mirror of
https://github.com/jetkvm/kvm.git
synced 2026-05-21 05:20:35 +00:00
Adam Shiervani
11b99d59fd
* Implement GPG signature verification for OTA updates - Added GPG signature verification to the OTA update process, ensuring that updates requiring signatures cannot be applied without them. - Introduced a new GPGVerifier struct to handle fetching and verifying signatures. - Updated the updateApp and updateSystem methods to check for signature URLs and download signatures as needed. - Enhanced error handling for missing signatures and verification failures. - Removed the old release.sh script as its functionality has been integrated into the Makefile for better release management. * Add tests for GPG signature verification in OTA updates * Refactor error message for missing GPG signature URL in OTA updates * Refactor OTA update process to improve signature handling - Introduced a new method for downloading component signatures, ensuring that updates requiring signatures cannot proceed without them. - Updated the Makefile to allow E2E tests to optionally include OTA tests based on the SKIP_OTA_E2E variable. - Enhanced the test_local_update.sh script to support signature file verification and inclusion during tests. - Improved error handling for missing signature URLs and added context cancellation checks in GPG key fetching. * Refactor GPG key caching to validate keyring before storing * Update Makefile to enhance E2E test process with optional OTA signature verification * Comment out non-working keyservers and update root key fingerprint * Add Ubunutu keyserver * Update root key fingerprint for GPG signature verification in OTA updates * Add signed OTA E2E test and full E2E test suite to Makefile - Introduced `test_e2e_signed` target for testing signed OTA updates with GPG signature verification. - Added `test_e2e_full` target to run both regular and signed OTA tests, requiring a signing key fingerprint. - Enhanced error handling for missing parameters in both test targets. * Update IP address extraction in test_local_update.sh to exclude all localhost addresses * Add GPG public key fetching tests with caching and error handling * Enhance build and testing scripts for signed OTA updates * Add fingerprint extraction and validation for GPG keys * Simplify bypass mechanism of OTA signature checks * Refactor E2E testing and release workflows * Enhance OTA testing framework and scripts * Improve local network IP detection in OTA helpers by implementing route-based detection as a primary method, falling back to interface scanning if necessary. * Add support for unsigned OTA version testing - Introduced a new script to test unsigned OTA updates with specific version checks. - Updated Makefile to include the new test script for unsigned OTA. - Enhanced existing E2E tests to validate version differences and ensure proper OTA behavior. - Improved error handling for required environment variables in the testing framework. * Update Makefile to include core E2E tests and enhance dev release validation - Added `test_core_e2e.sh` script execution to both production and development release workflows. - Improved user confirmation prompt before proceeding with the dev release. - Added completion messages to indicate successful test execution and readiness for release. * Enhance Makefile and testing scripts for improved OTA validation - Added a new script execution for testing unsigned OTA updates in the Makefile. - Updated E2E test configurations to exclude specific OTA tests and improve retry logic for video stream dimension retrieval. - Refactored mouse round-trip tests to remove unnecessary settle time parameters. * Final release confirmation of prod releases * Cleanup OTA code: eliminate redundant parsing, TOCTOU, and duplication - Remove double parseAndValidateKeyring call by threading validated keyring through fetchFromSingleKeyserver → fetchFromKeyservers → updateMemoryCache - Extract getKeyring() helper to deduplicate VerifySignature and VerifySignatureFromFile preamble - Replace os.Stat+os.Remove TOCTOU pattern with direct os.Remove ignoring os.ErrNotExist in downloadFile - Remove unnecessary fs.existsSync in mock server handler; check signaturePath variable directly Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * E2E: fix flaky tests, add unsigned OTA to dev test lane - Fix mouse roundtrip flakiness by increasing MOUSE_SETTLE_MS (50→150ms) - Export sshExec from helpers for ota-helpers.ts - Reduce overly conservative delays (polling, animations, reconnects) - Add waitForVideoDimensions helper with proper polling - Improve ensureLocalAuthMode to try known passwords before SSH reset - Add unsigned specific-version OTA test to `make test_e2e` target - Build baseline + dev binary with pinned VERSION_DEV to avoid timestamp drift Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> * Remove stale dev_release checklist item from PR templates Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
