From e68767d0f82bd68b933e7bb4803554e9a0aaba5f Mon Sep 17 00:00:00 2001 From: Mark Henderson Date: Tue, 15 Sep 2026 08:46:53 -0400 Subject: [PATCH 1/2] Squashed 'lightwalletd/' changes from 09593edbee..aa9acac2f9 aa9acac2f9 Merge pull request #599 from zcash/fix/crane-mirror-creds d79cd11005 Merge pull request #601 from zcash/dependabot/go_modules/google.golang.org/grpc-1.83.1 1cb42c5166 build(deps): bump google.golang.org/grpc from 1.82.1 to 1.83.1 51aba684c2 Merge pull request #600 from zecrocks/be/cve-dep-bumps 0e398d79cf docker: build in a stage, ship on debian:13-slim 5044f4b924 deps: bump golang.org/x/crypto for CVE-2026-56854 96fe9a145e deps: bump golang.org/x/net for CVE-2026-46600 a3cb34c5e6 deps: bump golang.org/x/text for CVE-2026-56852 77df3be44e CI: fix the zodlinc mirror step, which has never succeeded git-subtree-dir: lightwalletd git-subtree-split: aa9acac2f95e596f0edf9a3750ec7751d943e614 --- .github/workflows/CI.yaml | 17 ++++----------- Dockerfile | 20 +++++++++++++----- go.mod | 12 +++++------ go.sum | 44 +++++++++++++++++++-------------------- 4 files changed, 47 insertions(+), 46 deletions(-) diff --git a/.github/workflows/CI.yaml b/.github/workflows/CI.yaml index 2181a2fe..07725c16 100644 --- a/.github/workflows/CI.yaml +++ b/.github/workflows/CI.yaml @@ -62,12 +62,7 @@ jobs: electriccoinco/lightwalletd:latest - name: Push to zodlinc - # crane copy with explicit --src-creds and --dst-creds avoids the - # docker login session conflict (both registries are docker.io but - # different org credentials). env: - SRC_USER: ${{ secrets.DOCKERHUB_USERNAME }} - SRC_PASS: ${{ secrets.DOCKERHUB_PASSWORD }} DST_USER: ${{ secrets.ZODLINC_DOCKERHUB_USERNAME }} DST_PASS: ${{ secrets.ZODLINC_DOCKERHUB_PASSWORD }} run: | @@ -75,11 +70,7 @@ jobs: go install github.com/google/go-containerregistry/cmd/crane@v0.21.8 # go install writes to GOPATH/bin, which is not on PATH in this job. CRANE="$(go env GOPATH)/bin/crane" - "${CRANE}" copy \ - --src-creds "${SRC_USER}:${SRC_PASS}" \ - --dst-creds "${DST_USER}:${DST_PASS}" \ - electriccoinco/lightwalletd:${TAG} zodlinc/lightwalletd:${TAG} - "${CRANE}" copy \ - --src-creds "${SRC_USER}:${SRC_PASS}" \ - --dst-creds "${DST_USER}:${DST_PASS}" \ - electriccoinco/lightwalletd:latest zodlinc/lightwalletd:latest + # The source repo is public, so only the destination needs credentials. + "${CRANE}" auth login index.docker.io -u "${DST_USER}" -p "${DST_PASS}" + "${CRANE}" copy electriccoinco/lightwalletd:${TAG} zodlinc/lightwalletd:${TAG} + "${CRANE}" copy electriccoinco/lightwalletd:latest zodlinc/lightwalletd:latest diff --git a/Dockerfile b/Dockerfile index b25760ec..20ee93c7 100644 --- a/Dockerfile +++ b/Dockerfile @@ -3,19 +3,29 @@ FROM golang:1.25 AS lightwalletd_base ADD . /go/src/github.com/zcash/lightwalletd WORKDIR /go/src/github.com/zcash/lightwalletd -RUN make \ - && /usr/bin/install -c ./lightwalletd /usr/local/bin/ \ - && mkdir -p /var/lib/lightwalletd/db \ - && chown 2002:2002 /var/lib/lightwalletd/db +# CGO is not needed (no cgo imports), and disabling it yields a static +# binary that depends on nothing in the runtime stage. +ENV CGO_ENABLED=0 +RUN make && /usr/bin/install -c ./lightwalletd /usr/local/bin/ + +FROM debian:13-slim ARG LWD_USER=lightwalletd ARG LWD_UID=2002 +RUN apt-get update \ + && apt-get install -y --no-install-recommends ca-certificates \ + && rm -rf /var/lib/apt/lists/* + RUN useradd --home-dir "/srv/$LWD_USER" \ --shell /bin/bash \ --create-home \ --uid "$LWD_UID" \ - "$LWD_USER" + "$LWD_USER" \ + && mkdir -p /var/lib/lightwalletd/db \ + && chown "$LWD_UID:$LWD_UID" /var/lib/lightwalletd/db + +COPY --from=lightwalletd_base /usr/local/bin/lightwalletd /usr/local/bin/lightwalletd WORKDIR "/srv/$LWD_USER" diff --git a/go.mod b/go.mod index 49691cad..527f26f4 100644 --- a/go.mod +++ b/go.mod @@ -14,7 +14,7 @@ require ( github.com/spf13/cobra v1.8.0 github.com/spf13/viper v1.18.2 golang.org/x/exp v0.0.0-20230905200255-921286631fa9 - google.golang.org/grpc v1.82.1 + google.golang.org/grpc v1.83.1 google.golang.org/protobuf v1.36.11 gopkg.in/ini.v1 v1.67.0 ) @@ -48,10 +48,10 @@ require ( github.com/subosito/gotenv v1.6.0 // indirect go.uber.org/atomic v1.9.0 // indirect go.uber.org/multierr v1.9.0 // indirect - golang.org/x/crypto v0.52.0 // indirect - golang.org/x/net v0.55.0 // indirect - golang.org/x/sys v0.45.0 // indirect - golang.org/x/text v0.37.0 // indirect - google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 // indirect + golang.org/x/crypto v0.55.0 // indirect + golang.org/x/net v0.57.0 // indirect + golang.org/x/sys v0.47.0 // indirect + golang.org/x/text v0.41.0 // indirect + google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect gopkg.in/yaml.v3 v3.0.1 // indirect ) diff --git a/go.sum b/go.sum index 12ea6539..01d942a3 100644 --- a/go.sum +++ b/go.sum @@ -186,16 +186,16 @@ github.com/yuin/goldmark v1.1.27/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9de github.com/yuin/goldmark v1.2.1/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74= go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64= go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y= -go.opentelemetry.io/otel v1.43.0 h1:mYIM03dnh5zfN7HautFE4ieIig9amkNANT+xcVxAj9I= -go.opentelemetry.io/otel v1.43.0/go.mod h1:JuG+u74mvjvcm8vj8pI5XiHy1zDeoCS2LB1spIq7Ay0= -go.opentelemetry.io/otel/metric v1.43.0 h1:d7638QeInOnuwOONPp4JAOGfbCEpYb+K6DVWvdxGzgM= -go.opentelemetry.io/otel/metric v1.43.0/go.mod h1:RDnPtIxvqlgO8GRW18W6Z/4P462ldprJtfxHxyKd2PY= -go.opentelemetry.io/otel/sdk v1.43.0 h1:pi5mE86i5rTeLXqoF/hhiBtUNcrAGHLKQdhg4h4V9Dg= -go.opentelemetry.io/otel/sdk v1.43.0/go.mod h1:P+IkVU3iWukmiit/Yf9AWvpyRDlUeBaRg6Y+C58QHzg= -go.opentelemetry.io/otel/sdk/metric v1.43.0 h1:S88dyqXjJkuBNLeMcVPRFXpRw2fuwdvfCGLEo89fDkw= -go.opentelemetry.io/otel/sdk/metric v1.43.0/go.mod h1:C/RJtwSEJ5hzTiUz5pXF1kILHStzb9zFlIEe85bhj6A= -go.opentelemetry.io/otel/trace v1.43.0 h1:BkNrHpup+4k4w+ZZ86CZoHHEkohws8AY+WTX09nk+3A= -go.opentelemetry.io/otel/trace v1.43.0/go.mod