From 48e1846525cce0a870fec9720cc9bf078fa4bf31 Mon Sep 17 00:00:00 2001 From: Feng Ruohang Date: Wed, 9 Sep 2026 18:50:12 +0800 Subject: [PATCH] fix(tls): honor Go key exchange defaults across transports Remove the eight explicit curve overrides so Go 1.27 honors tlsmlkem=0 across Server listeners, node links and outbound transports. Remove the unused shared curve option and add wire-level regression coverage. Document CA trust and TLS upgrade behavior, retain the investigation artifacts, and exclude their synthetic routes from the rebrand guard. The product compatibility baseline remains unchanged. Validation: focused race tests, HTTP tests, lint, compatibility guard positive/negative controls, and a fresh Linux build with three isolated OIDC integration scenarios all pass. Adversarial review: Claude Code Fable 5.1, max effort. Final verdict: APPROVE FOR COMMIT. Signed-off-by: Feng Ruohang --- README.md | 20 + buildscripts/rebrand-guard/main.go | 2 + cmd/grid.go | 10 +- cmd/tls_defaults_test.go | 133 + cmd/utils.go | 51 +- docs/investigations/go127-stack-evidence.json | 2754 +++++++++++++ docs/investigations/go127-stack.md | 184 + docs/investigations/issue-154.md | 403 ++ docs/investigations/issue-154/admin-check.go | 41 + docs/investigations/issue-154/cert-roots.go | 41 + docs/investigations/issue-154/evidence.json | 2499 ++++++++++++ docs/investigations/issue-154/fixture.go | 179 + .../issue-154/linux-evidence.json | 3423 +++++++++++++++++ .../issue-154/openid-default-curves.patch | 40 + docs/investigations/issue-154/probe.go | 165 + docs/investigations/issue-154/run-linux.py | 170 + internal/config/etcd/etcd.go | 1 - internal/crypto/crypto.go | 6 - internal/http/transports.go | 6 +- 19 files changed, 10083 insertions(+), 45 deletions(-) create mode 100644 cmd/tls_defaults_test.go create mode 100644 docs/investigations/go127-stack-evidence.json create mode 100644 docs/investigations/go127-stack.md create mode 100644 docs/investigations/issue-154.md create mode 100644 docs/investigations/issue-154/admin-check.go create mode 100644 docs/investigations/issue-154/cert-roots.go create mode 100644 docs/investigations/issue-154/evidence.json create mode 100644 docs/investigations/issue-154/fixture.go create mode 100644 docs/investigations/issue-154/linux-evidence.json create mode 100644 docs/investigations/issue-154/openid-default-curves.patch create mode 100644 docs/investigations/issue-154/probe.go create mode 100644 docs/investigations/issue-154/run-linux.py diff --git a/README.md b/README.md index 644e31833..ef97448d8 100644 --- a/README.md +++ b/README.md @@ -89,6 +89,26 @@ The S3 API, `MINIO_*` variables, `minio_*` metrics, `x-minio-*` headers, `/minio Every divergence from upstream is listed in the code-verified [compatibility audit](https://silo.pgsty.com/compatibility/server/). Treat each release as a downstream upgrade: pin versions, read the [release notes](https://silo.pgsty.com/tags/silo/), and keep a rollback path. +### TLS and Go upgrades + +TLS key exchange follows Go's defaults across the S3 listener, node links, +replication, identity providers, etcd, and external HTTP services. If an endpoint +cannot accept ML-KEM, `GODEBUG=tlsmlkem=0` disables the default hybrid exchanges +for the process; certificate verification remains enabled. This option does not +disable ML-DSA signatures or resolve every TLS reset. Prefer updating the +incompatible endpoint before removing the temporary setting. +If only the new SecP hybrids cause problems, `GODEBUG=tlssecpmlkem=0` disables +those groups while retaining X25519MLKEM768. + +For builds targeting Go 1.27, setting either `SSL_CERT_FILE` or `SSL_CERT_DIR` +on macOS replaces Keychain trust with on-disk roots and Go's verifier. Stale or +incomplete CA paths can break previously trusted connections; unset inherited +values to restore Keychain trust. Explicit certificates in the configured `CAs` +directory remain additive to the selected root pool. +Go 1.27 binaries require macOS 13 or later. See the +[Go release notes](https://go.dev/doc/go1.27) and the +[SILO stack investigation](docs/investigations/go127-stack.md). + ## Security & Contributing Report vulnerabilities privately as described in [`SECURITY.md`](SECURITY.md); every fix ships with a public [advisory](https://silo.pgsty.com/blog/security/). Contributions are accepted inbound=outbound under AGPL-3.0-or-later with no CLA — only DCO sign-off (`git commit -s`) is required; see [`CONTRIBUTING.md`](CONTRIBUTING.md). diff --git a/buildscripts/rebrand-guard/main.go b/buildscripts/rebrand-guard/main.go index 261ec0446..b625cadff 100644 --- a/buildscripts/rebrand-guard/main.go +++ b/buildscripts/rebrand-guard/main.go @@ -115,7 +115,9 @@ func collect(repo string) (manifest, error) { fset := token.NewFileSet() for _, rel := range files { + // Investigation artifacts contain synthetic routes and archived configurations. if rel == "SILO_REBRANDING_MIGRATION.md" || + strings.HasPrefix(rel, "docs/investigations/") || strings.HasPrefix(rel, "buildscripts/rebrand-guard/") || strings.HasPrefix(rel, "buildscripts/helm-migration-guard/") { continue diff --git a/cmd/grid.go b/cmd/grid.go index 0b442267c..2a2120764 100644 --- a/cmd/grid.go +++ b/cmd/grid.go @@ -51,9 +51,8 @@ func initGlobalGrid(ctx context.Context, eps EndpointServerPools) error { grid.ContextDialer(xhttp.DialContextWithLookupHost(lookupHost, xhttp.NewInternodeDialContext(rest.DefaultTimeout, globalTCPOptions.ForWebsocket()))), newCachedAuthToken(), &tls.Config{ - RootCAs: globalRootCAs, - CipherSuites: crypto.TLSCiphers(), - CurvePreferences: crypto.TLSCurveIDs(), + RootCAs: globalRootCAs, + CipherSuites: crypto.TLSCiphers(), }), Local: local, Hosts: hosts, @@ -84,9 +83,8 @@ func initGlobalLockGrid(ctx context.Context, eps EndpointServerPools) error { grid.ContextDialer(xhttp.DialContextWithLookupHost(lookupHost, xhttp.NewInternodeDialContext(rest.DefaultTimeout, globalTCPOptions.ForWebsocket()))), newCachedAuthToken(), &tls.Config{ - RootCAs: globalRootCAs, - CipherSuites: crypto.TLSCiphers(), - CurvePreferences: crypto.TLSCurveIDs(), + RootCAs: globalRootCAs, + CipherSuites: crypto.TLSCiphers(), }, grid.RouteLockPath), Local: local, Hosts: hosts, diff --git a/cmd/tls_defaults_test.go b/cmd/tls_defaults_test.go new file mode 100644 index 000000000..7a3c1feb6 --- /dev/null +++ b/cmd/tls_defaults_test.go @@ -0,0 +1,133 @@ +// Copyright (c) 2026 Pigsty +// SPDX-License-Identifier: AGPL-3.0-or-later + +package cmd + +import ( + "crypto/tls" + "crypto/x509" + "encoding/pem" + "io" + "net/http" + "net/http/httptest" + "os" + "path/filepath" + "slices" + "testing" + "time" + + "github.com/minio/minio/internal/config/etcd" +) + +func TestOutboundTLSKeyExchangeDefaults(t *testing.T) { + for _, debug := range []string{"tlsmlkem=0", "tlsmlkem=1"} { + t.Run(debug, func(t *testing.T) { + t.Setenv("GODEBUG", debug) + for _, version := range []uint16{tls.VersionTLS12, tls.VersionTLS13} { + t.Run(tls.VersionName(version), func(t *testing.T) { + hellos := make(chan []tls.CurveID, 1) + server := httptest.NewUnstartedServer(http.HandlerFunc(func(w http.ResponseWriter, _ *http.Request) { + _, _ = io.WriteString(w, "ok") + })) + server.TLS = &tls.Config{ + MinVersion: version, MaxVersion: version, + GetConfigForClient: func(hello *tls.ClientHelloInfo) (*tls.Config, error) { + select { + case hellos <- slices.Clone(hello.SupportedCurves): + default: + } + return nil, nil + }, + } + server.StartTLS() + t.Cleanup(server.Close) + roots := x509.NewCertPool() + roots.AddCert(server.Certificate()) + + dir := t.TempDir() + certFile, keyFile := filepath.Join(dir, "public.crt"), filepath.Join(dir, "private.key") + cert := server.TLS.Certificates[0] + key, err := x509.MarshalPKCS8PrivateKey(cert.PrivateKey) + if err != nil { + t.Fatal(err) + } + for path, block := range map[string]*pem.Block{ + certFile: {Type: "CERTIFICATE", Bytes: cert.Certificate[0]}, + keyFile: {Type: "PRIVATE KEY", Bytes: key}, + } { + if err := os.WriteFile(path, pem.EncodeToMemory(block), 0o600); err != nil { + t.Fatal(err) + } + } + t.Setenv(etcd.EnvEtcdEndpoints, server.URL) + t.Setenv(etcd.EnvEtcdClientCert, "") + t.Setenv(etcd.EnvEtcdClientCertKey, "") + etcdConfig, err := etcd.LookupConfig(etcd.DefaultKVS, roots) + if err != nil { + t.Fatal(err) + } + for name, transport := range map[string]*http.Transport{ + "external": NewHTTPTransport(), + "internode": NewInternodeHTTPTransport(1)().(*http.Transport), + "replication": NewRemoteTargetHTTPTransport(false)(), + "cloud-client-cert": NewHTTPTransportWithClientCerts(certFile, keyFile).(*http.Transport), + "etcd": {TLSClientConfig: etcdConfig.TLS}, + } { + t.Run(name, func(t *testing.T) { + defer transport.CloseIdleConnections() + transport.Proxy = nil + transport.TLSClientConfig.RootCAs = roots + client := &http.Client{Transport: transport, Timeout: 5 * time.Second} + resp, err := client.Get(server.URL) + if err != nil { + t.Fatal(err) + } + defer resp.Body.Close() + if resp.StatusCode != http.StatusOK || resp.TLS.Version != version { + t.Fatalf("status %d, TLS %s", resp.StatusCode, tls.VersionName(resp.TLS.Version)) + } + curves := <-hellos + if got, want := slices.Contains(curves, tls.X25519MLKEM768), debug == "tlsmlkem=1"; got != want { + t.Errorf("ML-KEM offered = %v, want %v; curves %v", got, want, curves) + } + }) + } + }) + } + }) + } +} + +func TestServerTLSKeyExchangeDefaults(t *testing.T) { + for _, debug := range []string{"tlsmlkem=0", "tlsmlkem=1"} { + t.Run(debug, func(t *testing.T) { + t.Setenv("GODEBUG", debug) + // Reuse httptest's certificate with the actual Server TLS constructor. + seed := httptest.NewTLSServer(http.NotFoundHandler()) + cert := seed.TLS.Certificates[0] + seed.Close() + server := httptest.NewUnstartedServer(http.NotFoundHandler()) + server.TLS = newTLSConfig(func(*tls.ClientHelloInfo) (*tls.Certificate, error) { return &cert, nil }) + server.StartTLS() + defer server.Close() + roots := x509.NewCertPool() + leaf, err := x509.ParseCertificate(cert.Certificate[0]) + if err != nil { + t.Fatal(err) + } + roots.AddCert(leaf) + for _, curve := range []tls.CurveID{tls.X25519MLKEM768, tls.CurveP256} { + conn, err := tls.Dial("tcp", server.Listener.Addr().String(), &tls.Config{ + RootCAs: roots, MinVersion: tls.VersionTLS13, CurvePreferences: []tls.CurveID{curve}, + }) + wantSuccess := curve == tls.CurveP256 || debug == "tlsmlkem=1" + if (err == nil) != wantSuccess { + t.Errorf("curve %v: error %v, want success %v", curve, err, wantSuccess) + } + if conn != nil { + _ = conn.Close() + } + } + }) + } +} diff --git a/cmd/utils.go b/cmd/utils.go index 7f7032c5f..c4d61aca6 100644 --- a/cmd/utils.go +++ b/cmd/utils.go @@ -608,13 +608,12 @@ func GetDefaultConnSettings() xhttp.ConnSettings { // connections. func NewInternodeHTTPTransport(maxIdleConnsPerHost int) func() http.RoundTripper { return xhttp.ConnSettings{ - LookupHost: