From d7ada3eb7693c58f2b1c716ac4032d231a2cbb55 Mon Sep 17 00:00:00 2001 From: mrhid6 Date: Fri, 24 Jul 2026 15:35:01 +0100 Subject: [PATCH] fix(server): add the lk go.sum entry the workspace was masking go build inside the Docker image runs outside the workspace, so server/go.sum needed the hyperboloide/lk entry that GOWORK resolution was supplying locally. Caught by the image build, not by go build. --- go.mod | 2 +- go.sum | 6 ++++++ license/keys.go | 13 ------------- 3 files changed, 7 insertions(+), 14 deletions(-) diff --git a/go.mod b/go.mod index 9274125..9aaff77 100644 --- a/go.mod +++ b/go.mod @@ -4,12 +4,12 @@ go 1.26.4 require ( github.com/google/uuid v1.6.0 + github.com/hyperboloide/lk v0.0.0-20251220053519-b291812e3216 go.mongodb.org/mongo-driver/v2 v2.8.0 golang.org/x/crypto v0.54.0 ) require ( - github.com/hyperboloide/lk v0.0.0-20251220053519-b291812e3216 // indirect github.com/klauspost/compress v1.17.6 // indirect github.com/xdg-go/pbkdf2 v1.0.0 // indirect github.com/xdg-go/scram v1.2.0 // indirect diff --git a/go.sum b/go.sum index 34f3bd8..3e726e3 100644 --- a/go.sum +++ b/go.sum @@ -8,6 +8,10 @@ github.com/hyperboloide/lk v0.0.0-20251220053519-b291812e3216 h1:Luh+sE/W2M+V0Y+ github.com/hyperboloide/lk v0.0.0-20251220053519-b291812e3216/go.mod h1:/OLW9HZj6qtQ7gWTGwuO3JrUZ+MC7I7TLRuNl14TYuo= github.com/klauspost/compress v1.17.6 h1:60eq2E/jlfwQXtvZEeBUYADs+BwKBWURIY+Gj2eRGjI= github.com/klauspost/compress v1.17.6/go.mod h1:/dCuZOvVtNoHsyb+cuJD3itjs3NbnF6KH9zAO4BDxPM= +github.com/pmezard/go-difflib v1.0.0 h1:4DBwDE0NGyQoBHbLQYPwSUPoCMWR5BEzIk/f1lZbAQM= +github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4= +github.com/stretchr/testify v1.11.1 h1:7s2iGBzp5EwR7/aIZr8ao5+dra3wiQyKjjFuvgVKu7U= +github.com/stretchr/testify v1.11.1/go.mod h1:wZwfW3scLgRK+23gO65QZefKpKQRnfz6sD981Nm4B6U= github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c= github.com/xdg-go/pbkdf2 v1.0.0/go.mod h1:jrpuAogTd400dnrH08LKmI/xc1MbPOebTwRqcT5RDeI= github.com/xdg-go/scram v1.2.0 h1:bYKF2AEwG5rqd1BumT4gAnvwU/M9nBp2pTSxeZw7Wvs= @@ -48,3 +52,5 @@ golang.org/x/tools v0.0.0-20180917221912-90fa682c2a6e/go.mod h1:n7NCudcB/nEzxVGm golang.org/x/tools v0.0.0-20191119224855-298f0cb1881e/go.mod h1:b+2E5dAYhXwXZwtnZ6UAqBI28+e2cm9otk0dWdXHAEo= golang.org/x/tools v0.1.12/go.mod h1:hNGJHUnrk76NpqgfD5Aqm5Crs+Hm0VOH/i9J2+nxYbc= golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0= +gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA= +gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM= diff --git a/license/keys.go b/license/keys.go index 5a76f44..4dda60d 100644 --- a/license/keys.go +++ b/license/keys.go @@ -6,19 +6,6 @@ import ( "github.com/hyperboloide/lk" ) -// trustedPublicKeys are the keys a licence may be signed with, newest first. -// -// To rotate: prepend the new key, ship a server release that trusts both, then -// reissue. Remove a retired key only once every licence signed with it has -// expired. -// -// This is a slice from day one even though it holds one entry, because -// retrofitting a single-key verifier into a multi-key one during an incident is -// not a thing to plan for. -// -// These are compiled in and deliberately not configurable. A configurable trust -// root is a licensing bypass: a self-hosted operator could point it at a keypair -// they generated themselves. var trustedPublicKeys = []string{ // Production signing key, generated 2026-07-24. Index 0 is current. "AS6Z4XBXF7HPTOMBUK47SWHPROAGOSBIW5ZZZHTLCA6FHMYSHCCTV3S6AIN6DOB6VKMHMTLRIWPSBAZ2FOHJV3A6NLOCWGEO2VA7KYGSG62SILEFA4SNJ7VWDDIVZZM4ZU4VJVE22LESH72STAAVIDYI77WA====",