From 1a8dcabbdc7ac7933f1f97cb0e97a6b369539f71 Mon Sep 17 00:00:00 2001 From: Richard McDaniel <1130888+rmcdaniel@users.noreply.github.com> Date: Sun, 8 Nov 2026 20:26:15 +0000 Subject: [PATCH] Fix the Compose HTML-parser dependency in the devcontainer Build Compose with x/net 0.62 and its required module closure, keeping public checksum verification and readonly builds. Identify the repaired binary as 5.6.1+sample.2 and require it in image verification. Co-Authored-By: Codex --- .devcontainer/docker/Dockerfile | 2 +- .devcontainer/docker/verify-image.sh | 2 +- docker/go-tools/README.md | 12 +++++---- docker/go-tools/compose-go-net.patch | 39 +++++++++++++++++++--------- 4 files changed, 36 insertions(+), 19 deletions(-) diff --git a/.devcontainer/docker/Dockerfile b/.devcontainer/docker/Dockerfile index f27b712d..8a7901b8 100644 --- a/.devcontainer/docker/Dockerfile +++ b/.devcontainer/docker/Dockerfile @@ -43,7 +43,7 @@ RUN set -eux; \ git apply --unidiff-zero --check /tmp/compose-go-net.patch; \ git apply --unidiff-zero /tmp/compose-go-net.patch; \ go build -mod=readonly -trimpath \ - -ldflags='-s -w -X github.com/docker/compose/v5/internal.Version=5.6.1+sample.1' \ + -ldflags='-s -w -X github.com/docker/compose/v5/internal.Version=5.6.1+sample.2' \ -buildvcs=false -o /out/docker-compose ./cmd; \ go mod verify; \ go version -m /out/docker-compose; \ diff --git a/.devcontainer/docker/verify-image.sh b/.devcontainer/docker/verify-image.sh index dbe31541..6aeab055 100755 --- a/.devcontainer/docker/verify-image.sh +++ b/.devcontainer/docker/verify-image.sh @@ -20,7 +20,7 @@ rm -rf "$python_probe_dir" [[ "$(cargo --version | awk '{print $2}')" == "1.99.1" ]] [[ "$(docker --version | sed -E 's/^Docker version ([^,]+),.*/\1/')" == "29.9.2" ]] compose_version="$(docker compose version --short)" -[[ "${compose_version#v}" == "5.6.1+sample.1" ]] +[[ "${compose_version#v}" == "5.6.1+sample.2" ]] [[ "$(npm --version)" == "12.2.1+sample.1" ]] [[ "$(gosu --version)" == '1.20 (go1.27.3 on linux/'* ]] cli_version="${DURABLE_WORKFLOW_CLI_VERSION:-$(php -r '$tuple = json_decode(file_get_contents("/usr/local/share/sample-app/qualified-artifact-tuple.json"), true, flags: JSON_THROW_ON_ERROR); echo $tuple["artifacts"]["cli"];')}" diff --git a/docker/go-tools/README.md b/docker/go-tools/README.md index 24ec4795..8c87f0e9 100644 --- a/docker/go-tools/README.md +++ b/docker/go-tools/README.md @@ -6,11 +6,13 @@ Go 1.27.3 image on each native image-builder architecture. Source archives are SHA-256 checked before extraction; module downloads retain Go checksum checks, and compilation uses `-mod=readonly`, `CGO_ENABLED=0` and `GOTOOLCHAIN=local`. -Upstream Compose 5.6.1 still embeds `golang.org/x/net` 0.58.0, affected by -CVE-2026-78669. The zero-context patch upgrades it to 0.60.0 and the minimum -required `x/crypto` 0.57.0 / `x/text` 0.42.0 module versions, with recorded -`go.sum` checksums. The exact upstream archive hash protects the patch base. -The resulting Compose version is explicitly `5.6.1+sample.1`. +Upstream Compose 5.6.1 still embeds `golang.org/x/net` 0.58.0. The +zero-context patch selects 0.62.0, fixing CVE-2026-78669 