globalDNSCache.LookupHost, - DialTimeout: rest.DefaultTimeout, - RootCAs: globalRootCAs, - CipherSuites: crypto.TLSCiphers(), - CurvePreferences: crypto.TLSCurveIDs(), - EnableHTTP2: false, - TCPOptions: globalTCPOptions, + LookupHost: globalDNSCache.LookupHost, + DialTimeout: rest.DefaultTimeout, + RootCAs: globalRootCAs, + CipherSuites: crypto.TLSCiphers(), + EnableHTTP2: false, + TCPOptions: globalTCPOptions, }.NewInternodeHTTPTransport(maxIdleConnsPerHost) } @@ -622,13 +621,12 @@ func NewInternodeHTTPTransport(maxIdleConnsPerHost int) func() http.RoundTripper // used while communicating with the cloud backends. func NewHTTPTransportWithClientCerts(clientCert, clientKey string) http.RoundTripper { s := xhttp.ConnSettings{ - LookupHost: globalDNSCache.LookupHost, - DialTimeout: defaultDialTimeout, - RootCAs: globalRootCAs, - CipherSuites: crypto.TLSCiphersBackwardCompatible(), - CurvePreferences: crypto.TLSCurveIDs(), - TCPOptions: globalTCPOptions, - EnableHTTP2: false, + LookupHost: globalDNSCache.LookupHost, + DialTimeout: defaultDialTimeout, + RootCAs: globalRootCAs, + CipherSuites: crypto.TLSCiphersBackwardCompatible(), + TCPOptions: globalTCPOptions, + EnableHTTP2: false, } if clientCert != "" && clientKey != "" { @@ -660,13 +658,12 @@ const defaultDialTimeout = 5 * time.Second // NewHTTPTransportWithTimeout allows setting a timeout. func NewHTTPTransportWithTimeout(timeout time.Duration) *http.Transport { return xhttp.ConnSettings{ - LookupHost: globalDNSCache.LookupHost, - DialTimeout: defaultDialTimeout, - RootCAs: globalRootCAs, - TCPOptions: globalTCPOptions, - CipherSuites: crypto.TLSCiphersBackwardCompatible(), - CurvePreferences: crypto.TLSCurveIDs(), - EnableHTTP2: false, + LookupHost: globalDNSCache.LookupHost, + DialTimeout: defaultDialTimeout, + RootCAs: globalRootCAs, + TCPOptions: globalTCPOptions, + CipherSuites: crypto.TLSCiphersBackwardCompatible(), + EnableHTTP2: false, }.NewHTTPTransportWithTimeout(timeout) } @@ -674,12 +671,11 @@ func NewHTTPTransportWithTimeout(timeout time.Duration) *http.Transport { // used while communicating with the remote replication targets. func NewRemoteTargetHTTPTransport(insecure bool) func() *http.Transport { return xhttp.ConnSettings{ - LookupHost: globalDNSCache.LookupHost, - RootCAs: globalRootCAs, - CipherSuites: crypto.TLSCiphersBackwardCompatible(), - CurvePreferences: crypto.TLSCurveIDs(), - TCPOptions: globalTCPOptions, - EnableHTTP2: false, + LookupHost: globalDNSCache.LookupHost, + RootCAs: globalRootCAs, + CipherSuites: crypto.TLSCiphersBackwardCompatible(), + TCPOptions: globalTCPOptions, + EnableHTTP2: false, }.NewRemoteTargetHTTPTransport(insecure) } @@ -986,7 +982,6 @@ func newTLSConfig(getCert certs.GetCertificateFunc) *tls.Config { } else { tlsConfig.CipherSuites = crypto.TLSCiphersBackwardCompatible() } - tlsConfig.CurvePreferences = crypto.TLSCurveIDs() return tlsConfig } diff --git a/docs/investigations/go127-stack-evidence.json b/docs/investigations/go127-stack-evidence.json new file mode 100644 index 000000000..7113ef476 --- /dev/null +++ b/docs/investigations/go127-stack-evidence.json @@ -0,0 +1,2754 @@ +{ + "recorded_utc": "2026-09-09T10:06:09.493712+00:00", + "scope": "Local PGSTY stack Go 1.27 audit and fixes; no external deployment or publication", + "repositories": { + "silo": { + "path": "/Users/vonng/.codex/worktrees/4224/silo", + "base_commit": "d1105bbb3d4a0afa33b3a4ac11b821235038ed0e", + "branch": "codex/investigate-oidc-154", + "tracked_changes": [ + "README.md", + "cmd/grid.go", + "cmd/utils.go", + "internal/config/etcd/etcd.go", + "internal/crypto/crypto.go" + ], + "untracked": [ + "cmd/tls_defaults_test.go", + "docs/investigations/go127-stack-evidence.json", + "docs/investigations/go127-stack.md", + "docs/investigations/issue-154.md", + "docs/investigations/issue-154/admin-check.go", + "docs/investigations/issue-154/cert-roots.go", + "docs/investigations/issue-154/evidence.json", + "docs/investigations/issue-154/fixture.go", + "docs/investigations/issue-154/linux-evidence.json", + "docs/investigations/issue-154/openid-default-curves.patch", + "docs/investigations/issue-154/probe.go", + "docs/investigations/issue-154/run-linux.py" + ], + "go_mod_sha256": "f8182f00d130b89bd794041cb804ac3255ce7b035c0b73f8e6ca7094d6ea4035", + "go_sum_sha256": "6913c1a5d63af9f1cc4b21205bf45a98bd3f53855e4aa49dd3eccac06cd6ef19", + "dependencies_changed": false, + "modified_go_files": { + "cmd/grid.go": "570c10a301e4ed3c842c1811711df99021cbeafa7142a97e287df0f78175aae9", + "cmd/utils.go": "c84727b88ac0b7e1442bce1c81c719518dabdbd8fca5002144329070ea98e34e", + "internal/config/etcd/etcd.go": "0c29792e070d09f05b83effb639b324148ea56cc709077dcb6892a3a37c16d42", + "internal/crypto/crypto.go": "c3bf12d2fe9d998697a9a3aa6084b83d50d84d8af06c2af0e8598326e7ddbaf9", + "cmd/tls_defaults_test.go": "1a1ae148abd218881e841b62f9cc38ff637618e3df172b107ac9e59e0912b5bd" + } + }, + "silo-pkg": { + "path": "/Users/vonng/.codex/worktrees/4224/silo-pkg", + "base_commit": "a92c54d7ad910060dd6053c2fc38d41f3229bcfe", + "branch": "codex/go127-compat-20260909", + "tracked_changes": [ + "README.md" + ], + "untracked": [ + "env/web_env_tls_test.go" + ], + "go_mod_sha256": "0371c50986702312701ab3850dabcd2442b53e7e073d42168dfea5b38a5baff3", + "go_sum_sha256": "a73d65b976a5b5ac99d0f13bcba694662fee735fdad8a15107ef3a1be9ab7870", + "dependencies_changed": false, + "modified_go_files": { + "env/web_env_tls_test.go": "98d30a93d3ca50cf8fb30a6eb72cb6bd95ad6db90e398643af093cf0be134693" + } + }, + "mc": { + "path": "/Users/vonng/.codex/worktrees/4224/mc", + "base_commit": "fcd5cad8247ffac68c075adec43f02a5f15c16c6", + "branch": "codex/go127-compat-20260909", + "tracked_changes": [ + "README.md" + ], + "untracked": [ + "cmd/tls_defaults_test.go" + ], + "go_mod_sha256": "288ebd823a98033d5c63445e77d274f7407afede82ad240368ba3f06bfbada58", + "go_sum_sha256": "3dee1265485779625830593b17af6fa954eba7394f874db664d3938f5b66971f", + "dependencies_changed": false, + "modified_go_files": { + "cmd/tls_defaults_test.go": "8caedb0be3ac94b900ccaf94c2039569fb6d6d859a4c79a7ad272c8e446927f0" + } + }, + "silo-console": { + "path": "/Users/vonng/.codex/worktrees/4224/silo-console", + "base_commit": "c103d08ec36aab8e08ba091d77b639158ce9f18f", + "branch": "codex/go127-compat-20260909", + "tracked_changes": [ + "README.md" + ], + "untracked": [ + "api/tls_defaults_test.go" + ], + "go_mod_sha256": "1665c8c4ab2c63ce8c36e1391f254952ba460de46e79195e5c5b7acbcdfe02e4", + "go_sum_sha256": "7211f69c6c5d25ed923649dfa19eb571b2a16a71ab3d0935be50b2e57f9028e9", + "dependencies_changed": false, + "modified_go_files": { + "api/tls_defaults_test.go": "1f270ebe7cce540ec56348d4c5dbcf93be73beea60861907ca4425dc35986b27" + } + } + }, + "linux_server_build": { + "go": "go1.27.1", + "sha256": "7892ce222c61a6e362291a303c0d9e9a361f866cc398f7ded382d2e61bd21d49", + "settings": [ + "build\t-buildmode=exe", + "build\t-compiler=gc", + "build\t-tags=kqueue", + "build\tCGO_ENABLED=0", + "build\tGOARCH=arm64", + "build\tGOOS=linux", + "build\tGOARM64=v8.0", + "build\tvcs=git", + "build\tvcs.revision=d1105bbb3d4a0afa33b3a4ac11b821235038ed0e", + "build\tvcs.time=2026-09-09T06:55:35Z", + "build\tvcs.modified=true" + ], + "dependencies": [ + "dep\taead.dev/mem\tv0.2.0\th1:ufgkESS9+lHV/GUjxgc2ObF43FLZGSemh+W+y27QFMI=", + "dep\taead.dev/minisign\tv0.3.0\th1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA=", + "dep\taead.dev/mtls\tv0.3.0\th1:a+C0t15Y9SRX6qP1EqmQFZ4ZSMm88TPvNDymasu4ahQ=", + "dep\tcel.dev/expr\tv0.25.2\th1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=", + "dep\tcloud.google.com/go\tv0.123.0\th1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=", + "dep\tcloud.google.com/go/auth\tv0.20.0\th1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=", + "dep\tcloud.google.com/go/auth/oauth2adapt\tv0.2.8\th1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=", + "dep\tcloud.google.com/go/compute/metadata\tv0.9.0\th1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=", + "dep\tcloud.google.com/go/iam\tv1.5.3\th1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=", + "dep\tcloud.google.com/go/monitoring\tv1.24.3\th1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=", + "dep\tcloud.google.com/go/storage\tv1.61.3\th1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=", + "dep\tfilippo.io/edwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azcore\tv1.22.0\th1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azidentity\tv1.14.0\th1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/internal\tv1.12.0\th1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/storage/azblob\tv1.6.4\th1:jWQK1GI+LeGGUKBADtcH2rRqPxYB1Ljwms5gFA2LqrM=", + "dep\tgithub.com/Azure/go-ntlmssp\tv0.1.1\th1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=", + "dep\tgithub.com/AzureAD/microsoft-authentication-library-for-go\tv1.7.2\th1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp\tv1.33.0\th1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric\tv0.55.0\th1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping\tv0.55.0\th1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=", + "dep\tgithub.com/IBM/sarama\tv1.45.1\th1:nY30XqYpqyXOXSNoe2XCgjj9jklGM1Ye94ierUb1jQ0=", + "dep\tgithub.com/VividCortex/ewma\tv1.2.0\th1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=", + "dep\tgithub.com/acarl005/stripansi\tv0.0.0-20180116102854-5a71ef0e047d\th1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=", + "dep\tgithub.com/alecthomas/participle\tv0.7.1\th1:2bN7reTw//5f0cugJcTOnY/NYZcWQOaajW+BwZB5xWs=", + "dep\tgithub.com/apache/thrift\tv0.24.0\th1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=", + "dep\tgithub.com/aymanbagabas/go-osc52/v2\tv2.0.1\th1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=", + "dep\tgithub.com/beevik/ntp\tv1.5.0\th1:y+uj/JjNwlY2JahivxYvtmv4ehfi3h74fAuABB9ZSM4=", + "dep\tgithub.com/beorn7/perks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=", + "dep\tgithub.com/buger/jsonparser\tv1.1.2\th1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=", + "dep\tgithub.com/cespare/xxhash/v2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=", + "dep\tgithub.com/charmbracelet/bubbles\tv1.0.0\th1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=", + "dep\tgithub.com/charmbracelet/bubbletea\tv1.3.10\th1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=", + "dep\tgithub.com/charmbracelet/colorprofile\tv0.4.3\th1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=", + "dep\tgithub.com/charmbracelet/harmonica\tv0.2.0\th1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=", + "dep\tgithub.com/charmbracelet/lipgloss\tv1.1.0\th1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=", + "dep\tgithub.com/charmbracelet/x/ansi\tv0.11.8\th1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=", + "dep\tgithub.com/charmbracelet/x/cellbuf\tv0.0.15\th1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=", + "dep\tgithub.com/charmbracelet/x/term\tv0.2.2\th1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=", + "dep\tgithub.com/cheggaaa/pb\tv1.0.30\th1:NylhgqJfXx3JVBGx6ywsXuhpz8caSMPmLArXyAv1bwU=", + "dep\tgithub.com/clipperhouse/displaywidth\tv0.11.0\th1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=", + "dep\tgithub.com/clipperhouse/uax29/v2\tv2.7.0\th1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=", + "dep\tgithub.com/cncf/xds/go\tv0.0.0-20260202195803-dba9d589def2\th1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=", + "dep\tgithub.com/coreos/go-oidc/v3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=", + "dep\tgithub.com/coreos/go-semver\tv0.3.1\th1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=", + "dep\tgithub.com/coreos/go-systemd/v22\tv22.7.0", + "=>\tgithub.com/coreos/go-systemd/v22\tv22.6.0\th1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=", + "dep\tgithub.com/cosnicolaou/pbzip2\tv1.0.6\th1:FYF6b2j4X4q3hZezd2AoUN/emLCtH/MbDGwJjiOacak=", + "dep\tgithub.com/davecgh/go-spew\tv1.1.2-0.20180830191138-d8f796af33cc\th1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=", + "dep\tgithub.com/dchest/siphash\tv1.2.3\th1:QXwFc8cFOR2dSa/gE6o/HokBMWtLUaNDVd+22aKHeEA=", + "dep\tgithub.com/docker/go-units\tv0.5.0\th1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=", + "dep\tgithub.com/dustin/go-humanize\tv1.0.1\th1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=", + "dep\tgithub.com/eapache/go-resiliency\tv1.7.0\th1:n3NRTnBn5N0Cbi/IeOHuQn9s2UwVUH7Ga0ZWcP+9JTA=", + "dep\tgithub.com/eapache/go-xerial-snappy\tv0.0.0-20230731223053-c322873962e3\th1:Oy0F4ALJ04o5Qqpdz8XLIpNA3WM/iSIXqxtqo7UGVws=", + "dep\tgithub.com/eapache/queue\tv1.1.0\th1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=", + "dep\tgithub.com/eclipse/paho.mqtt.golang\tv1.5.1\th1:/VSOv3oDLlpqR2Epjn1Q7b2bSTplJIeV2ISgCl2W7nE=", + "dep\tgithub.com/elastic/go-elasticsearch/v7\tv7.17.10\th1:TCQ8i4PmIJuBunvBS6bwT2ybzVFxxUhhltAs3Gyu1yo=", + "dep\tgithub.com/envoyproxy/go-control-plane/envoy\tv1.37.0\th1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=", + "dep\tgithub.com/envoyproxy/protoc-gen-validate\tv1.3.3\th1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=", + "dep\tgithub.com/fatih/color\tv1.19.0\th1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=", + "dep\tgithub.com/fatih/structs\tv1.1.0\th1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=", + "dep\tgithub.com/felixge/fgprof\tv0.9.5\th1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=", + "dep\tgithub.com/felixge/httpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=", + "dep\tgithub.com/fraugster/parquet-go\tv0.12.0\th1:1slnC5y2VWEOUSlzbeXatM0BvSWcLUDsR/EcZsXXCZc=", + "dep\tgithub.com/go-asn1-ber/asn1-ber\tv1.5.8\th1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=", + "dep\tgithub.com/go-jose/go-jose/v4\tv4.1.4\th1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=", + "dep\tgithub.com/go-ldap/ldap/v3\tv3.4.14\th1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=", + "dep\tgithub.com/go-logr/logr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=", + "dep\tgithub.com/go-logr/stdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=", + "dep\tgithub.com/go-openapi/analysis\tv0.26.2\th1:Q6wOwXW8mcVAkpDFMshj/F4PlK2Fx86tmLJjZW4vyEs=", + "dep\tgithub.com/go-openapi/errors\tv0.22.8\th1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRejk/I=", + "dep\tgithub.com/go-openapi/jsonpointer\tv1.0.0\th1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=", + "dep\tgithub.com/go-openapi/jsonreference\tv1.0.1\th1:4zJ7AmYDKNmD3aSpfPnFNCFA5E80/xMHUNKgydaLh38=", + "dep\tgithub.com/go-openapi/loads\tv0.25.2\th1:+uNsDlRQfYtZTrh+3pdwampcAqZVPuBJW0IA82aZHII=", + "dep\tgithub.com/go-openapi/runtime\tv0.33.1\th1:jCvhI+wAdsn29byy+RgcPcg+j39YT6E304QOE/WqIVk=", + "dep\tgithub.com/go-openapi/runtime/server-middleware\tv0.33.1\th1:IAeKbwWnBnpsYTpuPVS8t73ZrPpKvRZnK2iJ2KJGUV0=", + "dep\tgithub.com/go-openapi/spec\tv1.0.0\th1:JtB/GHOj+eetjse6YvxqLze88oEekl/4uPBethvzRrA=", + "dep\tgithub.com/go-openapi/strfmt\tv0.27.0\th1:kbcTeaD9TXuXD0hhMXzuYa1sdTo6+dWGvwjW93E80IM=", + "dep\tgithub.com/go-openapi/swag\tv0.29.1\th1:C6EeWzUwQtcWEhE9eqBdUubGXxhWY4PlzHMLD7kLaiQ=", + "dep\tgithub.com/go-openapi/swag/cmdutils\tv0.29.1\th1:3DorPGfUdE80BogKY22EzoHBcHMrkVomZMoV7kS4ANY=", + "dep\tgithub.com/go-openapi/swag/conv\tv0.29.1\th1:AC4Eh/5c/eUDOUCzzsRC9ghmFgOSBHeRMGIngY0ZUGA=", + "dep\tgithub.com/go-openapi/swag/fileutils\tv0.29.1\th1:ZcPzMceVhU1WPbK6N1G6sNQKdd1CWJlf3cA08UHuoM0=", + "dep\tgithub.com/go-openapi/swag/jsonutils\tv0.29.1\th1:AFCxs0eQZ24/QyfhVHM2t49rMz7Vv3XCsZQI6yrNy+c=", + "dep\tgithub.com/go-openapi/swag/loading\tv0.29.1\th1:FCv5fG8UhTdDJa2R7w+5O9Ekpcbw7tt0nFWvmDKGBjc=", + "dep\tgithub.com/go-openapi/swag/mangling\tv0.29.1\th1:lHALtvYCdxVnRl4GrHmFPwfBTZYIObqdGNSKyu/8D6I=", + "dep\tgithub.com/go-openapi/swag/netutils\tv0.29.1\th1:IjIvdEP5duKcghFqJEPSUraRnkKYHoM65kTluTu+Jb4=", + "dep\tgithub.com/go-openapi/swag/pools\tv0.29.1\th1:NRogYxdEW9SjRM4mkAOji9iefO4MRXq3p/ZJcoQbUKg=", + "dep\tgithub.com/go-openapi/swag/stringutils\tv0.29.1\th1:1ykunK7iJQk1uOO7+oUH1ukbsK85fFCOiCFMOVSY+F0=", + "dep\tgithub.com/go-openapi/swag/typeutils\tv0.29.1\th1:Nzv9nhnlLCRBPQqfOX+7lB6Guju370or8StT+lIOf6M=", + "dep\tgithub.com/go-openapi/swag/yamlutils\tv0.29.1\th1:69w3tsBajm7MR/fejLy7HD/3J68Ys1SeeZMEzZ3w2sk=", + "dep\tgithub.com/go-openapi/validate\tv0.26.5\th1:Vm02dSmhevDx/4v4m8KAtMwffHGfq9wRLqICeebE/D4=", + "dep\tgithub.com/go-sql-driver/mysql\tv1.9.3\th1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=", + "dep\tgithub.com/go-viper/mapstructure/v2\tv2.5.0\th1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=", + "dep\tgithub.com/gobwas/httphead\tv0.1.0\th1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=", + "dep\tgithub.com/gobwas/pool\tv0.2.1\th1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=", + "dep\tgithub.com/gobwas/ws\tv1.4.0\th1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=", + "dep\tgithub.com/gogo/protobuf\tv1.3.2\th1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=", + "dep\tgithub.com/golang-jwt/jwt/v4\tv4.5.2\th1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=", + "dep\tgithub.com/golang-jwt/jwt/v5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=", + "dep\tgithub.com/golang/protobuf\tv1.5.4\th1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=", + "dep\tgithub.com/golang/snappy\tv1.0.0\th1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=", + "dep\tgithub.com/gomodule/redigo\tv1.9.3\th1:dNPSXeXv6HCq2jdyWfjgmhBdqnR6PRO3m/G05nvpPC8=", + "dep\tgithub.com/google/pprof\tv0.0.0-20260709232956-b9395ee17fa0\th1:du0WGc8xSKq/++e0cglxhS/mXVqsR7+c7jLEi5Vqduw=", + "dep\tgithub.com/google/s2a-go\tv0.1.9\th1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=", + "dep\tgithub.com/google/shlex\tv0.0.0-20191202100458-e7afc7fbc510\th1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=", + "dep\tgithub.com/google/uuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=", + "dep\tgithub.com/googleapis/enterprise-certificate-proxy\tv0.3.18\th1:hvVi34VucdrV1IIsiWuqYM8kutw/92MxNEFxCJZEh0k=", + "dep\tgithub.com/googleapis/gax-go/v2\tv2.23.0\th1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=", + "dep\tgithub.com/gorilla/websocket\tv1.5.4-0.20250319132907-e064f32e3674\th1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=", + "dep\tgithub.com/grafana/regexp\tv0.0.0-20250905093917-f7b3be9d1853\th1:cLN4IBkmkYZNnk7EAJ0BHIethd+J6LqxFNw5mSiI2bM=", + "dep\tgithub.com/grpc-ecosystem/grpc-gateway/v2\tv2.30.0\th1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=", + "dep\tgithub.com/hashicorp/errwrap\tv1.1.0\th1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=", + "dep\tgithub.com/hashicorp/go-multierror\tv1.1.1\th1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=", + "dep\tgithub.com/hashicorp/go-uuid\tv1.0.3\th1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=", + "dep\tgithub.com/inconshreveable/mousetrap\tv1.1.0\th1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=", + "dep\tgithub.com/jcmturner/aescts/v2\tv2.0.0\th1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=", + "dep\tgithub.com/jcmturner/dnsutils/v2\tv2.0.0\th1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=", + "dep\tgithub.com/jcmturner/gofork\tv1.7.6\th1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=", + "dep\tgithub.com/jcmturner/gokrb5/v8\tv8.4.4\th1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=", + "dep\tgithub.com/jcmturner/rpc/v2\tv2.0.3\th1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=", + "dep\tgithub.com/jedib0t/go-pretty/v6\tv6.8.3\th1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFlmffSQ=", + "dep\tgithub.com/jessevdk/go-flags\tv1.6.1\th1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=", + "dep\tgithub.com/json-iterator/go\tv1.1.12\th1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=", + "dep\tgithub.com/juju/ratelimit\tv1.0.2\th1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=", + "dep\tgithub.com/klauspost/compress\tv1.20.0\th1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=", + "dep\tgithub.com/klauspost/cpuid/v2\tv2.4.0\th1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=", + "dep\tgithub.com/klauspost/crc32\tv1.3.0\th1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=", + "dep\tgithub.com/klauspost/filepathx\tv1.1.1\th1:201zvAsL1PhZvmXTP+QLer3AavWrO3U1NILWpniHK4w=", + "dep\tgithub.com/klauspost/pgzip\tv1.2.6\th1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=", + "dep\tgithub.com/klauspost/readahead\tv1.4.0\th1:w4hQ3BpdLjBnRQkZyNi+nwdHU7eGP9buTexWK9lU7gY=", + "dep\tgithub.com/klauspost/reedsolomon\tv1.13.3\th1:01GwnO2xoCSaM0ShP4qwl+FsHg3csFShC6Tu/RS1ji0=", + "dep\tgithub.com/kr/fs\tv0.1.0\th1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=", + "dep\tgithub.com/kylelemons/godebug\tv1.1.0\th1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=", + "dep\tgithub.com/lestrrat-go/blackmagic\tv1.0.4\th1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=", + "dep\tgithub.com/lestrrat-go/dsig\tv1.4.0\th1:g7LUjK8cT74A5DzBXJI5HzsJuLhoYN0Wzj4nuOMIrH8=", + "dep\tgithub.com/lestrrat-go/httpcc\tv1.0.1\th1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=", + "dep\tgithub.com/lestrrat-go/httprc/v3\tv3.0.6\th1:4FpLQ18KK/ypPbVU3NLWJNRvH3kcYiqKqWfKGqNWxxI=", + "dep\tgithub.com/lestrrat-go/jwx/v3\tv3.2.0\th1:Jb3zBASTSZXz7gzzSAfYqxXF8KejvKC4xWoePLQqXCA=", + "dep\tgithub.com/lestrrat-go/option/v2\tv2.0.0\th1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=", + "dep\tgithub.com/lib/pq\tv1.10.9\th1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=", + "dep\tgithub.com/lithammer/shortuuid/v4\tv4.2.0\th1:LMFOzVB3996a7b8aBuEXxqOBflbfPQAiVzkIcHO0h8c=", + "dep\tgithub.com/lucasb-eyer/go-colorful\tv1.4.1\th1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=", + "dep\tgithub.com/mattn/go-colorable\tv0.1.15\th1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