GeezerVisonThe World Wide Web, restored to 800 pixels of glory. | |
| Home|About|Gaming cabinet|Archives|How it works|Starter sites | |
GeezerVison is showing github.com — fix: bump Go to 1.26.10, terraform to 1.16.7, alpine to 3.24.3 (CVE-2026-111943) by sreya · Pull Request #31301 · coder/coder Conversation
Collaborator
Mitigates CVE-2026-111943 (compromised eMudhra intermediate CAs).
Verification:
Backports to Decision log
Sorry, something went wrong. Uh oh!
There was an error while loading. Please reload this page. All reactionsBump the bundled Terraform binary from 1.16.6 to 1.16.7 across install.go, install.sh, Dockerfile.base, mise.toml, mise.lock, flake.nix, and the airgap docs example. Checksums come from the GPG-verified terraform_1.16.7_SHA256SUMS. Regenerate the testdata fixture fingerprint. Bump the base image from alpine 3.24.2 to 3.24.3 so it ships ca-certificates-bundle 20261020-r0 (3.24.2 ships 20260909-r0). Go 1.26.10 no longer trusts certificates issued through the compromised eMudhra intermediate CAs.
Contributor
All reactions
Sorry, something went wrong. Uh oh!
There was an error while loading. Please reload this page.
This was referenced
sreya
marked this pull request as ready for review
Contributor
There was a problem hiding this comment. Choose a reason for hiding this commentThe reason will be displayed to describe this comment to others. Learn more. I'm a codeowner of the airgap docs page, which is fine. If you want me to review the rest, just let me know.
Sorry, something went wrong. Uh oh!
There was an error while loading. Please reload this page. All reactions
cjfit
pushed a commit
that referenced
this pull request
Backport of #31301 to `release/2.35` for CVE-2026-111943 (compromised eMudhra intermediate CAs). - Go 1.26.9 to 1.26.10. - Terraform: `install.go` 1.14.5 (max 1.14.9) and image/mise 1.15.5 go to 1.16.7; max raised to 1.16.9. No 1.14.x or 1.15.x release carries the Go 1.26.10 rebuild (1.15.9 uses Go 1.25.10, 1.14.9 uses Go 1.25.8). - Base image `alpine:3.24.1` to `alpine:3.24.3`, which ships `ca-certificates-bundle-20261020-r0`. Verified: rebuilt `scripts/Dockerfile.base` on this branch (confirmed `ca-certificates-bundle-20261020-r0` and Terraform v1.16.7) and `go test ./provisioner/terraform/` passes. Local git hooks were skipped at the author's request; CI is the gate. Also cherry-picks #30922, which renews the SMTP test certificate that expired on 2026-10-18 (`TestSMTP` fails on every release branch without it). > Generated by Coder Agents on behalf of @sreya. --------- Co-authored-by: Michael Suchacz <[email protected]>
zenithwolf1000
pushed a commit
that referenced
this pull request
Backport of #31301 to `release/2.36` for CVE-2026-111943 (compromised eMudhra intermediate CAs). - Go 1.26.9 to 1.26.10. - Terraform 1.16.6 to 1.16.7. - Base image `alpine:3.24.1` to `alpine:3.24.3`, which ships `ca-certificates-bundle-20261020-r0`. Verified: rebuilt `scripts/Dockerfile.base` on this branch (confirmed `ca-certificates-bundle-20261020-r0` and Terraform v1.16.7) and `go test ./provisioner/terraform/` passes. Local git hooks were skipped at the author's request; CI is the gate. Also cherry-picks #30922, which renews the SMTP test certificate that expired on 2026-10-18 (`TestSMTP` fails on every release branch without it). > Generated by Coder Agents on behalf of @sreya. --------- Co-authored-by: Michael Suchacz <[email protected]> Co-authored-by: Cedric Fitzgerald <[email protected]>
zenithwolf1000
pushed a commit
that referenced
this pull request
Backport of #31301 to `release/2.37` for CVE-2026-111943 (compromised eMudhra intermediate CAs). - Go 1.26.9 to 1.26.10. - Terraform 1.16.6 to 1.16.7. - Base image `alpine:3.24.1` to `alpine:3.24.3`, which ships `ca-certificates-bundle-20261020-r0`. Verified: rebuilt `scripts/Dockerfile.base` on this branch (confirmed `ca-certificates-bundle-20261020-r0` and Terraform v1.16.7) and `go test ./provisioner/terraform/` passes. Local git hooks were skipped at the author's request; CI is the gate. > Generated by Coder Agents on behalf of @sreya.
zenithwolf1000
approved these changes
Uh oh!
There was an error while loading. Please reload this page.
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
ReviewersUh oh!
There was an error while loading. Please reload this page. AssigneesLabels
None yet
ProjectsMilestoneNo milestoneDevelopmentSuccessfully merging this pull request may close these issues. Uh oh!
There was an error while loading. Please reload this page. 3 participantsAdd this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later. | |
| You are visitor 01402503 — GeezerVison does not store the pages you look up. Best viewed with Netscape Navigator 4.7 or Internet Explorer 6 at 800×600. No cookies required. |