h1:/QJhyVBUUswCphDVxq+8mld+AvhXZLhe+8WVFxiFff0= +go.opentelemetry.io/otel v1.44.0 h1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU= +go.opentelemetry.io/otel v1.44.0/go.mod h1:BMgjTHL9WPRlRjL2oZCBTL4whCGtXch2H4BhOPIAyYc= +go.opentelemetry.io/otel/metric v1.44.0 h1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc= +go.opentelemetry.io/otel/metric v1.44.0/go.mod h1:8O7hanEPBNgEMmybD3s2VBKcgWOCsA6tzHBPODAiquo= +go.opentelemetry.io/otel/sdk v1.44.0 h1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58= +go.opentelemetry.io/otel/sdk v1.44.0/go.mod h1:Osuydd3Se74nqjAKxid74N5eC+jfEqfTegHRnq58oK0= +go.opentelemetry.io/otel/sdk/metric v1.44.0 h1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI= +go.opentelemetry.io/otel/sdk/metric v1.44.0/go.mod h1:5B5pMARnXxKhltooO4xUuCBorl65a4EpnTalObqOigA= +go.opentelemetry.io/otel/trace v1.44.0 h1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk= +go.opentelemetry.io/otel/trace v1.44.0/go.mod h1:oLl1jrMQAVo6v3GAggN+1VH9VIz9iUSvW53sW1Q8PIE= go.uber.org/atomic v1.7.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE= go.uber.org/atomic v1.9.0/go.mod h1:fEN4uk6kAWBTFdckzkM89CLk9XfWZrxpCo0nPH17wJc= @@ -208,8 +208,8 @@ golang.org/x/crypto v0.0.0-20170930174604-9419663f5a44/go.mod h1:6SG95UA2DQfeDnf golang.org/x/crypto v0.0.0-20190308221718-c2843e01d9a2/go.mod h1:djNgcEr1/C05ACkg1iLfiJU5Ep61QUkGW8qpdssI0+w= golang.org/x/crypto v0.0.0-20191011191535-87dc89f01550/go.mod h1:yigFU9vqHzYiE8UmvKecakEJjdnWj3jj499lnFckfCI= golang.org/x/crypto v0.0.0-20200622213623-75b288015ac9/go.mod h1:LzIPMQfyMNhhGPhUkYOs5KpL4U8rLKemX1yGLhDgUto= -golang.org/x/crypto v0.52.0 h1:RMs7fP2rXdep0CftQlK8Uf+kibLm7qkCcradZWYz988= -golang.org/x/crypto v0.52.0/go.mod h1:1QgfPxDqh0T2M/elOJtp9RvuR95kVjir0e6/BvEmGbc= +golang.org/x/crypto v0.55.0 h1:+KWHjbgOaAQ66dh/YlkZKHlz9ZUlq61AFirAR9ntP8M= +golang.org/x/crypto v0.55.0/go.mod h1:uq0V9dE/fzQuJtbnL+2EhWOE63vo164FY8xqEnV9xis= golang.org/x/exp v0.0.0-20190121172915-509febef88a4/go.mod h1:CJ0aWSM057203Lf6IL+f9T1iT9GByDxfZKAQTCR3kQA= golang.org/x/exp v0.0.0-20230905200255-921286631fa9 h1:GoHiUyI/Tp2nVkLI2mCxVkOjsbSXD66ic0XW0js0R9g= golang.org/x/exp v0.0.0-20230905200255-921286631fa9/go.mod h1:S2oDrQGGwySpoQPVqRShND87VCbxmc6bL1Yd2oYrm6k= @@ -231,8 +231,8 @@ golang.org/x/net v0.0.0-20200226121028-0de0cce0169b/go.mod h1:z5CRVTTTmAJ677TzLL golang.org/x/net v0.0.0-20200520004742-59133d7f0dd7/go.mod h1:qpuaurCH72eLCgpAm/N6yyVIVM9cpaDIP3A8BGJEC5A= golang.org/x/net v0.0.0-20200813134508-3edf25e44fcc/go.mod h1:/O7V0waA8r7cgGh81Ro3o1hOxt32SMVPicZroKQ2sZA= golang.org/x/net v0.0.0-20201021035429-f5854403a974/go.mod h1:sp8m0HH+o8qH0wwXwYZr8TS3Oi6o0r6Gce1SSxlDquU= -golang.org/x/net v0.55.0 h1:bcvxaJn3e1U6InsFWt1JUq1aSjnRxLzT2rtD2KfkDF8= -golang.org/x/net v0.55.0/go.mod h1:L5U2KuzuOe1lY7Z+aWVIKK6qEeJXnXV9yzGA+WCHJww= +golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE= +golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU= golang.org/x/oauth2 v0.0.0-20180821212333-d2e6202438be/go.mod h1:N/0e6XlmueqKjAGxoOufVs8QHGRruUQn6yWY3a++T0U= golang.org/x/sync