Skip to content

fix: security hardening and stability fixes across orchestrator, transport, and services #13

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mkumatag merged 3 commits into from
Jul 1, 2026
Merged

fix: security hardening and stability fixes across orchestrator, transport, and services #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
c6cd9d8
fix: security hardening and stability fixes across orchestrator, tran…
sudeeshjohn Jun 29, 2026
2ad700d
fix: bump Go to 1.26.4 to resolve CVE-2026-27145 and CVE-2026-42504
sudeeshjohn Jun 30, 2026
4944c42
fix: harden logger, downloader, and HMC round-tripper
sudeeshjohn Jun 30, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
7 changes: 5 additions & 2 deletions cmd/create.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -52,8 +52,11 @@ func runCreate(cmd *cobra.Command, args []string) error {
return err
}

// Ensure logger file descriptor is closed when command completes
defer orch.GetLogger().Close()
// Ensure logger file descriptor is closed when command completes.
// The anonymous func is required so the pointer is evaluated at exit time,
// not now — orch may be replaced with a new orchestrator further below if
// the workspace was previously deleted.
defer func() { orch.GetLogger().Close() }()

ctx := GetContext()
log := orch.GetLogger()
Expand Down
4 changes: 2 additions & 2 deletions cmd/createtemplate.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,8 +7,8 @@ import (
"strings"
"text/template"

"github.com/spf13/cobra"
"github.com/IBM/shiftlaunch/logger"
"github.com/spf13/cobra"
)

var (
Expand Down Expand Up @@ -47,7 +47,7 @@ func init() {
rootCmd.AddCommand(generateConfigCmd)

generateConfigCmd.Flags().StringVarP(&genConfigType, "type", "t", "multi", "Cluster topology: 'sno' or 'multi'")
generateConfigCmd.Flags().StringVarP(&genBootMethod, "boot", "b", "agent", "Boot method: 'agent' or 'netboot'")
generateConfigCmd.Flags().StringVarP(&genBootMethod, "boot", "b", "netboot", "Boot method: 'agent' or 'netboot'")
generateConfigCmd.Flags().StringVarP(&genOutputPath, "output", "o", "config.yaml", "Path to save the generated file")
generateConfigCmd.Flags().StringVar(&genReleaseType, "release-type", "official", "Payload type: 'official' or 'ci'")

Expand Down
8 changes: 4 additions & 4 deletions cmd/scale.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -319,7 +319,7 @@ func runScale(cmd *cobra.Command, args []string) error {

if targetUUID != "" {
// Power off LPAR immediately without deleting it
_, err := hmcProvider.GetHMCClient().PowerOffPartition(ctx, targetUUID, "Immediate", false, true)
_, err := hmcProvider.GetHMCClient().PowerOffPartition(ctx, targetUUID, "Immediate", false)
if err != nil && !strings.Contains(strings.ToLower(err.Error()), "unavailable in the current partition state") {
log.Warn("Failed to power off LPAR", "error", err)
}
Expand All @@ -329,17 +329,17 @@ func runScale(cmd *cobra.Command, args []string) error {
for i, mapping := range state.ISOMappings {
if mapping.NodeName == target.Hostname {
// Resolve System UUID required for unmapping
sysUUID, _, _ := hmcProvider.GetHMCClient().GetManagedSystemByName(ctx, mapping.SystemName, debug)
sysUUID, _, _ := hmcProvider.GetHMCClient().GetManagedSystemByName(ctx, mapping.SystemName)

if sysUUID != "" {
// Unmap ISO from LPAR
_, err := hmcProvider.GetHMCClient().DeleteVirtualOpticalMaps(ctx, sysUUID, mapping.VIOSUUID, targetUUID, []string{mapping.MediaName}, debug)
_, err := hmcProvider.GetHMCClient().DeleteVirtualOpticalMaps(ctx, sysUUID, mapping.VIOSUUID, targetUUID, []string{mapping.MediaName})
if err != nil {
log.Warn("Failed to unmap ISO from LPAR", "error", err)
} else {
time.Sleep(3 * time.Second) // Let VIOS digest the unmap
// Delete ISO from repository
err = hmcProvider.GetHMCClient().DeleteVirtualOpticalMedia(ctx, mapping.SystemName, mapping.VIOSName, mapping.MediaName, debug)
err = hmcProvider.GetHMCClient().DeleteVirtualOpticalMedia(ctx, mapping.SystemName, mapping.VIOSName, mapping.MediaName)
if err != nil && !strings.Contains(err.Error(), "not found") {
log.Warn("Failed to delete ISO from VIOS repository", "error", err)
}
Expand Down
4 changes: 2 additions & 2 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,14 +1,14 @@
module github.com/IBM/shiftlaunch

go 1.26.3
go 1.26.4

require (
golang.org/x/crypto v0.53.0 // indirect
gopkg.in/yaml.v3 v3.0.1
)

require (
github.com/IBM/infra-go-sdk v0.0.0-20260626121933-c8707cdac649
github.com/IBM/infra-go-sdk v0.0.0-20260630034014-da6ea8cba64d
github.com/spf13/cobra v1.10.2
github.com/spf13/viper v1.21.0
go.yaml.in/yaml/v3 v3.0.4
Expand Down
4 changes: 2 additions & 2 deletions go.sum
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,8 +6,8 @@ atomicgo.dev/keyboard v0.2.10 h1:v7mvUKUZLHIggxULEIuWbT+WkkyQSgdbA201EziAhHU=
atomicgo.dev/keyboard v0.2.10/go.mod h1:ap/z5ilnhLqYq852m6kPeTq5Z6aESGWu5mzRpJlC6aI=
atomicgo.dev/schedule v0.1.0 h1:nTthAbhZS5YZmgYbb2+DH8uQIZcTlIrd4eYr3UQxEjs=
atomicgo.dev/schedule v0.1.0/go.mod h1:xeUa3oAkiuHYh8bKiQBRojqAMq3PXXbJujjb0hw8pEU=
github.com/IBM/infra-go-sdk v0.0.0-20260626121933-c8707cdac649 h1:02DjfvDqLdA5GDMkuSmE5jQ/6tlluwjPcuTkK7dGkio=
github.com/IBM/infra-go-sdk v0.0.0-20260626121933-c8707cdac649/go.mod h1:bDk0yc6n1Wx+HtxwlZpsXqWx8x3Cag9YV9DkogrdueA=
github.com/IBM/infra-go-sdk v0.0.0-20260630034014-da6ea8cba64d h1:ANPjiwzkHkQDmon7mwbnn/6e5sDbluUmmN+96yuJvDE=
github.com/IBM/infra-go-sdk v0.0.0-20260630034014-da6ea8cba64d/go.mod h1:ig0leiRacKahGoO8KloXH8yJI3z6a3d6d6GYk6EtX08=
github.com/MarvinJWendt/testza v0.5.2 h1:53KDo64C1z/h/d/stCYCPY69bt/OSwjq5KpFNwi+zB4=
github.com/MarvinJWendt/testza v0.5.2/go.mod h1:xu53QFE5sCdjtMCKk8YMQ2MnymimEctc4n3EjyIYvEY=
github.com/aymanbagabas/go-osc52/v2 v2.0.1 h1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=
Expand Down
Loading
Loading