108 lines
4.4 KiB
Modula-2
108 lines
4.4 KiB
Modula-2
module github.com/jetkvm/kvm
|
|
|
|
go 1.24.4
|
|
|
|
require (
|
|
github.com/Masterminds/semver/v3 v3.4.0
|
|
github.com/ProtonMail/go-crypto v1.1.5
|
|
github.com/beevik/ntp v1.5.0
|
|
github.com/caarlos0/env/v11 v11.3.1
|
|
github.com/coder/websocket v1.8.14
|
|
github.com/coreos/go-oidc/v3 v3.16.0
|
|
github.com/creack/pty v1.1.24
|
|
github.com/erikdubbelboer/gspt v0.0.0-20210805194459-ce36a5128377
|
|
github.com/fsnotify/fsnotify v1.9.0
|
|
github.com/gin-contrib/logger v1.2.6
|
|
github.com/gin-gonic/gin v1.10.1
|
|
github.com/go-co-op/gocron/v2 v2.17.0
|
|
github.com/google/uuid v1.6.0
|
|
github.com/guregu/null/v6 v6.0.0
|
|
github.com/gwatts/rootcerts v0.0.0-20250901182336-dc5ae18bd79f
|
|
github.com/insomniacslk/dhcp v0.0.0-20250919081422-f80a1952f48e
|
|
github.com/mdlayher/ndp v1.1.0
|
|
github.com/pion/ice/v4 v4.1.0
|
|
github.com/pion/logging v0.2.4
|
|
github.com/pion/mdns/v2 v2.1.0
|
|
github.com/pion/webrtc/v4 v4.2.1
|
|
github.com/pojntfx/go-nbd v0.3.2
|
|
github.com/prometheus/client_golang v1.23.2
|
|
github.com/prometheus/common v0.67.2
|
|
github.com/prometheus/procfs v0.19.2
|
|
github.com/psanford/httpreadat v0.1.0
|
|
github.com/rs/xid v1.6.0
|
|
github.com/rs/zerolog v1.34.0
|
|
github.com/sourcegraph/tf-dag v0.2.2-0.20250131204052-3e8ff1477b4f
|
|
github.com/stretchr/testify v1.11.1
|
|
github.com/vearutop/statigz v1.5.0
|
|
github.com/vishvananda/netlink v1.3.1
|
|
go.bug.st/serial v1.6.4
|
|
golang.org/x/crypto v0.43.0
|
|
golang.org/x/net v0.46.0
|
|
golang.org/x/sys v0.37.0
|
|
google.golang.org/grpc v1.76.0
|
|
google.golang.org/protobuf v1.36.10
|
|
)
|
|
|
|
replace github.com/pojntfx/go-nbd v0.3.2 => github.com/chemhack/go-nbd v0.0.0-20241006125820-59e45f5b1e7b
|
|
|
|
require (
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/bytedance/sonic v1.14.0 // indirect
|
|
github.com/bytedance/sonic/loader v0.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.3.0 // indirect
|
|
github.com/cloudflare/circl v1.3.7 // indirect
|
|
github.com/cloudwego/base64x v0.1.6 // indirect
|
|
github.com/creack/goselect v0.1.2 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/gabriel-vasile/mimetype v1.4.9 // indirect
|
|
github.com/gin-contrib/sse v1.1.0 // indirect
|
|
github.com/go-jose/go-jose/v4 v4.1.3 // indirect
|
|
github.com/go-playground/locales v0.14.1 // indirect
|
|
github.com/go-playground/universal-translator v0.18.1 // indirect
|
|
github.com/go-playground/validator/v10 v10.27.0 // indirect
|
|
github.com/goccy/go-json v0.10.5 // indirect
|
|
github.com/jonboulle/clockwork v0.5.0 // indirect
|
|
github.com/josharian/native v1.1.0 // indirect
|
|
github.com/json-iterator/go v1.1.12 // indirect
|
|
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
|
|
github.com/leodido/go-urn v1.4.0 // indirect
|
|
github.com/mattn/go-colorable v0.1.14 // indirect
|
|
github.com/mattn/go-isatty v0.0.20 // indirect
|
|
github.com/mdlayher/packet v1.1.2 // indirect
|
|
github.com/mdlayher/socket v0.4.1 // indirect
|
|
github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
|
|
github.com/modern-go/reflect2 v1.0.2 // indirect
|
|
github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
|
|
github.com/pelletier/go-toml/v2 v2.2.4 // indirect
|
|
github.com/pierrec/lz4/v4 v4.1.14 // indirect
|
|
github.com/pilebones/go-udev v0.9.1 // indirect
|
|
github.com/pion/datachannel v1.5.10 // indirect
|
|
github.com/pion/dtls/v3 v3.0.9 // indirect
|
|
github.com/pion/interceptor v0.1.42 // indirect
|
|
github.com/pion/randutil v0.1.0 // indirect
|
|
github.com/pion/rtcp v1.2.16 // indirect
|
|
github.com/pion/rtp v1.8.27 // indirect
|
|
github.com/pion/sctp v1.9.0 // indirect
|
|
github.com/pion/sdp/v3 v3.0.17 // indirect
|
|
github.com/pion/srtp/v3 v3.0.9 // indirect
|
|
github.com/pion/stun/v3 v3.0.2 // indirect
|
|
github.com/pion/transport/v3 v3.1.1 // indirect
|
|
github.com/pion/turn/v4 v4.1.3 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/prometheus/client_model v0.6.2 // indirect
|
|
github.com/robfig/cron/v3 v3.0.1 // indirect
|
|
github.com/rogpeppe/go-internal v1.14.1 // indirect
|
|
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
|
|
github.com/u-root/uio v0.0.0-20230220225925-ffce2a382923 // indirect
|
|
github.com/ugorji/go/codec v1.3.0 // indirect
|
|
github.com/vishvananda/netns v0.0.5 // indirect
|
|
github.com/wlynxg/anet v0.0.5 // indirect
|
|
go.yaml.in/yaml/v2 v2.4.3 // indirect
|
|
golang.org/x/arch v0.20.0 // indirect
|
|
golang.org/x/oauth2 v0.32.0 // indirect
|
|
golang.org/x/sync v0.17.0 // indirect
|
|
golang.org/x/text v0.30.0 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20250804133106-a7a43d27e69b // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|