=", + "dep\tgithub.com/mattn/go-ieproxy\tv0.0.12\th1:OZkUFJC3ESNZPQ+6LzC3VJIFSnreeFLQyqvBWtvfL2M=", + "dep\tgithub.com/mattn/go-isatty\tv0.0.24\th1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=", + "dep\tgithub.com/mattn/go-runewidth\tv0.0.29\th1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ=", + "dep\tgithub.com/matttproud/golang_protobuf_extensions\tv1.0.4\th1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=", + "dep\tgithub.com/miekg/dns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=", + "dep\tgithub.com/minio/cli\tv1.24.2\th1:J+fCUh9mhPLjN3Lj/YhklXvxj8mnyE/D6FpFduXJ2jg=", + "dep\tgithub.com/minio/colorjson\tv1.0.8\th1:AS6gEQ1dTRYHmC4xuoodPDRILHP/9Wz5wYUGDQfPLpg=", + "dep\tgithub.com/minio/console\tv1.7.6", + "=>\tgithub.com/pgsty/silo-console\tv0.0.0-20260908142700-c103d08ec36a\th1:aHLqQ7INozqGLEOB1tr+n/eKgrBhlQ20fHyLmeNu+ao=", + "dep\tgithub.com/minio/crc64nvme\tv1.1.1\th1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=", + "dep\tgithub.com/minio/csvparser\tv1.0.0\th1:xJEHcYK8ZAjeW4hNV9Zu30u+/2o4UyPnYgyjWp8b7ZU=", + "dep\tgithub.com/minio/dnscache\tv0.1.1\th1:AMYLqomzskpORiUA1ciN9k7bZT1oB3YZN4cEIi88W5o=", + "dep\tgithub.com/minio/dperf\tv0.7.1\th1:eBwtaBBjuANwgUy1waWoS+wP+0i5fkXJOdGU2RXuDxo=", + "dep\tgithub.com/minio/filepath\tv1.0.0\th1:fvkJu1+6X+ECRA6G3+JJETj4QeAYO9sV43I79H8ubDY=", + "dep\tgithub.com/minio/highwayhash\tv1.0.4\th1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=", + "dep\tgithub.com/minio/kms-go/kes\tv0.3.1\th1:K3sPFAvFbJx33XlCTUBnQo8JRmSZyDvT6T2/MQ2iC3A=", + "dep\tgithub.com/minio/kms-go/kms\tv0.6.0\th1:oGdGUyjfCZwRIi7em0aj4wk+oOm7+4a0lzSZny7ZIDU=", + "dep\tgithub.com/minio/madmin-go/v3\tv3.0.110\th1:FIYekj7YPc430ffpXFWiUtyut3qBt/unIAcDzJn9H5M=", + "dep\tgithub.com/minio/mc\tv0.0.0-20251106162529-77f82e18b540", + "=>\tgithub.com/pgsty/mc\tv0.0.0-20260909015522-fcd5cad8247f\th1:JiL/FcsGMsAhA+Iv+0Jzk9VnEAVVv4HUNbR0cGf+/CE=", + "dep\tgithub.com/minio/md5-simd\tv1.1.2\th1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=", + "dep\tgithub.com/minio/minio-go/v7\tv7.3.1-0.20260828014306-0e78d3f18efe\th1:By2FKNSOUGLOeb0x4D7xJMHr8x/X1ZW8PG780SpKUwQ=", + "dep\tgithub.com/minio/mux\tv1.10.1\th1:grrK8SwRKbkNFE6qG7WAvFGH09bB46d5teOOtKfQ14s=", + "dep\tgithub.com/minio/pkg/v3\tv3.6.1\th1:gaNT80BS/iuIany5ylTkVmfN4s6UYY30OtImFv4GQA8=", + "dep\tgithub.com/minio/selfupdate\tv0.6.0\th1:i76PgT0K5xO9+hjzKcacQtO7+MjJ4JKA8Ak8XQ9DDwU=", + "dep\tgithub.com/minio/simdjson-go\tv0.4.5\th1:r4IQwjRGmWCQ2VeMc7fGiilu1z5du0gJ/I/FsKwgo5A=", + "dep\tgithub.com/minio/sio\tv0.4.3\th1:JqyID1XM86KwBZox5RAdLD4MLPIDoCY2cke2CXCJCkg=", + "dep\tgithub.com/minio/websocket\tv1.6.0\th1:CPvnQvNvlVaQmvw5gtJNyYQhg4+xRmrPNhBbv8BdpAE=", + "dep\tgithub.com/minio/xxml\tv0.0.3\th1:ZIpPQpfyG5uZQnqqC0LZuWtPk/WT8G/qkxvO6jb7zMU=", + "dep\tgithub.com/minio/zipindex\tv0.5.0\th1:QydEWJW+uAFMd5xmQa580bm7JtC5krpuAtARXIQr72U=", + "dep\tgithub.com/mitchellh/go-homedir\tv1.1.0\th1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=", + "dep\tgithub.com/modern-go/concurrent\tv0.0.0-20180306012644-bacd9c7ef1dd\th1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=", + "dep\tgithub.com/modern-go/reflect2\tv1.0.3-0.20250322232337-35a7c28c31ee\th1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=", + "dep\tgithub.com/muesli/ansi\tv0.0.0-20230316100256-276c6243b2f6\th1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=", + "dep\tgithub.com/muesli/cancelreader\tv0.2.2\th1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=", + "dep\tgithub.com/muesli/reflow\tv0.3.0\th1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=", + "dep\tgithub.com/muesli/termenv\tv0.16.0\th1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=", + "dep\tgithub.com/munnerz/goautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=", + "dep\tgithub.com/nats-io/nats.go\tv1.49.0\th1:yh/WvY59gXqYpgl33ZI+XoVPKyut/IcEaqtsiuTJpoE=", + "dep\tgithub.com/nats-io/nkeys\tv0.4.15\th1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=", + "dep\tgithub.com/nats-io/nuid\tv1.0.1\th1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=", + "dep\tgithub.com/nats-io/stan.go\tv0.10.4\th1:19GS/eD1SeQJaVkeM9EkvEYattnvnWrZ3wkSWSw4uXw=", + "dep\tgithub.com/ncw/directio\tv1.0.5\th1:JSUBhdjEvVaJvOoyPAbcW0fnd0tvRXD76wEfZ1KcQz4=", + "dep\tgithub.com/nsqio/go-nsq\tv1.1.0\th1:PQg+xxiUjA7V+TLdXw7nVrJ5Jbl3sN86EhGCQj4+FYE=", + "dep\tgithub.com/oklog/ulid/v2\tv2.1.2\th1:IEclFb9JNvzYA6MW2SCxbLzcHTVsfqm3PrqGQJH5zec=", + "dep\tgithub.com/olekukonko/tablewriter\tv0.0.5\th1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=", + "dep\tgithub.com/pgsty/silo-pkg/v3\tv3.13.3\th1:d2xYTn4LXoWIAIjBlW/17wtA/Ut1ap29t+1ww4TFa8o=", + "dep\tgithub.com/philhofer/fwd\tv1.2.0\th1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=", + "dep\tgithub.com/pierrec/lz4/v4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=", + "dep\tgithub.com/pkg/browser\tv0.0.0-20240102092130-5ac0b6a4141c\th1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=", + "dep\tgithub.com/pkg/errors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=", + "dep\tgithub.com/pkg/sftp\tv1.13.11\th1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=", + "dep\tgithub.com/pkg/xattr\tv0.4.12\th1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=", + "dep\tgithub.com/posener/complete\tv1.2.3\th1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=", + "dep\tgithub.com/prometheus/client_golang\tv1.24.1\th1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=", + "dep\tgithub.com/prometheus/client_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=", + "dep\tgithub.com/prometheus/common\tv0.71.0\th1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=", + "dep\tgithub.com/prometheus/procfs\tv0.22.0\th1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=", + "dep\tgithub.com/prometheus/prom2json\tv1.5.0\th1:WIcAOjLE1x476W3dUlmTL6E/e98CgVGuwwYusl6MPP8=", + "dep\tgithub.com/prometheus/prometheus\tv0.314.0\th1:YjsimqsIi6/mOtzZcrPEYUALO6zpfaht9O5sXqDz2vg=", + "dep\tgithub.com/puzpuzpuz/xsync/v3\tv3.5.1\th1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=", + "dep\tgithub.com/rabbitmq/amqp091-go\tv1.10.0\th1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=", + "dep\tgithub.com/rcrowley/go-metrics\tv0.0.0-20250401214520-65e299d6c5c9\th1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=", + "dep\tgithub.com/rivo/uniseg\tv0.4.7\th1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=", + "dep\tgithub.com/rjeczalik/notify\tv0.9.3\th1:6rJAzHTGKXGj76sbRgDiDcYj/HniypXmSJo1SWakZeY=", + "dep\tgithub.com/rs/cors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=", + "dep\tgithub.com/rs/xid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=", + "dep\tgithub.com/safchain/ethtool\tv0.7.0\th1:rlJzfDetsVvT61uz8x1YIcFn12akMfuPulHtZjtb7Is=", + "dep\tgithub.com/secure-io/sio-go\tv0.3.1\th1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rRc=", + "dep\tgithub.com/shirou/gopsutil/v3\tv3.24.5\th1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=", + "dep\tgithub.com/spiffe/go-spiffe/v2\tv2.7.0\th1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=", + "dep\tgithub.com/tidwall/gjson\tv1.19.0\th1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=", + "dep\tgithub.com/tidwall/match\tv1.2.0\th1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=", + "dep\tgithub.com/tidwall/pretty\tv1.2.1\th1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=", + "dep\tgithub.com/tinylib/msgp\tv1.6.4\th1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=", + "dep\tgithub.com/tklauser/go-sysconf\tv0.4.0\th1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=", + "dep\tgithub.com/tklauser/numcpus\tv0.12.0\th1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=", + "dep\tgithub.com/unrolled/secure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=", + "dep\tgithub.com/valyala/bytebufferpool\tv1.0.0\th1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=", + "dep\tgithub.com/valyala/fastjson\tv1.6.10\th1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=", + "dep\tgithub.com/vbauerster/cupwriter\tv0.0.4\th1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys=", + "dep\tgithub.com/vbauerster/mpb/v8\tv8.16.1\th1:gNYmwMip9xRWNGAiblZOgUNXWeU2P0NIGd5x0f8ffbc=", + "dep\tgithub.com/xdg/scram\tv1.0.5\th1:TuS0RFmt5Is5qm9Tm2SoD89OPqe4IRiFtyFY4iwWXsw=", + "dep\tgithub.com/xdg/stringprep\tv1.0.3\th1:cmL5Enob4W83ti/ZHuZLuKD/xqJfus4fVPwE+/BDm+4=", + "dep\tgithub.com/xo/terminfo\tv1.0.0\th1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=", + "dep\tgithub.com/zeebo/xxh3\tv1.1.0\th1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=", + "dep\tgo.etcd.io/etcd/api/v3\tv3.7.1\th1:KJG0/DcWGfe3Y1otDf/fsBf0TSSgpxZ5RO/L8SFt73E=", + "dep\tgo.etcd.io/etcd/client/pkg/v3\tv3.7.1\th1:rKYsj3pRkR0eK3yjT3XOgrhqfmIfj9pzNgxjh7mfFv4=", + "dep\tgo.etcd.io/etcd/client/v3\tv3.7.1\th1:0PEMMC0KuZmVIN+RAbdqfkZ45pYTgKVtmBEbRCvZFUg=", + "dep\tgo.opentelemetry.io/auto/sdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=", + "dep\tgo.opentelemetry.io/contrib/detectors/gcp\tv1.44.0\th1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc\tv0.70.0\th1:oECp5f+hN7nkwjU/8BxQ/q23bGPb8FIrD839owX222E=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/net/http/otelhttp\tv0.70.0\th1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=", + "dep\tgo.opentelemetry.io/otel\tv1.45.0\th1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=", + "dep\tgo.opentelemetry.io/otel/metric\tv1.45.0\th1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=", + "dep\tgo.opentelemetry.io/otel/sdk\tv1.45.0\th1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=", + "dep\tgo.opentelemetry.io/otel/sdk/metric\tv1.45.0\th1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=", + "dep\tgo.opentelemetry.io/otel/trace\tv1.45.0\th1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=", + "dep\tgo.uber.org/atomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=", + "dep\tgo.uber.org/multierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=", + "dep\tgo.uber.org/zap\tv1.28.0\th1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=", + "dep\tgo.yaml.in/yaml/v3\tv3.0.5\th1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=", + "dep\tgoftp.io/server/v2\tv2.0.3\th1:iz6Gxj7f2SFQVxrj0s1is+gueE6O9yTc+Ab0vtQ6Zn4=", + "dep\tgolang.org/x/crypto\tv0.56.0\th1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=", + "dep\tgolang.org/x/net\tv0.58.0\th1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=", + "dep\tgolang.org/x/oauth2\tv0.36.0\th1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=", + "dep\tgolang.org/x/sync\tv0.22.0\th1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=", + "dep\tgolang.org/x/sys\tv0.47.0\th1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=", + "dep\tgolang.org/x/term\tv0.45.0\th1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=", + "dep\tgolang.org/x/text\tv0.41.0\th1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=", + "dep\tgolang.org/x/time\tv0.15.0\th1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=", + "dep\tgoogle.golang.org/api\tv0.290.0\th1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A=", + "dep\tgoogle.golang.org/genproto\tv0.0.0-20260319201613-d00831a3d3e7\th1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=", + "dep\tgoogle.golang.org/genproto/googleapis/api\tv0.0.0-20260831171406-18b4a7587f8a\th1:i3TAXhpKc7TUP1VAPiBBrv45kamjoizCC3rOC0cAbOs=", + "dep\tgoogle.golang.org/genproto/googleapis/rpc\tv0.0.0-20260831171406-18b4a7587f8a\th1:3Dnd1cDaZlB68lziofO+bJXpjOy8UfRv8Unt+yH8tQ4=", + "dep\tgoogle.golang.org/grpc\tv1.83.2\th1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=", + "dep\tgoogle.golang.org/protobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=", + "dep\tgopkg.in/ini.v1\tv1.67.3\th1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=", + "dep\tgopkg.in/yaml.v2\tv2.4.0\th1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=" + ] + }, + "linux_container": { + "image_id": "sha256:307af7711e2e04ab75759cb42a1eef45c43c4404894c0e30dd19f742b107b922", + "kind": "pre-existing