modules/.bin, not the workspace root. This
# is exactly where the Docker CMD runs it from (WORKDIR apps/api,
# ./node_modules/.bin/tsx). The root path never existed; this assertion
# was added in #649 and this is its first real release run.
test -x /tmp/prebuilt-root/snapotter/apps/api/node_modules/.bin/tsx
( cd /tmp/prebuilt-root/snapotter/apps/api && ./node_modules/.bin/tsx --version )
echo "archive_name=${archive_name}" >> "$GITHUB_ENV"
- name: Install pinned Syft 1.42.3 from verified release bytes
docker/go-tools/caire/go.mod
+2
View File
@@ -6,3 +6,5 @@ require (
github.com/esimov/caire v1.5.0
golang.org/x/image v0.43.0
)
require golang.org/x/text v0.39.0 // indirect
docker/go-tools/caire/go.sum
+8
View File
@@ -22,11 +22,19 @@ golang.org/x/exp/shiny v0.0.0-20240707233637-46b078467d37 h1:SOSg7+sueresE4IbmmG
golang.org/x/exp/shiny v0.0.0-20240707233637-46b078467d37/go.mod h1:3F+MieQB7dRYLTmnncoFbb1crS5lfQoTfDgQy6K4N0o=
golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
golang.org/x/sys v0.22.0 h1:RI27ohtqKCnwULzJLqkv897zojh5/DwS/ENaMzUOaWI=
golang.org/x/sys v0.22.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
golang.org/x/term v0.0.0-20220722155259-a9ba230a4035 h1:Q5284mrmYTpACcm+eAKjKJH48BBwSyfJqmmGDTtT8Vc=
golang.org/x/term v0.0.0-20220722155259-a9ba230a4035/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
docker/go-tools/pdfcpu/go.mod
+2
View File
@@ -6,3 +6,5 @@ require (
github.com/pdfcpu/pdfcpu v0.13.0
golang.org/x/image v0.43.0
)
require golang.org/x/text v0.39.0 // indirect
docker/go-tools/pdfcpu/go.sum
+8
View File
@@ -22,7 +22,15 @@ golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988=
golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc=
golang.org/x/image v0.43.0 h1:FLxcP4ec2350nTfOC8ysKtqYSIFbk/QGjw1ZHNP4tsY=
golang.org/x/image v0.43.0/go.mod h1:rrpelvGFt+kLPAjPM4HeWPgrl0FtafueU//e5N0qk/Q=
golang.org/x/mod v0.37.0 h1:vF1DjpVEshcIqoEaauuHebaLk1O1forxjxBaVn884JQ=
golang.org/x/mod v0.37.0/go.mod h1:m8S8VeM9r4dzDwjrKO0a1sZP3YjeMamRRlD+fmR2Q/0=
golang.org/x/sync v0.21.0 h1:HLII4xRRTtCRkxYp4HNFF0Js/Og6q2i++KXbg0gHCwM=
golang.org/x/sync v0.21.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
golang.org/x/text v0.38.0 h1:sXmwo9DwP3OK9EZ7PqAdaooSGozfl/3a6/xJcbzPRhE=
golang.org/x/text v0.38.0/go.mod h1:YXZt3QhHUKYT53r2lLKFIVi6Ao1jdzrTR/KQ09qyxF4=
golang.org/x/text v0.39.0 h1:UbZz4pLOvn600D6Oh6GGEI6VAmndrEBLv8/6BEXzyus=
golang.org/x/text v0.39.0/go.mod h1:3UwRclnC2g0TU9x8PZiyfOajCd1zaUNHF9cvqcQZ+ZM=
golang.org/x/tools v0.47.0 h1:7Kn5x/d1svx/PzryTsqeoZN4TZwqeH5pGWjefhLi/1Q=
golang.org/x/tools v0.47.0/go.mod h1:dFHnyTvFWY212G+h7ZY4Vsp/K3U4/7W9TyVaAul8uCA=
gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
tests/unit/infra/release-supply-chain.test.ts
+5 -1
View File
@@ -119,7 +119,11 @@ describe("release supply-chain closure", () => {
expect(archiveSecurity).toContain("Verify immutable release tag binding");
expect(archiveSecurity).toContain("sha256sum --check --strict");
expect(archiveSecurity).toContain('filter="data"');
expect(archiveSecurity).toContain("node_modules/.bin/tsx --version");
// tsx is asserted at apps/api/node_modules/.bin, where pnpm's workspace layout
// actually places a workspace-package dependency and where the Docker CMD runs
// it. The root path never existed and failed the first real release run.
expect(archiveSecurity).toContain("apps/api/node_modules/.bin/tsx");
expect(archiveSecurity).not.toContain("snapotter/node_modules/.bin/tsx");
expect(archiveSecurity).toContain(
"cyclonedx-json=snapotter-v${VERSION}-archive-linux-${ARCH}-sbom.cdx.json",
);
tests/unit/security/dockerfile-build-args.test.ts
+4
View File
@@ -83,8 +83,12 @@ describe("Dockerfile build args", () => {
expect(module).toContain(contract.application);
expect(module).toContain("golang.org/x/image v0.43.0");
// x/text is pinned to the patched line the same way x/image is: 0.38.0
// carried CVE-2026-56852 (fixed in 0.39.0) and is linked into both binaries.
expect(module).toContain("golang.org/x/text v0.39.0");
expect(checksums).toContain(`${contract.application} h1:`);
expect(checksums).toContain("golang.org/x/image v0.43.0 h1:");
expect(checksums).toContain("golang.org/x/text v0.39.0 h1:");
expect(stage).toContain(
`COPY docker/go-tools/${contract.directory}/go.mod docker/go-tools/${contract.directory}/go.sum ./`,
);