Skip to content

Update archive key handling - #70

Merged
DamianZaremba merged 2 commits into
mainfrom
feature/update-archive-key-handling
Aug 31, 2026
Merged

Update archive key handling#70
DamianZaremba merged 2 commits into
mainfrom
feature/update-archive-key-handling

Conversation

@DamianZaremba

@DamianZaremba DamianZaremba commented Aug 31, 2026

Copy link
Copy Markdown
Member
  • bot config - add archive key
  • archive prefix key - change hashing algo

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

Trivy Security Scan

cnb/lifecycle/launcher

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib v1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib v1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

@DamianZaremba
DamianZaremba force-pushed the feature/update-archive-key-handling branch from e240518 to 42ee74d Compare August 31, 2026 14:39
@DamianZaremba
DamianZaremba force-pushed the feature/update-archive-key-handling branch from 0d5f263 to b984f68 Compare August 31, 2026 16:05
Base automatically changed from feature/refactor-bot-config to main August 31, 2026 16:14
@DamianZaremba
bot config - add archive key
7ee710b 
Currently this is tied to the password meaning anytime the password is
rotated the archive keys break, now that we are using bot passwords this
is potentially more often.

Split the usage so the archive key/secret is seperate; it is also not
super secure due to the hashing in use.
@DamianZaremba
archive prefix key - change hashing algo
c9865e8 
We rotated the password a while back, so essentially broke all the
existing archive keys.

Update the hashing algo to a more secure variant as you could in
principle brute force the password from a published key, since the
inputs are known (public source code).
@DamianZaremba
DamianZaremba force-pushed the feature/update-archive-key-handling branch from b984f68 to c9865e8 Compare August 31, 2026 16:14
@DamianZaremba
DamianZaremba merged commit 2d6a8b1 into main Aug 31, 2026
4 checks passed
@DamianZaremba
DamianZaremba deleted the feature/update-archive-key-handling branch August 31, 2026 16:16
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DamianZaremba