generic Debian 12 base", + "network": "none", + "published_ports": [], + "server_or_console_image": false + }, + "linux_integration": [ + { + "case": "allpaths-add", + "binary": "candidate-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "add_ok": true, + "add_reset": false, + "events": [ + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + } + ] + }, + { + "case": "allpaths-compat-login", + "binary": "candidate-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "oauth": { + "callback_status": 200, + "login_status": 204, + "buckets_status": 200, + "session_cookie": true + }, + "bad-signature": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "bad-audience": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 269, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-signature", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-audience", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + } + ] + }, + { + "case": "allpaths-tls13-login", + "binary": "candidate-go127", + "mode": "normal", + "godebug": null, + "tls13": true, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "oauth": { + "callback_status": 200, + "login_status": 204, + "buckets_status": 200, + "session_cookie": true + }, + "bad-signature": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "bad-audience": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "events": [ + { + "alpn": null, + "bytes_read": 1513, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Silo" + }, + { + "cipher": 4865, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Silo" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 772, + "user_agent_family": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 1495, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-signature", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Silo" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-audience", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + } + ] + } + ], + "ca_default_comparison": [ + { + "explicit_ca": false, + "go": "go1.26.5", + "os": "darwin", + "trusted": false, + "binary": "cert-roots-126", + "module_go": "1.26.0", + "mode": "environment" + }, + { + "explicit_ca": true, + "go": "go1.26.5", + "os": "darwin", + "trusted": true, + "binary": "cert-roots-126", + "module_go": "1.26.0", + "mode": "explicit" + }, + { + "explicit_ca": false, + "go": "go1.26.5", + "os": "darwin", + "trusted": false, + "binary": "cert-roots-126", + "module_go": "1.26.0", + "mode": "legacy-platform" + }, + { + "explicit_ca": false, + "go": "go1.26.5", + "os": "darwin", + "trusted": false, + "binary": "cert-roots-126", + "module_go": "1.26.0", + "mode": "force-environment" + }, + { + "explicit_ca": false, + "go": "go1.27.1", + "os": "darwin", + "trusted": false, + "binary": "cert-roots-127", + "module_go": "1.26.0", + "mode": "environment" + }, + { + "explicit_ca": true, + "go": "go1.27.1", + "os": "darwin", + "trusted": true, + "binary": "cert-roots-127", + "module_go": "1.26.0", + "mode": "explicit" + }, + { + "explicit_ca": false, + "go": "go1.27.1", + "os": "darwin", + "trusted": false, + "binary": "cert-roots-127", + "module_go": "1.26.0", + "mode": "legacy-platform" + }, + { + "explicit_ca": false, + "go": "go1.27.1", + "os": "darwin", + "trusted": true, + "binary": "cert-roots-127", + "module_go": "1.26.0", + "mode": "force-environment" + }, + { + "explicit_ca": false, + "go": "go1.27.1", + "os": "darwin", + "trusted": true, + "binary": "cert-roots-app127", + "module_go": "1.27.1", + "mode": "environment" + }, + { + "explicit_ca": true, + "go": "go1.27.1", + "os": "darwin", + "trusted": true, + "binary": "cert-roots-app127", + "module_go": "1.27.1", + "mode": "explicit" + }, + { + "explicit_ca": false, + "go": "go1.27.1", + "os": "darwin", + "trusted": false, + "binary": "cert-roots-app127", + "module_go": "1.27.1", + "mode": "legacy-platform" + }, + { + "explicit_ca": false, + "go": "go1.27.1", + "os": "darwin", + "trusted": true, + "binary": "cert-roots-app127", + "module_go": "1.27.1", + "mode": "force-environment" + } + ], + "commands": [ + { + "repo": "silo", + "command": "CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local go test -mod=readonly -tags kqueue -count=1 ./cmd -run ^Test(Outbound|Server)TLSKeyExchangeDefaults$", + "platform": "darwin/arm64", + "phase": "before fix", + "exit": 1, + "result": "All five outbound constructor cases incorrectly offered ML-KEM with tlsmlkem=0, against both TLS 1.2 and TLS 1.3 peers; the listener incorrectly accepted a PQ-only client." + }, + { + "repo": "silo", + "command": "same focused command", + "platform": "darwin/arm64", + "phase": "after fix", + "exit": 0, + "result": "ok 1.322s" + }, + { + "repo": "silo", + "command": "GOWORK=off GOTOOLCHAIN=local go test -mod=readonly -race -tags kqueue -count=1 ./cmd -run ^Test(Outbound|Server)TLSKeyExchangeDefaults$", + "platform": "darwin/arm64", + "exit": 0, + "result": "ok 2.533s" + }, + { + "repo": "silo", + "command": "CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local go test -mod=readonly -tags kqueue -count=1 ./internal/crypto ./internal/config/... ./internal/http ./internal/grid", + "platform": "darwin/arm64", + "exit": 0 + }, + { + "repo": "silo", + "command": "locally cross-compiled server-cmd.test -test.run ^Test(Outbound|Server)TLSKeyExchangeDefaults$ -test.v -test.timeout 45s", + "platform": "linux/arm64", + "exit": 0, + "result": "20 outbound combinations and 4 inbound handshake attempts pass" + }, + { + "repo": "silo-pkg", + "command": "GOWORK=off GOTOOLCHAIN=local make test", + "go": "go1.27.1", + "platform": "darwin/arm64", + "exit": 0, + "result": "lint 0 issues; full race suite passes" + }, + { + "repo": "silo-pkg", + "command": "CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local /path/to/go1.26.5/bin/go test -mod=readonly -tags kqueue -count=1 ./...", + "go": "go1.26.5", + "platform": "darwin/arm64", + "exit": 0 + }, + { + "repo": "mc", + "command": "CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local go test -mod=readonly -tags kqueue -count=1 ./cmd", + "go": "go1.27.1", + "platform": "darwin/arm64", + "exit": 0, + "result": "ok 19.430s; includes S3 Select early-close cancellation" + }, + { + "repo": "mc", + "command": "golangci-lint v2.13.1 run --allow-serial-runners --build-tags kqueue --timeout=10m --config ./.golangci.yml", + "exit": 0, + "result": "0 issues; rerun after initial concurrent linter lock conflict" + }, + { + "repo": "silo-console", + "command": "CGO_ENABLED=0 GOWORK=off GOTOOLCHAIN=local go test -mod=readonly -tags kqueue -count=1 ./api/... ./pkg/...", + "go": "go1.27.1", + "platform": "darwin/arm64", + "exit": 0 + }, + { + "repo": "silo-console", + "command": "golangci-lint v2.13.1 run --build-tags kqueue --timeout=5m --config ./.golangci.yml", + "exit": 0, + "result": "0 issues" + }, + { + "repo": "silo", + "command": "GOWORK=off GOTOOLCHAIN=local make lint GOLANGCI=/Users/vonng/go/bin/golangci-lint", + "exit": 0, + "result": "Go lint 0 issues; typos absent, optional spelling check skipped. Used installed matching v2.13.1 after terminating only the task-owned redundant installer." + } + ], + "limits": [ + "Synthetic loopback fixtures, not the customer IdP or production network.", + "No full distributed TLS cluster or actual etcd, cloud, LDAP or Keycloak deployment.", + "No rendered browser, logout or production data migration test.", + "No Windows, old macOS or PowerPC runtime test.", + "No claim that all possible Go 1.27 regressions have been excluded." + ], + "post_review_validation": { + "recorded_utc": "2026-09-09T10:45:18.855578+00:00", + "phase": "After first Fable 5.1 Max review corrections, before final review and commit", + "first_review_verdict": "CHANGES REQUIRED: synthetic fixture routes broke rebrand CI after staging", + "corrections": [ + "Exclude docs/investigations from rebrand guard without changing its baseline", + "Use non-blocking ClientHello capture in all four test files", + "Remove unused internal HTTP curve override field", + "Clarify Keychain replacement and the SecP-only compatibility option", + "Label historical patch and worktree evidence as superseded or captured history" + ], + "rebrand_guard": { + "positive": { + "exit_code": 0, + "output": "compatibility manifest: imports=119 env=437 metrics=19 headers=86 routes=223 roots=1 grid=3 storage=15 policy=58 brand=180 sha256=373c66a6b05a19e2c2173034aa184b9237b249875fd33371cbda3414be7f6c34\nSilo rebrand compatibility baseline is unchanged\n" + }, + "negative_control": { + "exit_code": 1, + "output": "routes compatibility set changed\n + /codex-review-product-route\nexit status 1\n" + }, + "baseline_diff": "" + }, + "linux_server_build": { + "go": "go1.27.1", + "sha256": "e904a7df2fda47391a3a0725589332a6fc1b456411ffacca3e2dad326d744dcc", + "settings": [ + "build\t-buildmode=exe", + "build\t-compiler=gc", + "build\t-tags=kqueue", + "build\tCGO_ENABLED=0", + "build\tGOARCH=arm64", + "build\tGOOS=linux", + "build\tGOARM64=v8.0", + "build\tvcs=git", + "build\tvcs.revision=d1105bbb3d4a0afa33b3a4ac11b821235038ed0e", + "build\tvcs.time=2026-09-09T06:55:35Z", + "build\tvcs.modified=true" + ], + "runtime_source_sha256": { + "cmd/grid.go": "570c10a301e4ed3c842c1811711df99021cbeafa7142a97e287df0f78175aae9", + "cmd/utils.go": "c84727b88ac0b7e1442bce1c81c719518dabdbd8fca5002144329070ea98e34e", + "internal/config/etcd/etcd.go": "0c29792e070d09f05b83effb639b324148ea56cc709077dcb6892a3a37c16d42", + "internal/crypto/crypto.go": "c3bf12d2fe9d998697a9a3aa6084b83d50d84d8af06c2af0e8598326e7ddbaf9", + "internal/http/transports.go": "12e22830e98dd7391329b852eee8481981c74450b1cf7601c1d6623ee46b3981" + } + }, + "linux_integration": [ + { + "case": "allpaths-add", + "binary": "candidate-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "add_ok": true, + "add_reset": false, + "events": [ + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "ua": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (linux; arm64; mode-server-xl-single; docker; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:16; vendor:Apple; family:; model:0x000; stepping:0; model_name:))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (linux; arm64; mode-server-xl-single; docker; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:16; vendor:Apple; family:; model:0x000; stepping:0; model_name:))" + } + ] + }, + { + "case": "allpaths-compat-login", + "binary": "candidate-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "oauth": { + "callback_status": 200, + "login_status": 204, + "buckets_status": 200, + "session_cookie": true + }, + "bad-signature": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "bad-audience": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (linux; arm64; mode-server-xl-single; docker; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:16; vendor:Apple; family:; model:0x000; stepping:0; model_name:))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (linux; arm64; mode-server-xl-single; docker; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:16; vendor:Apple; family:; model:0x000; stepping:0; model_name:))" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "ua": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 269, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-signature", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (linux; arm64; mode-server-xl-single; docker; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:16; vendor:Apple; family:; model:0x000; stepping:0; model_name:))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-audience", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Go-http-client/1.1" + } + ] + }, + { + "case": "allpaths-tls13-login", + "binary": "candidate-go127", + "mode": "normal", + "godebug": null, + "tls13": true, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "oauth": { + "callback_status": 200, + "login_status": 204, + "buckets_status": 200, + "session_cookie": true + }, + "bad-signature": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "bad-audience": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "events": [ + { + "alpn": null, + "bytes_read": 1513, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Silo (linux; arm64; mode-server-xl-single; docker; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:16; vendor:Apple; family:; model:0x000; stepping:0; model_name:))" + }, + { + "cipher": 4865, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Silo (linux; arm64; mode-server-xl-single; docker; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:16; vendor:Apple; family:; model:0x000; stepping:0; model_name:))" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 772, + "ua": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 1495, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-signature", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Silo (linux; arm64; mode-server-xl-single; docker; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:16; vendor:Apple; family:; model:0x000; stepping:0; model_name:))" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-audience", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "ua": "Go-http-client/1.1" + } + ] + } + ], + "tests": { + "mc": [ + { + "command": [ + "go", + "test", + "-mod=readonly", + "-race", + "-tags", + "kqueue", + "-count=1", + "-run", + "^TestClientTLSKeyExchangeDefaults$", + "./cmd" + ], + "exit_code": 0, + "seconds": 10.066, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-mc-0.log" + } + ], + "silo-console": [ + { + "command": [ + "go", + "test", + "-mod=readonly", + "-race", + "-tags", + "kqueue", + "-count=1", + "-run", + "^TestOutboundTLSKeyExchangeDefaults$", + "./api" + ], + "exit_code": 0, + "seconds": 10.603, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-silo-console-0.log" + } + ], + "silo-pkg": [ + { + "command": [ + "make", + "test" + ], + "exit_code": 0, + "seconds": 16.946, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-silo-pkg-0.log" + }, + { + "command": [ + "/Users/vonng/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.26.5.darwin-arm64/bin/go", + "test", + "-mod=readonly", + "-count=1", + "-run", + "^TestWebEnvTLSKeyExchangeDefaults$", + "./env" + ], + "exit_code": 0, + "seconds": 1.457, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-silo-pkg-1.log" + } + ], + "silo": [ + { + "command": [ + "go", + "test", + "-mod=readonly", + "-race", + "-tags", + "kqueue", + "-count=1", + "-run", + "^Test(Outbound|Server)TLSKeyExchangeDefaults$", + "./cmd" + ], + "exit_code": 0, + "seconds": 33.047, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-silo-0.log" + }, + { + "command": [ + "go", + "test", + "-mod=readonly", + "-race", + "-tags", + "kqueue", + "-count=1", + "./internal/http" + ], + "exit_code": 0, + "seconds": 2.379, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-silo-1.log" + } + ] + }, + "lint": [ + { + "repo": "silo", + "command": [ + "make", + "lint", + "GOLANGCI=/Users/vonng/go/bin/golangci-lint" + ], + "exit_code": 0, + "seconds": 63.943, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-silo-lint.log" + }, + { + "repo": "mc", + "command": [ + "/Users/vonng/go/bin/golangci-lint", + "run", + "--build-tags", + "kqueue", + "--timeout=10m", + "--config", + "./.golangci.yml" + ], + "exit_code": 0, + "seconds": 15.794, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-mc-lint.log" + }, + { + "repo": "silo-console", + "command": [ + "/Users/vonng/go/bin/golangci-lint", + "run", + "--build-tags", + "kqueue", + "--timeout=5m", + "--config", + "./.golangci.yml" + ], + "exit_code": 0, + "seconds": 29.207, + "log": "/private/tmp/silo-go127-fable51-review.7ega9azp/after-review-silo-console-lint.log" + } + ], + "independent_test_note": "The first review observed one shuffled certs.TestValidPairAfterWrite timing failure in an untouched separate test binary; three plain reruns, the same seed, and the full certs rerun passed. The post-correction make test full race suite also passes." + } +} diff --git a/docs/investigations/go127-stack.md b/docs/investigations/go127-stack.md new file mode 100644 index 000000000..7bd5a74e5 --- /dev/null +++ b/docs/investigations/go127-stack.md @@ -0,0 +1,184 @@ +# SILO stack: Go 1.27 compatibility audit + +2026-09-09. Scope: the maintained Server, silo-pkg, mcli, and Console. This extends +the [OIDC #154 investigation](issue-154.md) to other paths using the same TLS +configuration and to adjacent standard-library changes. It records local +validation performed before commit. No pushes, issue comments, releases, or +production changes were made during the audit. + +## Findings and changes + +| Component | Finding | Change | +| --- | --- | --- | +| Server, baseline `d1105bbb3d4a0afa33b3a4ac11b821235038ed0e` | Eight TLS configuration sites explicitly use the same ML-KEM-containing curve list, overriding `tlsmlkem=0` in Go 1.27. | Remove the eight assignments and obsolete `TLSCurveIDs` helper. Retain Go defaults in HTTP clients, replication, cloud client-certificate transport, both grid links, etcd, and the S3 listener. Add wire-level regression tests. | +| silo-pkg, baseline `a92c54d` | No built-in explicit PQ curve list. Web environment transport uses defaults; LDAP/OIDC accept caller configuration. | Add a real web-environment TLS regression test and document runtime-default selection. Keep the Go 1.26 library floor. | +| mcli, baseline `fcd5cad8` | S3/Admin transport and alias/TOFU dialer use default curves. No instance of the Server's override bug found. | Add real S3/Admin transport and alias-dialer handshake tests; update Go/TLS upgrade notes. | +| Console, baseline `c103d08ec` | IdP, SILO/STS, Prometheus, and webhook clients share a transport using defaults. The HTTPS listener explicitly uses only P-256. | Add real IdP/SILO-client handshake tests; update Go/TLS upgrade notes. Retain the existing listener policy. | + +The Server's general external HTTP transport is also used by OpenID discovery +and JWKS, identity plugins, notification/lambda checks, audit/log webhooks, and +S3 cloud backends. Fixing only the two OIDC callers would leave those other paths +affected. The broader correction supersedes the earlier OIDC-only candidate. + +The retained defaults follow Go's implementation rather than duplicating its +`GODEBUG` parser. Go 1.27 explicitly changed the interaction between manually +selected curves and the `tlsmlkem`/`tlssecpmlkem` default controls. See the +[Go TLS release notes](https://go.dev/doc/go1.27#crypto/tls). + +With no opt-out, default curves additionally include SecP256r1MLKEM768 and +SecP384r1MLKEM1024. With `GODEBUG=tlsmlkem=0`, hybrid exchanges are disabled for +default-configured TLS throughout the process. This is an intentional change +from the old fixed subset. `GODEBUG=tlssecpmlkem=0` disables just the SecP +hybrids while retaining X25519MLKEM768. TLS versions, cipher-suite policy, +certificate and hostname checks, client certificates, proxies, and HTTP/2 choices are not +relaxed by this patch. No automatic fallback after a TLS error is introduced. + +## Reproduction and regression evidence + +Before changing product code, the new Server test failed for all five tested +outbound constructors with `tlsmlkem=0`: general external HTTP, internode HTTP, +replication, cloud client certificates, and etcd. The server observed +`[X25519MLKEM768 X25519 P256 P384 P521]` in every case. Both TLS 1.2 and TLS 1.3 +peers reproduced the problem. The inbound Server also accepted a PQ-only client +despite the same opt-out. + +After the change, those tests pass on darwin/arm64 and linux/arm64. They exercise +20 outbound combinations (five constructors, two peer TLS versions, two debug +settings), plus inbound classical/PQ-only peers with the opt-out enabled and +disabled. The inbound opt-out case rejects a PQ-only peer while continuing to +accept P-256. The etcd test exercises its actual TLS configuration, not an etcd +cluster; the client-certificate test exercises construction/loading, not a full +mutual-authentication service. + +The mc, Console, and silo-pkg handshake tests pass without product code changes. +All use a trusted synthetic certificate and inspect a real ClientHello. They +check both disabling and retaining ML-KEM. Console also retains its existing +unknown-CA, hostname, and endpoint-scoping regression checks. + +A freshly source-built complete Linux Server then passed three isolated +integration scenarios using the existing synthetic IdP fixture: + +| Scenario | Result | +| --- | --- | +| ML-KEM-intolerant IdP + `tlsmlkem=0` | Discovery/JWKS, IAM, Console, and authenticated Admin calls succeed; login 204 and bucket list 200. | +| Normal TLS 1.3 IdP, no