v0.0.0-20180314180146-1d60e4601c6f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= golang.org/x/sync v0.0.0-20181108010431-42b317875d0f/go.mod h1:RxMgew5VJxzue5/jJTE5uejpjVlOe/izrB70Jof72aM= @@ -253,13 +253,13 @@ golang.org/x/sys v0.0.0-20200814200057-3d37ad5750ed/go.mod h1:h1NjWce9XRLGQEsW7w golang.org/x/sys v0.0.0-20200930185726-fdedc70b468f/go.mod h1:h1NjWce9XRLGQEsW7wpKNCjG9DtNlClVuFLEZdDNbEs= golang.org/x/sys v0.0.0-20211025201205-69cdffdb9359/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= golang.org/x/sys v0.0.0-20220715151400-c0bba94af5f8/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg= -golang.org/x/sys v0.45.0 h1:dO4czNzziLiiXplLQgBCEpCvXQ3dnkn0SdaZSYdQ+FY= -golang.org/x/sys v0.45.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= +golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs= +golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw= golang.org/x/text v0.3.0/go.mod h1:NqM8EUOU14njkJ3fqMW+pc6Ldnwhi/IjpwHt7yyuwOQ= golang.org/x/text v0.3.2/go.mod h1:bEr9sfX3Q8Zfm5fL9x+3itogRgK3+ptLWKqgva+5dAk= golang.org/x/text v0.3.3/go.mod h1:5Zoc/QRtKVWzQhOtBMvqHzDpF6irO9z98xDceosuGiQ= -golang.org/x/text v0.37.0 h1:Cqjiwd9eSg8e0QAkyCaQTNHFIIzWtidPahFWR83rTrc= -golang.org/x/text v0.37.0/go.mod h1:a5sjxXGs9hsn/AJVwuElvCAo9v8QYLzvavO5z2PiM38= +golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8= +golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M= golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190114222345-bf090417da8b/go.mod h1:n7NCudcB/nEzxVGmLbDWY5pfWTLqBcC2KZ6jyYvM4mQ= golang.org/x/tools v0.0.0-20190226205152-f727befe758c/go.mod h1:9Yl7xja0Znq3iFh3HoIrodX9oNMXvdceNzlUR8zjMvY= @@ -280,15 +280,15 @@ google.golang.org/appengine v1.4.0/go.mod h1:xpcJRLb0r/rnEns0DIKYYv+WjYCduHsrkT7 google.golang.org/genproto v0.0.0-20180817151627-c66870c02cf8/go.mod h1:JiN7NxoALGmiZfu7CAH4rXhgtRTLTxftemlI0sWmxmc= google.golang.org/genproto v0.0.0-20190819201941-24fa4b261c55/go.mod h1:DMBHOl98Agz4BDEuKkezgsaosCRResVns1a3J2ZsMNc= google.golang.org/genproto v0.0.0-20200423170343-7949de9c1215/go.mod h1:55QSHmfGQM9UVYDPBsyGGes0y52j32PQ3BqQfXhyH3c= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478 h1:RmoJA1ujG+/lRGNfUnOMfhCy5EipVMyvUE+KNbPbTlw= -google.golang.org/genproto/googleapis/rpc v0.0.0-20260414002931-afd174a4e478/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa h1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk= +google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa/go.mod h1:4Hqkh8ycfw05ld/3BWL7rJOSfebL2Q+DVDeRgYgxUU8= google.golang.org/grpc v1.19.0/go.mod h1:mqu4LbDTu4XGKhr4mRzUsmM4RtVoemTSY81AxZiDr8c= google.golang.org/grpc v1.23.0/go.mod h1:Y5yQAOtifL1yxbo5wqy6BxZv8vAUGQwXBOALyacEbxg= google.golang.org/grpc v1.25.1/go.mod h1:c3i+UQWmh7LiEpx4sFZnkU36qjEYZ0imhYfXVyQciAY= google.golang.org/grpc v1.27.0/go.mod h1:qbnxyOmOxrQa7FizSgH+ReBfzJrCY1pSN7KXBS8abTk= google.golang.org/grpc v1.29.1/go.mod h1:itym6AZVZYACWQqET3MqgPpjcuV5QH3BxFS3IjizoKk= -google.golang.org/grpc v1.82.1 h1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE= -google.golang.org/grpc