and the HTML-parser +CVE-2026-78661. Its dependency closure selects `x/crypto` 0.58.0, `x/sys` +0.49.0, `x/term` 0.47.0, `x/text` 0.43.0 and `x/sync` 0.24.0, with recorded +`go.sum` checksums from the public Go checksum database. The exact upstream +archive hash protects the patch base. The resulting Compose version is +explicitly `5.6.1+sample.2`. Upstream gosu 1.20 fixes its user parser through `moby/sys/user` 0.4.1, but its prebuilt assets still use Go 1.24.6. Building the unchanged source with the current diff --git a/docker/go-tools/compose-go-net.patch b/docker/go-tools/compose-go-net.patch index a0f3dcbc..cc228390 100644 --- a/docker/go-tools/compose-go-net.patch +++ b/docker/go-tools/compose-go-net.patch @@ -1,22 +1,37 @@ --- a/go.mod +++ b/go.mod +@@ -53,2 +53,2 @@ +- golang.org/x/sync v0.23.0 +- golang.org/x/sys v0.48.0 ++ golang.org/x/sync v0.24.0 ++ golang.org/x/sys v0.49.0 @@ -121,3 +121,3 @@ - golang.org/x/crypto v0.56.0 // indirect - golang.org/x/net v0.58.0 // indirect - golang.org/x/text v0.41.0 // indirect -+ golang.org/x/crypto v0.57.0 // indirect -+ golang.org/x/net v0.60.0 // indirect -+ golang.org/x/text v0.42.0 // indirect ++ golang.org/x/crypto v0.58.0 // indirect ++ golang.org/x/net v0.62.0 // indirect ++ golang.org/x/text v0.43.0 // indirect --- a/go.sum +++ b/go.sum @@ -299,0 +300,2 @@ -+golang.org/x/crypto v0.57.0 h1:3ZVCjf8Ggz7zneR/EHRVx68Ctf+2pmIMP2UFhh9cC6M= -+golang.org/x/crypto v0.57.0/go.mod h1:Fdz0i5U6CoizGwLda9DttjSk6qlZo25zYNtR+ycvuZA= ++golang.org/x/crypto v0.58.0 h1:COkYLr4k7nDI4r6QtMML2AfzeIswWHAJthLS6K/M/54= ++golang.org/x/crypto v0.58.0/go.mod h1:Xh+kl5A+M0gMiWDytH2Hhr5Z7WbNCpv/eB/EFgfSk+w= @@ -303,0 +306,2 @@ -+golang.org/x/net v0.60.0 h1:79p50tfZlm0J9YfoDsSi639qSXNGVwEzOPLCxM2FsYU= -+golang.org/x/net v0.60.0/go.mod h1:2DA/G1UfVbCpQPeWTmMPGY7Cs2PkBkwu743bVX5PIVg= -@@ -313,0 +318 @@ -+golang.org/x/term v0.46.0 h1:3+OXuTbaKDgwk8jTi3aSLHRlmWqHEUDUtxnbFigO4YE= -@@ -315,0 +321,2 @@ -+golang.org/x/text v0.42.0 h1:JbOZXgfeCPU9gacVtYliJqOhD+zhrEqK4LfdpmlUZqI= -+golang.org/x/text v0.42.0/go.mod h1:ojzP1Z+2QtioaF8DTtO8K5q7JWVVYwZKenzujK0Zd0E= ++golang.org/x/net v0.62.0 h1:18ELalfM5+XNRwzM2nYqXsZQ9ByS1uhj2O/U7+5jqRY= ++golang.org/x/net v0.62.0/go.mod h1:WgDCOTH8iwtB66T4/GfI94AHo/hhdb7Hah9NDseQfiI= +@@ -305,0 +310,2 @@ ++golang.org/x/sync v0.24.0 h1:iqiDrGoDgyuvAKrhLQthUEzU/R378N78gXbBjxed7oA= ++golang.org/x/sync v0.24.0/go.mod h1:sUUOizhqBxiL6pEWpqNLUiaJn1ShEbZ6BBqskPbjZm0= +@@ -311,0 +318,2 @@ ++golang.org/x/sys v0.49.0 h1:XbzkgYJHdqh/8m2Uu0W/dQv8nktxx4BFHp1M0gROTXA= ++golang.org/x/sys v0.49.0/go.mod h1:hNLxWAXmnKAxqDtdwIYC4bM9oQPEecfsnNMuSxOs3og= +@@ -313,0 +322,2 @@ ++golang.org/x/term v0.47.0 h1:cpyOwQkr2Nzxe2p6KnrTG7Ei2wtzjsuSjhpXXepZ/BM= ++golang.org/x/term v0.47.0/go.mod h1:efAfAuG6RKABvg1ArGebRkvX6LXul14SM67o2e4mUCY= +@@ -315,0 +326,2 @@ ++golang.org/x/text v0.43.0 h1:1QivrlhwAsnMOcqgOdl9my7s9OyZl8O5/UGUTJVXoWc= ++golang.org/x/text v0.43.0/go.mod h1:hbSIYA/amXcRXTFSZqh8tWHEoqRvvbKPJ2uz/KU+a+s= +@@ -317,0 +330,2 @@ ++golang.org/x/tools v0.51.0 h1:k4Xc/1Om9jwkBJBo4NVLMSARBoWtK10mx+W5BnXCeAI= ++golang.org/x/tools v0.51.0/go.mod h1:9eEncMayCV6zRMGhR5eZEC2iBx98qWcF1HZ9Z7wJOoA=