Skip to content

archive config - check prefix on config parse - #72

Merged
DamianZaremba merged 2 commits into
feature/refactor-archive-configfrom
feature/check-archive-prefix-at-config-parse
Aug 31, 2026
Merged

archive config - check prefix on config parse#72
DamianZaremba merged 2 commits into
feature/refactor-archive-configfrom
feature/check-archive-prefix-at-config-parse

Conversation

@DamianZaremba

@DamianZaremba DamianZaremba commented Aug 31, 2026 •
edited
Loading

Copy link
Copy Markdown
Member
  • centralise the logic
  • fixes index archives (archive prefix is only changed if we have an archive section, so this flip-flops currently)

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

Trivy Security Scan

cnb/lifecycle/launcher

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib v1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib v1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from 28baab2 to 4b95c9f Compare August 31, 2026 15:00
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch 2 times, most recently from 489b04b to a98bdbb Compare August 31, 2026 15:08
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch 3 times, most recently from 606b575 to c463baa Compare August 31, 2026 15:22
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from c463baa to 0712369 Compare August 31, 2026 16:06
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from 0712369 to 1c3359a Compare August 31, 2026 16:14
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from 1c3359a to f4dfdd9 Compare August 31, 2026 16:16
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from f4dfdd9 to 5f5afd2 Compare August 31, 2026 16:39
@DamianZaremba
DamianZaremba merged commit ea28176 into main Aug 31, 2026
5 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DamianZaremba