v1.82.1/go.mod h1:yzTZ1TB1Z3SG+LIYaI+WiE8D5+PZ3ArnrSp8zF3+/ZA= +google.golang.org/grpc v1.83.1 h1:HIO0+BEtBP6soyqvqC8sNUjZ7bTs+0hFQuFF+RAy++Y= +google.golang.org/grpc v1.83.1/go.mod h1:kDyl6SKsiHKt0uylY5gtn5cEjkrIOhQOGDgIc4JGwzQ= google.golang.org/protobuf v0.0.0-20200109180630-ec00e32a8dfd/go.mod h1:DFci5gLYBciE7Vtevhsrf46CRTquxDuWsQurQQe4oz8= google.golang.org/protobuf v0.0.0-20200221191635-4d8936d0db64/go.mod h1:kwYJMbMJ01Woi6D6+Kah6886xMZcty6N08ah7+eCXa0= google.golang.org/protobuf v0.0.0-20200228230310-ab0ca4ff8a60/go.mod h1:cfTl7dwQJ+fmap5saPgwCLgHXTUD7jkjRqWcaiX5VyM= From 4ed476a7dd3e706ee03f172dfb837bf041151207 Mon Sep 17 00:00:00 2001 From: Mark Henderson Date: Tue, 15 Sep 2026 08:47:48 -0400 Subject: [PATCH 2/2] doc: record the lightwalletd CVE pull and its deliberate tag un-pin Upstream cut v0.5.4 before shipping fixes for CVE-2026-56854 (x/crypto), CVE-2026-46600 (x/net) and CVE-2026-56852 (x/text), and has not cut another tag. Take master at aa9acac2f9 and note the un-pin so the next watch run does not read it as drift. Co-Authored-By: Claude Opus 5 (1M context) --- CHANGELOG.md | 17 +++++++++++++++++ SUBTREES.md | 6 +++++- 2 files changed, 22 insertions(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 077e5c11..817937ad 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -6,6 +6,23 @@ in the GitHub release body and refuses to release without one. Stage upcoming entries under `## Unreleased`, then retitle the section to the version (with date) before dispatching the release. +## Unreleased + +### Security + +- lightwalletd: pull upstream `master` to `aa9acac2f9`, nine commits past + `v0.5.4`, for three dependency CVE fixes: `golang.org/x/crypto` + (CVE-2026-56854, `5044f4b924`), `golang.org/x/net` (CVE-2026-46600, + `96fe9a145e`) and `golang.org/x/text` (CVE-2026-56852, `a3cb34c5e6`). + Upstream has not cut a tag carrying them, so the subtree is deliberately + un-pinned until `v0.5.5`; see SUBTREES.md. + +### Changed + +- lightwalletd: `google.golang.org/grpc` 1.82.1 to 1.83.1 (`1cb42c5166`), and + the image now builds in a stage and ships on `debian:13-slim` + (`0e398d79cf`). + ## v29 - 2026-09-07 ### Added diff --git a/SUBTREES.md b/SUBTREES.md index 1799fdbc..3a91c4ad 100644 --- a/SUBTREES.md +++ b/SUBTREES.md @@ -32,7 +32,11 @@ Notes: 2026-08-19 cohort, which is what zallet builds against. - **lightwalletd** is the original Go light client server (Zaino serves the same protocol in the Z3 stack). Vendored as the platform for private-lookup (PIR) - experimentation. Tracks `master`, pinned to a release tag (currently `v0.5.4`). + experimentation. Tracks `master`, normally pinned to a release tag. + **Deliberately un-pinned as of 2026-09-15**, at `aa9acac2f9`, nine commits past + `v0.5.4`: upstream shipped three CVE dependency bumps (x/crypto CVE-2026-56854, + x/net CVE-2026-46600, x/text CVE-2026-56852) after cutting that tag and has not + cut another. Re-pin when `v0.5.5` appears. ## Why subtrees (not submodules)