diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml index 4074361..62254f5 100644 --- a/.github/workflows/build.yml +++ b/.github/workflows/build.yml @@ -9,6 +9,26 @@ on: permissions: read-all jobs: + compatibility: + runs-on: ubuntu-22.04 + steps: + - uses: actions/checkout@v5 + - uses: actions/setup-go@v6 + with: + go-version: "1.27.1" + - name: Verify the pinned interpreter + run: test "$(go list -m -f '{{.Version}}' go.starlark.net)" = "v0.0.0-20260324133313-ffb3f39dd27a" + - name: Guard the compatible crypto dependency boundary + # v0.55.0 keeps Go 1.25 support. Its SSH/OpenPGP packages must not enter + # this application's build or tests; their advisories need a separate + # dependency and compatibility review before either package is used. + run: | + go list -deps -test ./... > "$RUNNER_TEMP/crypto-imports.txt" + if grep -E '^golang.org/x/crypto/(ssh|openpgp)(/|$)' "$RUNNER_TEMP/crypto-imports.txt"; then + echo "Review the crypto version before adding SSH or OpenPGP dependencies" + exit 1 + fi + container: runs-on: ubuntu-22.04 timeout-minutes: 15 @@ -38,7 +58,7 @@ jobs: with: # Match go.mod's compatibility floor; the shared workflow also tests # the current stable Go release. - go-floor: "1.26" + go-floor: "1.25" # Test-coverage ratchet (covcheck). The CLI-R0 characterization suite # brought total statement coverage to ~69.5% (cli 68.9 / config 94.1 / # util 92.7 / sys 77.8; main.go and web/ are the uncovered remainder). diff --git a/README.md b/README.md index 530320a..00e6eb5 100644 --- a/README.md +++ b/README.md @@ -395,7 +395,7 @@ host_name: MyStarCLIServer ### Prerequisites -- Go 1.26.8 or later (prebuilt binaries do not require a Go installation) +- Go 1.25.8 or later (prebuilt binaries do not require a Go installation) ### Building diff --git a/SECURITY.md b/SECURITY.md index 78a8fb8..24f721b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -36,5 +36,22 @@ do not preempt arbitrary Go builtins or impose a complete output-byte budget. Untrusted scripts or public multi-tenant services need a separate constrained worker, resource limits, and an independent security review. +The interpreter remains at `go.starlark.net@v0.0.0-20260324133313-ffb3f39dd27a`. +It predates the [upstream parser recursion fix](https://github.com/google/starlark-go/commit/5395d018f003e2a08bfbca6dcb2562acee700f62) +(GHSA-wcqm-92f8-mh2v): deeply nested source can terminate the host process. +This includes `check`, execution, generated source and modules reached through +`load()`. Step limits, cancellation and `recover` cannot protect this parsing +phase. Review all source and loaded modules; arbitrary source requires a +separately isolated host deployment. This release does not fix that parser risk. + Treat transcripts from `--record` as sensitive output: they can include input, results, and errors. Control their access and retention at the host level. + +## Optional dependency packages + +`golang.org/x/crypto v0.55.0` preserves the existing Go 1.25.8 source-build +floor. The CLI uses its SHA-3 package through request validation. SSH and +OpenPGP are outside the build and test dependency graph; their known advisories +remain in the module and are not described as fixed. CI rejects importing +those packages without another dependency and compatibility review. Final +release scans must still evaluate the actual target artifacts. diff --git a/examples/go.mod b/examples/go.mod index 26ec600..d37a3f0 100644 --- a/examples/go.mod +++ b/examples/go.mod @@ -5,7 +5,7 @@ // non-gating job. The replace points at the in-repo kit until starcli is tagged. module github.com/1set/starcli/examples -go 1.26.8 +go 1.25.8 require ( github.com/1set/starcli v0.0.0 @@ -25,7 +25,7 @@ require ( github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 // indirect github.com/spyzhov/ajson v0.9.6 // indirect github.com/starpkg/base v0.1.3 // indirect - go.starlark.net v0.0.0-20260708150628-5395d018f003 // indirect + go.starlark.net v0.0.0-20260324133313-ffb3f39dd27a // indirect go.uber.org/atomic v1.11.0 // indirect go.uber.org/multierr v1.9.0 // indirect go.uber.org/zap v1.24.0 // indirect diff --git a/examples/go.sum b/examples/go.sum index 495e694..6554772 100644 --- a/examples/go.sum +++ b/examples/go.sum @@ -17,8 +17,8 @@ github.com/chzyer/test v1.0.0/go.mod h1:2JlltgoNkt4TW/z9V/IzDdFaMTM2JPIi26O1pF38 github.com/davecgh/go-spew