Panic-driven denial of service in the AWS SDK for Go v2 EventStream decoder:
eventstream -> v1.7.8, service/s3 -> v1.97.3 (minimum patched versions, so the
change carries the fix and nothing else).
Verified against a measured baseline: go build ./... exit 0, and go test ./...
is 9 ok / 5 fail BOTH with and without this change — identical, so those
failures are pre-existing.
Several luxfi versions carry TWO different contents across this workspace,
because published tags were moved instead of a new patch being cut:
age@v1.5.0, pq@v1.0.3, threshold@v1.9.4, zap@v0.6.0, zap@v0.8.1.
Adjudicated before editing, since "checksum mismatch / SECURITY ERROR" is also
what a real supply-chain attack looks like. It is not one here: sum.golang.org
holds the OLD hash while proxy.golang.org and a direct fetch BOTH serve the same
NEW bytes. Two independent transports agreeing means nothing is rewriting
content in flight — the tag moved at source. The sumdb entry is a fossil:
GOPRIVATE covers github.com/luxfi/* with GOSUMDB=off, so our own modules never
consult the checksum DB and a moved tag splits consumers silently.
The old bytes are served by nothing now, so a stale pin can never build.
Corrected to the only content that exists, in BOTH line forms (h1: and
/go.mod h1:) — Go reports these one at a time, so a partial fix just relocates
the error.
Deliberately no `go mod tidy`: this changes no selected version, only the
recorded hash of versions already chosen.
Verified: `go list -m all` resolves with no checksum error.
The durable fix is upstream: never move a published tag, cut x.y.z+1 instead.
Resolves the workspace-wide cgo build blocker (cloud@v0.1.0's dead base/gateway/iam
pseudo-versions). vfs 0.4.2+ decoupled from cloud per HIP-0106. go mod tidy clean,
builds pure-Go.
Replace proto.Marshal/Unmarshal with native pb.Marshal/pb.Unmarshal to
match the wire format used by luxfi/badger/v4. This ensures databases
written by nodes using the badger fork (v1.23.4) can be read by nodes
using zapdb (v1.23.5), preventing "proto: cannot parse invalid
wire-format data" errors during rolling upgrades.
Added types_zap.go and marshal_zap.go from luxfi/badger fork, which
provide custom LittleEndian binary encoding for ManifestChangeSet,
KV, Checksum, and other internal types. The standard protobuf
generated code (badgerpb4.pb.go) is now behind a grpc build tag.
Use sync.Once and helper functions to safely handle metric initialization
when the package is imported multiple times in test environments. This
fixes the "Reuse of exported var name" panic that occurred when running
coreth tests.
- Rename module from github.com/dgraph-io/badger/v4 to github.com/luxfi/zapdb/v4
- Update all internal imports to use new module path
- Preserve all ZAP enhancements from badger fork
zeekay