Skip to content

archive config - rewrite if prefix is invalid - #73

Open
DamianZaremba wants to merge 1 commit into
feature/check-archive-prefix-at-config-parsefrom
feature/rewrite-broken-configs
Open

archive config - rewrite if prefix is invalid#73
DamianZaremba wants to merge 1 commit into
feature/check-archive-prefix-at-config-parsefrom
feature/rewrite-broken-configs

Conversation

@DamianZaremba

@DamianZaremba DamianZaremba commented Aug 31, 2026

Copy link
Copy Markdown
Member

Currently we log an error on every run with no feedback to the user.

Re-use the logic we have for dealing with once to explicitly re-write
the config to the calculated value.

This will fix some live instances (fallback value) and make archiving
behaviour more obuvious when the prefix is wrong.

In the worst case it will annoy the user into contacting us where we can
explain what is happening.

Note: This will update all configs regardless of if we need to archive

@github-actions

github-actions Bot commented Aug 31, 2026

Copy link
Copy Markdown

Trivy Security Scan

cnb/lifecycle/launcher

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib v1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib v1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib v1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib v1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib v1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.cdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

layers/sbom/launch/buildpacksio_lifecycle/launcher/sbom.spdx.json

Severity Package Installed Fixed CVE Title
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-27145 crypto/x509: golang: golang crypto/x509: Denial of Service via excessive processing of DNS SAN entries
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33811 net: golang: Go net package: Denial of Service via long CNAME response in LookupCNAME
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-33814 net/http/internal/http2: golang: golang.org/x/net: Go HTTP/2: Denial of Service via malformed SETTINGS_MAX_FRAME_SIZE frame
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-33818 encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39820 net/mail: golang: Go net/mail: Denial of Service via crafted email inputs
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-39821 golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing
🟠 HIGH stdlib 1.26.2 1.25.12, 1.26.5, 1.27.0-rc.2 CVE-2026-39822 golang: Go os.Root: Symlink following vulnerability allows directory traversal
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-39836 net: golang: Go net package: Denial of Service via NUL byte in Dial and LookupPort on Windows
🟠 HIGH stdlib 1.26.2 1.25.10, 1.26.3 CVE-2026-42499 net/mail: golang: net/mail: Denial of Service via pathological email address parsing
🟠 HIGH stdlib 1.26.2 1.25.11, 1.26.4 CVE-2026-42504 mime: golang: Golang MIME: Denial of Service via maliciously-crafted MIME header
🟠 HIGH stdlib 1.26.2 1.26.6, 1.27.0-rc.3 CVE-2026-46600 golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56853 net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56858 html/template: golang: Go html/template: Cross-Site Scripting via pathological input
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56859 encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56860 net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution
🟠 HIGH stdlib 1.26.2 1.25.13, 1.26.6, 1.27.0-rc.3 CVE-2026-56862 crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages

@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch 4 times, most recently from a98bdbb to 30b60bc Compare August 31, 2026 15:13
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch from 009b25e to 32c8c71 Compare August 31, 2026 15:14
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from 30b60bc to 606b575 Compare August 31, 2026 15:15
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch from 32c8c71 to a0c7959 Compare August 31, 2026 15:15
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from 606b575 to c463baa Compare August 31, 2026 15:22
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch 2 times, most recently from 0d83eae to f858145 Compare August 31, 2026 15:25
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from c463baa to 0712369 Compare August 31, 2026 16:06
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch 2 times, most recently from 0a65bdf to 423109d Compare August 31, 2026 16:11
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from 0712369 to 1c3359a Compare August 31, 2026 16:14
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch from 423109d to bf1e66f Compare August 31, 2026 16:14
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from 1c3359a to f4dfdd9 Compare August 31, 2026 16:16
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch from bf1e66f to 8730052 Compare August 31, 2026 16:16
@DamianZaremba
DamianZaremba force-pushed the feature/check-archive-prefix-at-config-parse branch from f4dfdd9 to 5f5afd2 Compare August 31, 2026 16:39
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch 2 times, most recently from 0771e88 to 5fe2310 Compare August 31, 2026 17:30
An error occurred while trying to automatically change base from feature/check-archive-prefix-at-config-parse to feature/refactor-archive-config August 31, 2026 17:40
@DamianZaremba DamianZaremba mentioned this pull request Aug 31, 2026
Open
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch from 5fe2310 to bbfd66b Compare September 1, 2026 13:02
@DamianZaremba
archive config - rewrite if prefix is invalid
a9cbf31 
Currently we log an error on every run with no feedback to the user.

Re-use the logic we have for dealing with `once` to explicitly re-write
the config to the calculated value.

This will fix some live instances (fallback value) and make archiving
behaviour more obuvious when the prefix is wrong.

In the worst case it will annoy the user into contacting us where we can
explain what is happening.

Note: This will update all configs regardless of if we need to archive
@DamianZaremba
DamianZaremba force-pushed the feature/rewrite-broken-configs branch from bbfd66b to a9cbf31 Compare September 1, 2026 13:03
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@DamianZaremba