From d283fa8a6dd6199a9e4837c6eeeab8b1c4f9f903 Mon Sep 17 00:00:00 2001 From: KoLDXr00T Date: Sun, 25 Oct 2026 09:25:34 +0000 Subject: [PATCH] ci: Go 1.26.10; the escape job runs without krun govulncheck has failed on main since 2026-10-23: GO-2026-6809 in crypto/x509, reachable from box serve, is fixed in Go 1.26.10, and go.mod pinned 1.26.9, which CI and releases build with. escape.yml symlinked krun to crun until #56 made box stop needing krun for firecracker. #56 has landed, so the step now fails if krun is on PATH instead, and the job stands for a firecracker-only host. --- .github/workflows/escape.yml | 6 +++--- go.mod | 2 +- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/.github/workflows/escape.yml b/.github/workflows/escape.yml index 664d041..6be81ca 100644 --- a/.github/workflows/escape.yml +++ b/.github/workflows/escape.yml @@ -46,9 +46,9 @@ jobs: sudo usermod --add-subuids 262144-4456447 --add-subgids 262144-4456447 "$USER" podman system migrate command -v crun || sudo apt-get install -y crun - # Until #56 lands, box up wants krun on PATH whatever the backend. - # Remove this then, so the job is a firecracker-only host. - sudo ln -sf "$(command -v crun)" /usr/local/bin/krun + # A firecracker-only host: firecracker never runs krun, and box must + # not need it (#56). Fail rather than test with it present. + if command -v krun; then echo "krun is on PATH; this job must run without it" >&2; exit 1; fi - name: host run: | diff --git a/go.mod b/go.mod index 72a8434..1d30fc9 100644 --- a/go.mod +++ b/go.mod @@ -1,6 +1,6 @@ module box -go 1.26.9 +go 1.26.10 require ( github.com/goccy/go-yaml v1.19.2