v1.1.1 h1:vj9j/u1bqnvCEfJOwUhtlOARqs3+rkHYY13jYWTU97c= github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38= github.com/google/go-cmp v0.5.4/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= -github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8= -github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU= +github.com/google/go-cmp v0.5.6 h1:BKbKCqvP6I+rmFHt06ZmyQtvB8xAkWdhFyr0ZUNZcxQ= +github.com/google/go-cmp v0.5.6/go.mod h1:v8dTdLbMG2kIc/vJvl+f65V22dbkXbowE6jgT/gNBxE= github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0= github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo= github.com/h2so5/here v0.0.0-20200815043652-5e14eb691fae h1:ghqI9EdSyyIL2iuOM9UIGVO7kEYQFVLKAUIFoOea5MY= @@ -41,8 +41,8 @@ github.com/starpkg/qrcode v0.1.0 h1:VULD2XBVacMq0c2WxJgdG0d3k0Z4EOSaFdYdkOB7bME= github.com/starpkg/qrcode v0.1.0/go.mod h1:itKiBubTuioyMM78bA+RTfwm/hH3EYG+W6NX0cscgh0= github.com/stretchr/testify v1.8.0 h1:pSgiaMZlXftHpm5L7V1+rVB+AZJydKsMxsQBIJw4PKk= github.com/stretchr/testify v1.8.0/go.mod h1:yNjHg4UonilssWZ8iaSj1OCr/vHnekPRkoO+kdMU+MU= -go.starlark.net v0.0.0-20260708150628-5395d018f003 h1:cAxcqHgW8fnmT0cEBU3TzvVYHIFt8IIGDMWUF6rImk4= -go.starlark.net v0.0.0-20260708150628-5395d018f003/go.mod h1:Iue6g6iirlfLoVi/DYCi5/x0h/bAOuWF3dULTKpt2Vo= +go.starlark.net v0.0.0-20260324133313-ffb3f39dd27a h1:w7OMj6r/AoxBpbfncRXaV18hjzIAFRytYaRILymmMRE= +go.starlark.net v0.0.0-20260324133313-ffb3f39dd27a/go.mod h1:YKMCv9b1WrfWmeqdV5MAuEHWsu5iC+fe6kYl2sQjdI8= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI= diff --git a/go.mod b/go.mod index 697846b..6f86fe3 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module github.com/1set/starcli -go 1.26.8 +go 1.25.8 require ( bitbucket.org/ai69/colorlogo v0.1.3 @@ -25,7 +25,7 @@ require ( github.com/starpkg/totp v0.1.0 github.com/starpkg/web v0.1.0 github.com/starpkg/yaml v0.1.0 - go.starlark.net v0.0.0-20260708150628-5395d018f003 + go.starlark.net v0.0.0-20260324133313-ffb3f39dd27a go.uber.org/atomic v1.11.0 go.uber.org/zap v1.24.0 golang.org/x/sys v0.47.0 @@ -119,7 +119,7 @@ require ( github.com/yuin/goldmark-emoji v1.0.6 // indirect go.uber.org/multierr v1.9.0 // indirect golang.org/x/arch v0.3.0 // indirect - golang.org/x/crypto v0.56.0 // indirect + golang.org/x/crypto v0.55.0 // indirect golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 // indirect golang.org/x/net v0.57.0 // indirect golang.org/x/sync v0.22.0 // indirect diff --git a/go.sum b/go.sum index 2a509f1..c9d6a52 100644 --- a/go.sum +++ b/go.sum @@ -288,8 +288,8 @@ github.com/yuin/goldmark v1.8.2 h1:kEGpgqJXdgbkhcOgBxkC0X0PmoPG1ZyoZ117rDVp4zE= github.com/yuin/goldmark v1.8.2/go.mod h1:ip/1k0VRfGynBgxOz0yCqHrbZXhcjxyuS66Brc7iBKg= github.com/yuin/goldmark-emoji v1.0.6 h1:QWfF2FYaXwL74tfGOW5izeiZepUDroDJfWubQI9HTHs= github.com/yuin/goldmark-emoji v1.0.6/go.mod h1:ukxJDKFpdFb5x0a5HqbdlcKtebh086iJpI31LTKmWuA= -go.starlark.net v0.0.0-20260708150628-5395d018f003 h1:cAxcqHgW8fnmT0cEBU3TzvVYHIFt8IIGDMWUF6rImk4= -go.starlark.net v0.0.0-20260708150628-5395d018f003/go.mod h1:Iue6g6iirlfLoVi/DYCi5/x0h/bAOuWF3dULTKpt2Vo= +go.starlark.net v0.0.0-20260324133313-ffb3f39dd27a h1:w7OMj6r/AoxBpbfncRXaV18hjzIAFRytYaRILymmMRE= +go.starlark.net v0.0.0-20260324133313-ffb3f39dd27a/go.mod h1:YKMCv9b1WrfWmeqdV5MAuEHWsu5iC+fe6kYl2sQjdI8= go.uber.org/atomic v1.11.0 h1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE= go.uber.org/atomic v1.11.0/go.mod h1:LUxbIzbOniOlMKjJjyPfpl4v+PKK2cNJn91OQbhoJI0= go.uber.org/goleak v1.1.11 h1:wy28qYRKZgnJTxGxvye5/wgWr1EKjmUDGYox5mGlRlI= @@ -301,8 +301,8 @@ go.uber.org/zap v1.24.0/go.mod h1:2kMP+WWQ8aoFoedH3T2sq6iJ2yDWpHbP0f6MQbS9Gkg= golang.org/x/arch v0.0.0-20210923205945-b76863e36670/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8= golang.org/x/arch v0.3.0 h1:02VY4/ZcO/gBOH6PUaoiptASxtXU10jazRCP865E97k= golang.org/x/arch v0.3.0/go.mod h1:5om86z9Hs0C8fWVUuoMHwpExlXzs5Tkyp9hOrfG7pp8= -golang.org/x/crypto v0.56.0 h1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y= -golang.org/x/crypto v0.56.0/go.mod h1:OMW5y6CY9l38uPLmxU6l6pwcXp1obtLo3e6gT7gQR2I= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8 h1:aAcj0Da7eBAtrTp03QXWvm88pSyOt+UgdZw2BFZ+lEw= golang.org/x/exp v0.0.0-20240325151524-a685a6edb6d8/go.mod h1:CQ1k9gNrJ50XIzaKCRR2hssIjF07kZFEiieALBM/ARQ= golang.org/x/mod v0.38.0 h1:MECBjubtXD7yj4HrhIUcywNaGeNVUdfVnxmPajOk4yk=