From c0aa37ddad8d98b275d86ac2384817d00a7c41c8 Mon Sep 17 00:00:00 2001 From: thetechnologist1911 Date: Tue, 15 Sep 2026 09:54:13 -0400 Subject: [PATCH 1/2] chore(agent): build with Go 1.26.8 toolchain govulncheck reports 5 reachable stdlib vulnerabilities in binaries built with the 1.25 line: net/url, crypto/tls (x2), encoding/asn1 and net/http. All are fixed in go1.26.6. CI and the release workflow both resolve their Go version from agent/go.mod, so pinning the toolchain there is what actually changes the shipped binaries. Pin `toolchain` rather than raising the `go` directive so the minimum language version to build from source stays 1.25.0. After: 7 reachable vulnerabilities drop to 2, both daemon-side Moby issues (CVE-2026-34040, CVE-2026-33997) reached only through the docker client import, with no fixed module version published. --- agent/go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/agent/go.mod b/agent/go.mod index 1e77d12..7388e6f 100644 --- a/agent/go.mod +++ b/agent/go.mod @@ -2,6 +2,8 @@ module github.com/restorable-dev/restorable/agent go 1.25.0 +toolchain go1.26.8 + require ( github.com/containerd/errdefs v1.0.0 github.com/docker/docker v28.5.2+incompatible From 64b7a2e2c91a8cf1f1463e35d7e3e8fe6c3137c1 Mon Sep 17 00:00:00 2001 From: thetechnologist1911 Date: Tue, 15 Sep 2026 19:20:08 -0400 Subject: [PATCH 2/2] fix(e2e): pull MinIO from quay.io, pinned The S3 e2e pulled `minio/minio` by bare name. That repository no longer exists on Docker Hub, so the job fails at the pull with "access denied" before any agent code runs. Nothing in the repo changed; the image moved out from under us while the tree sat idle. quay.io is MinIO's own registry and carries the same releases. Pinned to a specific RELEASE tag rather than floating, since an unpinned reference is what let this break without a single failing run to point at. --- agent/e2e/run-s3.sh | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/agent/e2e/run-s3.sh b/agent/e2e/run-s3.sh index 5ff44dc..4258dcb 100755 --- a/agent/e2e/run-s3.sh +++ b/agent/e2e/run-s3.sh @@ -18,7 +18,7 @@ fail() { printf 'E2E FAIL: %s\n' "$*" >&2; exit 1; } log "starting MinIO (S3 endpoint)" docker run -d --name "$NAME" -p 9101:9000 \ -e MINIO_ROOT_USER=testaccess -e MINIO_ROOT_PASSWORD=testsecret123 \ - minio/minio server /data >/dev/null + quay.io/minio/minio:RELEASE.2025-09-07T16-13-09Z server /data >/dev/null for i in $(seq 1 30); do curl -sf -o /dev/null http://localhost:9101/minio/health/live && break sleep 1