Repository navigation
Back up with the AWS CLI; build on Go 1.27.3 (CVE-2026-111943) - #20
Merged
Merged
Conversation
CVE-2026-111943: eight eMudhra intermediates under emSign ECC Root CA - G3 have trivially recoverable keys. - The operator image (0.3.2) trusts that root: its distroless base predates the fix. Rebuilt on the current base it does not. Go 1.25 gets no fix (only 1.26.10 and 1.27.3 block the intermediates in crypto/x509) and is out of support: the builder and CI move to Go 1.27.3. - Backup and restore Jobs used minio/mc, which is gone from Docker Hub (quay.io/minio needs a login): a Job on a node without it cached could not start. They now use amazon/aws-cli:2.38.5, whose botocore CA bundle no longer holds the root. A custom endpoint (MinIO, other S3-compatible stores) is addressed path-style; AWS by region; credentials still come from the same Secret, or the default AWS chain without one. Retention deletes the timestamped backup folders older than the cutoff, by name; restore downloads only the newest backup instead of the whole prefix. Checked end to end against a local S3 (rclone serve s3): upload, a 2020 backup removed, a non-backup folder kept, the newest backup restored. golangci-lint v2.8.0 cannot read Go 1.27 export data: v2.15.0. Its goconst no longer skips tests; test files are excluded again, and the six repeated literals it found in non-test code are constants now. The deprecated Result.Requeue on a StatefulSet update conflict is RequeueAfter: 1s.
austin-barrington
added a commit
that referenced
this pull request
Oct 24, 2026
Newest known HyperbyteDB: 0.9.3-beta, so a 0.9.3-beta cluster no longer reads NewerThanKnown; every capability needs 0.9.1-beta or older, so nothing renders differently. docs/compatibility.md: the v0.3.3 row and the backup, Go and CA changes (#20) in the v0.3.2 -> v0.3.3 notes. v0.3.3: each pod restarts once per rolling update (#19); backups use the AWS CLI since minio/mc can no longer be pulled, and the image is built with Go 1.27.3 on a base without the compromised eMudhra root (#20). Checked on kind with HyperbyteDB 0.9.3 (3-node sync_quorum and 1-node pools behind the proxy, 10 writes/s): one restart per pod, every acknowledged write on every pod, in three rolling updates.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
CVE-2026-111943: eight eMudhra intermediates under emSign ECC Root CA - G3 have trivially recoverable keys.
Operator image. 0.3.2, which n3 runs, trusts that root: its distroless base predates the fix.
manageris built with go1.27.3.crypto/x509) and is out of support. The builder and all CI workflows move to Go 1.27.3.Backup and restore jobs (a real outage).
minio/mcis gone from Docker Hub, andquay.io/minioneeds a login. A Job on a node without the image cached could not start at all.amazon/aws-cli:2.38.5. It's maintained, and it trusts botocore's own CA bundle, which no longer has the root (checked).--endpoint-url; AWS is addressed by region.mccouldn't do.mcwrote, so existing backups age out as before.rclone serve s3) with the real image:<prefix>/<timestamp>//snapshot/<timestamp>/, where the restore step looksLint. golangci-lint v2.8.0 can't read Go 1.27 export data, so it moves to v2.15.0.
goconstno longer skips tests, so test files are excluded again.Result.Requeueon a StatefulSet update conflict is nowRequeueAfter: 1s.Unit, envtest and lint all pass inside
golang:1.27.3.This is meant to ship with #19 as v0.3.3; whichever merges second adds this to the v0.3.3 notes in
docs/compatibility.md.