opt-out | Same successful login, token exchange, STS, session, and bucket-list chain. | +| Add OIDC to a running Server | Actual Admin API accepts the provider under the compatibility setting. | + +Both login scenarios reject modified JWT signatures and a wrong audience: no +session cookie is issued and authenticated bucket access returns 403. Login +currently reports these authentication failures as 500; that existing error +mapping is outside this TLS change. Curl in the same namespace returns HTTP/2 +200. The containers use a pre-existing generic Debian image, `--network none`, +and no published ports; no Server or Console image was downloaded or used. + +The fixture drives real Console HTTP APIs, not rendered browser interaction. +This is a conditional interoperability reproduction, not proof of the actual +customer ingress behavior. Grid's existing tests pass, but a production-style +distributed TLS cluster, external cloud providers, and real etcd/LDAP/Keycloak +deployments were not exercised. Disabling ML-KEM does not disable new ML-DSA +signature offers and does not repair an ingress that rejects those offers. + +## Other Go changes checked + +### macOS root certificates: a confirmed upgrade-visible change + +Using the same public synthetic CA and `certs.GetRootCAs`, fresh-process probes +produce the following results when `SSL_CERT_FILE` points at that CA and +`SSL_CERT_DIR` points at an empty directory: + +| Compiler / main module | CA from environment trusted? | Explicit CA argument trusted? | +| --- | --- | --- | +| Go 1.26.5 / `go 1.26.0` | No | Yes | +| Go 1.27.1 / `go 1.26.0` | No | Yes | +| Go 1.27.1 / `go 1.27.1` | Yes | Yes | + +The Go 1.26 module built by Go 1.27 carries +`DefaultGODEBUG=...x509sslcertoverrideplatform=0`; explicitly setting that option +to `1` enables the new behavior. A Go 1.27 application can explicitly set it to +`0` to recover the previous platform behavior. The diagnostic source is +[cert-roots.go](issue-154/cert-roots.go). The consuming application's defaults +apply to library calls as well, so silo-pkg's older `go` directive does not +prevent the behavior in Server, mc, or Console. + +This is expected standard-library behavior, not a reason to silently discard +configured CA variables or skip verification. Setting either variable replaces +Keychain trust with on-disk roots and Go's verifier; stale or incomplete paths +can break previously trusted connections. Unset inherited variables to restore +Keychain trust; explicit additional CAs still work. The three application +READMEs and the package README now document this. The package's Windows loader enumerates +the native ROOT store directly and does not call `SystemCertPool`; it does not +inherit this particular new setting. Windows behavior was reviewed in source, +not runtime-tested. + +### JSON, HTTP, timers, and other compatibility controls + +- **JSON:** checked owned JSON error handling and exercised policy/condition, + config, and authentication tests. `quick` uses typed `SyntaxError` and + `UnmarshalTypeError`; no owned decision depending on changed standard JSON + error text was found. silo-pkg's full suite passes with both Go compilers; + mc's command and Console's API/auth suites pass under Go 1.27. No broad + `nojsonv2` opt-out or serialization rewrite is justified by these results. +- **HTTP response closing:** Go 1.27's standard-library drain is bounded at + 256 KiB and 50 ms. mc's actual early-close/cancel regression passes, including + the compressed S3 Select stream. Existing owned drain helpers can still have + independent timeout concerns; those are not newly caused by this Go change. +- **ALPN and custom connections:** mc's TLS dialer returns a real `*tls.Conn`; + its deadline wrapper is on the TCP dial path. No new accidental HTTP/2 opt-in + from the expanded `ConnectionState` interface support was identified in + these transports. Console keeps its existing transport policy. +- **Removed switches:** no maintained runtime/config reliance on `tlsrsakex`, + `tls3des`, `tls10server`, `x509keypairleaf`, or `asynctimerchan` was found. + Existing explicit cipher policies continue to be explicit. Timer uses in + package certificate reload and license refresh do not depend on buffered + timer-channel length/capacity. Unix EOF error changes do not expose a matching + owned error-type assumption on the reviewed Unix-socket paths. +- **Platform floor:** application READMEs now identify macOS 13 as the minimum + for Go 1.27 binaries. No Windows, old macOS, or PowerPC runtime claim is made. + +## Validation and delivery + +- Server: focused TLS tests on macOS and Linux; macOS race run; crypto, HTTP, + grid, and all `internal/config/...` tests; full Linux Server build and the + three integration scenarios above. +- silo-pkg: `make test` (lint and full race suite) on Go 1.27.1; full suite on + Go 1.26.5, preserving the library floor. +- mc: complete `./cmd` suite, including the new TLS test and existing S3 Select + early-cancel test. +- Console: complete `./api/... ./pkg/...` suites, including identity and STS + validation and the new handshake tests. + +Go lint reports zero issues in all four repositories. Server's optional spelling +check is skipped because `typos` is not installed. Its lint target used the +already-installed matching golangci-lint v2.13.1 after a redundant download was +stopped; mc's lint was rerun serially after the global linter lock prevented the +first concurrent attempt. These tooling retries did not require source changes. + +An independent Fable 5.1 Max review reproduced the old-code failures and ran the +new TLS tests with the race detector. Its shuffled mc and Console suites passed. +One shuffled silo-pkg run failed the untouched `certs.TestValidPairAfterWrite`; +that test passed three plain reruns, the same shuffle seed, and the full certs +package rerun. The certs package runs in a separate test binary from the changed +env tests; this was classified as an existing timing flake. + +The review also found that committing the diagnostic fixture made rebrand CI +count synthetic IdP paths as product routes. The guard now excludes +`docs/investigations/`; the product compatibility baseline is unchanged. +The full proposed file set passes the guard, and a negative control adding a +product route still fails. After the review corrections, a fresh Linux Server +build passed all three integration scenarios again; the new binary identity and +rerun results are recorded in the evidence file's `post_review_validation`. + +All source and dependency choices remain those of the maintained PGSTY stack. +`go.mod` and `go.sum` are unchanged in every repository. The Server uses its +existing pinned Console/pkg/mc modules; the companion changes are tests and +documentation, so no replacement graph or unpublished dependency version is +needed to build the runtime fix. + +Validation used separate worktrees for Server, silo-pkg, mc, and Console, leaving +the original repositories and their `main` branches untouched. Build identities, +fixture results, and command outcomes are recorded in +[go127-stack-evidence.json](go127-stack-evidence.json). Absolute paths and branch +names in the captured evidence identify the environment at recording time. +The recorded module graph identifies the dependencies selected for those +builds; `go.sum` also retains checksums for unselected versions. Local image IDs +and temporary paths are historical evidence, not portable setup instructions. diff --git a/docs/investigations/issue-154.md b/docs/investigations/issue-154.md new file mode 100644 index 000000000..e873a9512 --- /dev/null +++ b/docs/investigations/issue-154.md @@ -0,0 +1,403 @@ +# SILO #154：OIDC discovery 连接重置调查 + +前两轮调查时间：2026-09-09；公开 issue 最后核对于 07:53 UTC。第二轮补充同源码、同依赖、不同 Go 工具链的 Linux 完整 Server 对照和候选补丁认证链路验证。 + +**后续更新：用户已授权扩展至整个 SILO 技术栈并修复。现已确认 Server 其他 TLS 路径也存在同类覆盖问题，并在产品工作区完成统一使用 Go 默认曲线的修复。当前实现、验证和交付状态见 [全栈调查](go127-stack.md)。下文保留前两轮的诊断与当时的 OIDC 局部候选；“未修改产品”和“不要扩大范围”等表述仅适用于当时的调查阶段，局部候选已被后续全路径修复取代。** + +## 判断与处理顺序 + +**目前可以确认是 Server 发出的 discovery GET 失败，随后 IAM 初始化等待，Console 初始化也被延后；还不能确认真实连接由谁、在哪个协议阶段重置。优先调查 SILO/Go 客户端与 IdP 前置 TLS 终止器、代理或 WAF 的互操作。** 现有证据不支持将其定性为证书错误、Keycloak 配置错误、JWT 校验错误或 `coreos/go-oidc` 回归。 + +有两项与版本相关、可在本地验证的 TLS 差异： + +1. **Go 1.27 改变了 `GODEBUG=tlsmlkem=0` 与显式 `CurvePreferences` 的关系。** SILO 两个版本都显式包含 X25519MLKEM768。旧版 Go 1.26.5 会根据该环境选项移除它；Go 1.27.1 保留显式配置。在模拟拒绝 ML-KEM 的入口上，能重现“相同选项下旧 Server 启动成功，新 Server 持续 reset”。**客户是否设置过这个选项尚未知，不能把条件性复现当成客户根因。** +2. **Go 1.27 的 ClientHello 新增 ML-DSA 签名算法。** 没有上述环境选项时，新旧版本也会发送不同的握手。人为拒绝新算法编号的入口同样能产生旧成功、新失败。真实入口是否存在这种行为尚未知。 + +另外，HTTP User-Agent 从 `MinIO` 变成了 `Silo`；若连接在 TLS 完成、GET 发出之后被重置，应优先查 WAF、User-Agent 规则和 HTTP 路由，而不是继续调整 TLS。 + +最短路径：**先在故障进程所在环境拿到实际 Go 版本、是否设置 `tlsmlkem=0`、目标 IP 和 TLS 完成与否；再针对已证实的分支处理。** 优先修正入口兼容性或错误路由。若确认是上述环境选项失效，只为 OpenID 出站请求恢复 Go 默认曲线选择，是目前最小的代码候选。现阶段不宜做全局 TLS 改动或整体依赖回退。 + +## 第二轮结论：已隔离 Go 因素，局部候选修复通过 Linux 验证 + +**可以复现一种由 Go 1.26.5 → 1.27.1 单独触发的兼容性回归。建议保留 Go、针对已确认分支修复；整体回退只用于临时恢复服务。** 这里的“已确认”指本地实验机制，仍不等于已经确认客户入口的根因。 + +四个完整 Server 都从本地源码编译为 `linux/arm64`，在现成通用 Debian 12 基础镜像的 `--network none` 容器中运行；Server、合成 IdP、Console 和 curl 共用同一 loopback 网络，没有暴露端口。没有下载或运行 Server/Console 镜像。旧源码为 `d88f46ccee345a9c2fabe2d221d9a9e56bc11aec`，当前源码为 `d1105bbb3d4a0afa33b3a4ac11b821235038ed0e`。 + +旧源码两次构建使用完全相同的 `go.mod`、`go.sum` 和实际链接模块版本，仅替换编译器；当前源码与候选补丁构建的依赖图也完全相同。实际二进制 SHA-256、`go version -m` 依赖和构建选项保存在 [Linux 证据](issue-154/linux-evidence.json)。 + +下表的入口**人为设置为见到 X25519MLKEM768 就发 TCP RST**，Server 都设置 `GODEBUG=tlsmlkem=0`： + +| 源码与编译器 | Server 初始 ClientHello | 完整 Server 结果 | 同容器 curl | +| --- | --- | --- | --- | +| 同一份旧源码 + Go 1.26.5 | 275 字节，无 ML-KEM | discovery、JWKS、IAM、Console 正常；cluster 200 | HTTP/2 200 | +| 同一份旧源码 + Go 1.27.1 | 1509 字节，仍包含 ML-KEM | `connection reset by peer`；IAM 等待；cluster 503；Console 未启动 | HTTP/2 200 | +| 当前源码 + Go 1.27.1 | 1509 字节，仍包含 ML-KEM | 同样失败 | HTTP/2 200 | +| 当前源码 + 局部候选补丁 + Go 1.27.1 | 287 字节，无 ML-KEM | 完整启动及合成 OIDC 登录成功 | HTTP/2 200 | + +这将该条件下的回归定位到工具链行为，而非 Console、pkg、mc 或 `coreos/go-oidc` 升级。Go 1.27 的发布说明明确将此作为有意改变：`tlsmlkem` / `tlssecpmlkem` 只控制默认曲线集合，显式指定的集合可以继续启用这些算法。SILO 现有曲线列表显式包含该算法，因而原来的兼容开关在这条路径失效。[Go 1.27 crypto/tls 说明](https://go.dev/doc/go1.27#crypto/tls)。 + +共完成 **12 个 Linux 场景**，其中失败用例按预期失败： + +- 正常 TLS 1.2 / P-256 / RSA / AES-256-GCM 的 IdP，旧源码用两个 Go 版本编译均正常，证明不是 Go 1.27 普遍无法连接这套 TLS。 +- 上表四个对照均符合预期；候选补丁如果不设置 `tlsmlkem=0`，仍被 ML-KEM 拒绝规则拦截。补丁恢复显式兼容选项的作用，不会自行关闭后量子算法。 +- 候选补丁在上述 TLS 1.2 兼容场景、以及无 GODEBUG 的正常 TLS 1.3 场景，都完成 Console 登录信息获取 → IdP authorization redirect → callback → token exchange → STS 凭据 → Console 会话 → 桶列表读取。登录 API 为 204，桶列表为 200。 +- 两个登录场景分别提交错误签名与错误 audience 的 JWT，登录返回 500、桶列表返回 403，没有生成会话 cookie。这里只确认认证未放行，没有将现有 500 状态码行为改为另一项修复。 +- 不信任 CA 时，候选 Server 仍因 `x509: certificate signed by unknown authority` 停在 IAM 初始化。没有关闭证书校验。 +- 不配置 OIDC 启动后，经实际 Admin API 添加同一合成 provider：当前源码失败且返回 reset；候选补丁成功。 +- 入口改为拒绝 ML-DSA 签名编号，候选补丁加 `tlsmlkem=0` 仍失败。这是另一条机制，当前补丁没有解决它。 + +认证流程由 Python 驱动真实 Console HTTP API；IdP 使用一次性合成授权码和自行签发的实验 JWT，没有客户账户。没有执行浏览器页面交互、登出、真实 Keycloak 或生产数据升级测试。TLS 1.3 对照实际协商 TLS 1.3/P-256，不是所有新增后量子曲线的互操作覆盖。 + +### 修复与回退的取舍 + +[候选补丁](issue-154/openid-default-curves.patch) 只有三个文件：增加 OpenID 专用 transport helper，将其 `TLSClientConfig.CurvePreferences` 设为 `nil`，再替换 IAM 初始化和 OpenID 配置校验两个调用点。测试时仅应用于隔离源码副本，当前产品工作区未应用；Go 版本与所有依赖保持不变。它让 Go 默认策略和现有兼容开关接管外部 IdP 的密钥交换，其他 TLS 参数继续来自现有构造函数。 + +如果客户证据确认此分支，建议采用该局部修复，并在客户实际入口复验。如果客户没有设置 `tlsmlkem=0`，它不能单独解释旧版成功：旧版默认也发送 ML-KEM。此时应继续区分 ML-DSA、其他握手变化、HTTP/WAF 规则与网络路径；不把此补丁直接宣称为 #154 的完整修复。 + +**不建议将当前产品直接改回 Go 1.26。** 实测以 Go 1.26.7 和 `GOTOOLCHAIN=local` 读取当前源码即被 `go.mod requires go >= 1.27.1` 拒绝；所固定的 Server、Console、mc 均声明 Go 1.27.1。回退需要进一步调整这些模块及可能的传递依赖，不是只换一个编译器版本。这个报错证明当前依赖图不能原样回编，并不证明经过额外适配后绝对无法回编。报告中已恢复服务的旧版可作为临时运行状态，不能把这种处置等同于完成兼容修复。 + +第二轮的运行脚本是 [run-linux.py](issue-154/run-linux.py)，结果是 [linux-evidence.json](issue-154/linux-evidence.json)，具体构建和运行步骤见文末。没有 issue 评论、提交、推送、合并或发布。 + +候选副本另通过 Go 1.27.1、darwin/arm64、CGO 关闭的 `go test -mod=readonly -count=1 ./internal/http ./internal/config/identity/openid`；补丁可以干净应用到调查基线。这些包级测试与上述 Linux 集成验证分别记录，不将其当成 Linux 单元测试结果。 + +## 范围、版本与公开证据 + +- 初始工作区干净，处于 detached HEAD；调查分支为 `codex/investigate-oidc-154`，基线与远端 main 均为 `d1105bbb3d4a0afa33b3a4ac11b821235038ed0e`。 +- 已读取 `/Users/vonng/pgsty/silo/AGENTS.md` 及工作区适用说明。维护范围为 PGSTY 的 Server、Console、mc、silo-pkg；上游 MinIO 仅作参考。 +- 第一轮 Server 与 transport 探针为本地源码构建的 darwin/arm64 程序，第二轮完整 Server 交叉构建为 linux/arm64；均使用 `CGO_ENABLED=0 GOWORK=off`。fixture 与 Admin 辅助程序也由本机 Go 构建。历史源码使用 `git archive` 导入隔离临时目录。没有下载或运行 Server/Console Docker 镜像，没有访问客户端点，没有改动真实服务或数据，没有评论 issue、推送、合并或发布。 +- 产品源码、`go.mod`、`go.sum` 未修改。本目录中的 Go 文件是显式运行的调查工具，带 `//go:build ignore`，不进入正常构建。 + +| 项目 | 旧版：2026-08-04 | 报告故障版：2026-09-03 | 调查时 main | +| --- | --- | --- | --- | +| 完整 tag | `RELEASE.2026-08-04T00-00-00Z` | `RELEASE.2026-09-03T13-18-01Z` | 无新 release 声明 | +| 源码 commit | `d88f46ccee345a9c2fabe2d221d9a9e56bc11aec` | `9b11dc9469e650815b775cb47b039610644f5da4` | `d1105bbb3d4a0afa33b3a4ac11b821235038ed0e` | +| go.mod / Docker 构建定义 | Go 1.26.5 | Go 1.27.1 | Go 1.27.1 | +| 本地 Server / 探针实际编译器 | Go 1.26.5 | Go 1.27.1 | Go 1.27.1 | +| Console replacement | `v0.0.0-20260804042150-b952a1202869` | `v0.0.0-20260903111932-464a59d73ada` | `v0.0.0-20260908142700-c103d08ec36a` | +| mc replacement | `v0.0.0-20260801042411-ad10a2a10b76` | `v0.0.0-20260903063637-a2ef95c035d9` | `v0.0.0-20260909015522-fcd5cad8247f` | +| PGSTY silo-pkg | v3.11.0，替换历史 minio/pkg 路径 | v3.13.2，直接依赖 | v3.13.3，直接依赖 | +| coreos/go-oidc/v3 | v3.17.0 | v3.21.0 | v3.21.0 | +| x/crypto | v0.54.0 | v0.56.0 | v0.56.0 | +| x/net | v0.57.0 | v0.58.0 | v0.58.0 | +| x/oauth2 | v0.36.0 | v0.36.0 | v0.36.0 | + +版本依据：[旧版 go.mod](https://github.com/pgsty/silo/blob/d88f46ccee345a9c2fabe2d221d9a9e56bc11aec/go.mod)、[故障版 go.mod](https://github.com/pgsty/silo/blob/9b11dc9469e650815b775cb47b039610644f5da4/go.mod)、[本次 main go.mod](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/go.mod)。还核对了各 tag 的 `Dockerfile.goreleaser` 和 release workflow。它们声明相应 Go 构建版本、禁用 CGO；历史归档、本次探针和 Server 均用 `go version -m` 核实实际编译器与 replacement。**这些不是客户实际镜像 digest 或其内二进制的取证，后者仍需 `--version` / build info 确认。** + +[Issue #154](https://github.com/pgsty/silo/issues/154) 当前 OPEN，最后更新时间 `2026-09-08T05:30:42Z`，评论数为 0。报告包含升级后 Server 初始化失败、旧版回退恢复、测试实例添加 OIDC 失败，以及 curl 成功的输出。 + +curl 那次连接验证了所收到的证书链，并选择 TLS 1.2、`ECDHE-RSA-AES256-GCM-SHA384`、P-256 和 HTTP/2；解析得到两个 IPv4，记录中实际访问了其中一个。**公开命令使用 `docker run --rm` 新建容器，并非 `docker exec` 进入原故障容器；同镜像不能证明同网络命名空间、环境变量、CA 挂载、DNS 结果或出口。** 域名、realm、IP 已脱敏，本次不推测其真实值。 + +## 实际请求链 + +### IAM 与配置校验 + +```text +Server startup + IAMSys.Init + openid.LookupConfig + parseDiscoveryDoc: GET .well-known/openid-configuration + PopulatePublicKey: GET discovery 中的 jwks_uri + IAM store 初始化 + Console 初始化 + +Console 添加 OIDC + AdminClient.AddOrUpdateIDPConfig + Server addOrUpdateIDPHandler + validateConfig(identity_openid) + 同一个 openid.LookupConfig / NewHTTPTransport +``` + +`parseDiscoveryDoc` 是 SILO 自己的实现，用标准库 `http.Client` 发 GET，收到成功响应后才解码 JSON；这次日志中的 `Get ... read tcp ... reset` 发生在该调用返回响应之前，不能进一步区分 TLS 与 HTTP。请求本身不需要客户 client secret、token 或私钥。[IAM 调用点](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/iam.go#L278-L288)、[discovery 实现](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/internal/config/identity/openid/jwt.go#L261-L285)、[JWKS 实现](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/internal/config/identity/openid/jwt.go#L89-L110)。 + +Console 的添加表单通过 Admin API 触发 Server 配置校验。校验成功才写入配置；本地已重现该 API 返回同样的 reset，恢复 IdP 后再次创建成功并要求重启。[Console 调用](https://github.com/pgsty/silo-console/blob/c103d08ec36a/api/admin_idp.go#L79-L114)、[Admin 客户端](https://github.com/pgsty/silo-console/blob/c103d08ec36a/api/client-admin.go#L593-L595)、[Server 校验和保存边界](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/admin-handlers-idp-config.go#L127-L150)、[OpenID 配置校验](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/config-current.go#L353-L359)。 + +`coreos/go-oidc.NewProvider` 在 Server 中的使用是 `MockOpenIDTestUserInteraction` 测试辅助函数，不是这次 IAM discovery 调用链。升级此依赖不能单独解释或修复该 GET。`crypto/tls` 和这里的 `net/http` 属于 Go 标准库，不能用 go.mod 中 `x/crypto`、`x/net` 的版本代替它们的实际行为。[辅助函数](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/utils.go#L994-L1012)。 + +### transport 参数与环境 + +| 项目 | 实际行为及意义 | +| --- | --- | +| 构造 | `NewHTTPTransport()` → `NewHTTPTransportWithTimeout(time.Minute)` → `xhttp.ConnSettings`。每次 IAM 初始化重试都会重新构造。 | +| TLS 版本 | 未显式设置 Min/Max；所比较 Go 工具链的正常默认范围是 TLS 1.2–1.3。证书、主机名验证开启。 | +| 密码套件 | 显式 `TLSCiphersBackwardCompatible()`，包含 curl 成功使用的 ECDHE-RSA/AES-256-GCM。没有理由为本 issue 添加旧 RSA、3DES 或 SHA-1 例外。 | +| 曲线 | 显式 `{X25519MLKEM768, P256, X25519, P384, P521}`，两个 release 和当前 main 相同。实际上线顺序还受 Go 实现控制，见实验。 | +| ALPN / HTTP | `EnableHTTP2=false`，同时设置自定义 TLS config 和 DialContext；实测 ClientHello 没有 ALPN，GET 使用 HTTP/1.1。三个版本一致。`GODEBUG=http2client=0` 对此基线路径无修复价值。 | +| 代理 | `http.ProxyFromEnvironment`；HTTPS URL 使用 `HTTPS_PROXY` / `https_proxy` 与 `NO_PROXY` / `no_proxy`。这两版标准库均优先非空大写值，不使用 `ALL_PROXY`；设置在进程内缓存。不能根据 curl 的路由推断它。注意 go.mod 的 x/net v0.58.0 代码不是这里所用的标准库 vendored 实现。 | +| DNS | `globalDNSCache.LookupHost`，dnscache v0.1.1；默认刷新窗口在容器/Kubernetes 为 30 秒，其他环境为 10 分钟，可配置。按返回地址逐个尝试 TCP，首次 TCP 成功就返回；随后 TLS/HTTP 失败不会回到这个循环尝试另一 IP。代码注释称随机选择，但该循环没有 shuffle。 | +| Linux TCP 参数 | 使用 SILO 的自定义 dialer，包含 TCP fast open/keepalive 等设置，部分参数来自 Server CLI，包括 interface、buffer、user timeout。第二轮执行了完整 Linux Server 的正常 CLI 初始化，但只验证 loopback；不能排除实际出口设备、路由或非默认 CLI 参数的交互。 | +| CA | `silo-pkg/certs.GetRootCAs` 加载系统根、Kubernetes CA 目录和 `certs/CAs`；Server 还加入自己的公开服务证书。相关 pkg CA 加载实现未在这次版本比较中变化；实际文件和路径仍可能因部署变化不同。 | +| 超时 | TCP 拨号 5 秒，TLS 握手 10 秒，响应头 1 分钟；discovery/JWKS 的 Client 没有总超时，discovery 使用的 Request 也没有调用方 context。响应体停滞不受响应头超时保护。 | +| 复用 | keep-alive 开启，idle 15 秒，TLS session cache 100。一次初始化内 discovery 与 JWKS 可复用连接；初始化重试的新 transport 没有旧连接或 session。持续首次握手失败不能用清理空闲连接解释。 | +| 请求标识 | UA 包含产品、OS、架构、模式和构建信息，产品名从 `MinIO` 变为 `Silo`；传输层禁用自动压缩。UA 规则只能在 HTTPS 被终止、HTTP 请求可见之后起作用。 | + +源码：[构造与超时](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/utils.go#L651-L670)、[HTTP/TLS 参数](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/internal/http/transports.go#L44-L94)、[密码套件与曲线](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/internal/crypto/crypto.go#L52-L78)、[DNS 拨号循环](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/internal/http/dial_dnscache.go#L42-L84)、[缓存刷新](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/common-main.go#L551-L578)、[CA 加载](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/server-main.go#L383-L395)、[UA](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/update.go#L228-L266)。 + +比较旧 tag 与故障 tag，OpenID discovery、transport、曲线实现的变动仅为 pkg 导入路径调整；IAM 另有品牌日志变更。比较故障 tag 与本次 main，这些关键实现没有变动。因此不能把当前依赖推进当成 #154 已解决的证据。 + +**Console 登录阶段是另一条出站路径。** 当前及故障版 Console 通过 `GetConsoleHTTPClient` / `GlobalTransport` 再获取 discovery、交换令牌，TLS config 未指定 CurvePreferences，仍做完整证书验证；不能把“添加配置走 Server”推广为所有 Console OIDC 请求都走 Server transport。任何修复最终都必须验证完整登录。`CONSOLE_MINIO_SERVER_TLS_SKIP_VERIFY` 只针对 SILO 端点，不能作为 IdP 修复。[Console transport](https://github.com/pgsty/silo-console/blob/c103d08ec36a/api/config.go#L68-L121)、[IdP 客户端](https://github.com/pgsty/silo-console/blob/c103d08ec36a/api/tls.go#L59-L70)、[Console discovery](https://github.com/pgsty/silo-console/blob/c103d08ec36a/pkg/auth/idp/oauth2/provider.go#L428-L449)。 + +## 本地实验与能排除的假设 + +工具与原始结果放在 [issue-154/](issue-154/)： + +- `probe.go` 直接调用 `cmd.NewHTTPTransport()`，用同版本 `certs.GetRootCAs` 装入实验 CA；记录 TCP、TLS、HTTP 阶段。诊断参数仅修改被比较的一项。 +- `fixture.go` 仅监听 IPv4 loopback；使用即时生成的 RSA 测试证书与专用 CA，提供 discovery 和有效 JWKS。正常基线限制 TLS 1.2、P-256、`TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384`，支持 HTTP/1.1 和 HTTP/2。 +- `admin-check.go` 仅允许 loopback Server，验证 Console 使用的 Admin API；使用本地虚构配置和临时凭据。 +- `evidence.json` 保存版本、握手参数、分阶段 trace 和完整 Server 实验结果；无客户信息、私钥或 token。 +- 第二轮扩展 fixture 的合成授权码、token 和 JWKS 流程；`run-linux.py` 驱动 Linux 完整 Server 及 Console API，`linux-evidence.json` 保存十二组场景和构建身份。敏感运行值不写入结果。 + +### 正常服务及握手差异 + +三个源码版本的实际 transport 都能通过完整证书验证，以 TLS 1.2 / AES-256-GCM / HTTP/1.1 获取测试文档。**Go 1.27 本身并非不能连接 TLS 1.2、RSA 证书或这套密码套件。** 正常服务也接受诊断性的 HTTP/2。 + +| 构建与选项 | fixture 读到的初始握手字节数 | 支持的 group ID | 新增 ML-DSA 签名编号 | +| --- | ---: | --- | --- | +| 旧源码 + Go 1.26.5，默认 | 1497 | 4588, 29, 23, 24, 25 | 无 | +| 故障源码 + Go 1.27.1，默认 | 1509 | 同上 | 0x0904, 0x0905, 0x0906 | +| 当前源码 + Go 1.27.1，默认 | 1509 | 同上 | 同上 | +| 旧源码 + Go 1.26.5，`tlsmlkem=0` | 275 | 29, 23, 24, 25 | 无 | +| 故障/当前源码 + Go 1.27.1，`tlsmlkem=0` | 1509 | 4588, 29, 23, 24, 25 | 有 | +| 旧源码、旧依赖，只改为 Go 1.27.1 | 1509 | 4588, 29, 23, 24, 25 | 有；`tlsmlkem=0` 也不再移除 4588 | + +4588 是 X25519MLKEM768，29 是 X25519，23/24/25 是 P-256/384/521。这些字节数包含本地 fixture 收到的 TLS record，测试 URL 是 IP，没有 DNS SNI；不能直接当成客户网络中的包长或 MTU 证据。默认新旧差异约 12 字节，没有证据支持“本次才突然出现巨大 ML-KEM 握手”的说法。设置上述环境选项时的差异则显著不同。 + +旧源码保留旧依赖、仅更换 Go 编译器后，行为随编译器变化，隔离了本次发现与 silo-pkg/Console 版本更新之间的关系。Go 1.27 官方说明也明确记录显式曲线配置不再受这些默认值开关限制，并新增 ML-DSA 支持。[Go 1.27 发布说明](https://go.dev/doc/go1.27)。本地进一步核对了两版 `crypto/tls/defaults.go`、`common.go` 的 `curvePreferences`/`supportsCurve` 和 `handshake_client.go`。 + +### 主动拒绝与对照结果 + +下列拒绝规则是人为设置的模型，**只证明机制可以产生相同症状，不证明真实 Keycloak 或其入口使用这些规则**。 + +| fixture 规则 | 对照结果 | 能支持的结论 | +| --- | --- | --- | +| ClientHello 带 ML-KEM 就发送 TCP RST | 旧版默认也失败；旧版 + `tlsmlkem=0` 成功；故障版 + 同选项失败；故障版显式 classical 曲线成功 | 需要旧环境选项或其他变化，才能用该机制解释升级回归。仅说 ML-KEM 不兼容不充分。 | +| ClientHello 带 ML-DSA 编号就 RST | 旧版默认成功；故障版默认/仅 classical 都失败；故障版 TLS 1.2-only 成功 | 新的签名算法列表是另一种可区分机制。ML-DSA 与 ML-KEM 不是同一项。TLS 1.2-only 会同时改变多项 ClientHello，成功不等于唯一定位 ML-DSA。 | +| 必须提供 h2 ALPN | 旧、新 Server transport 默认都失败；`-h2` 成功 | 可以解释 curl 与 Server 的不同，单独不能解释新旧版本差异。 | +| TLS 完成后，对 `Silo` UA 的 GET 发送 RST | 同一个新 transport，`MinIO` UA 成功、`Silo` UA 失败 | 报告的外层 `Get ... reset` 错误也可能来自 HTTP 层，必须先判断 TLS 是否完成。 | +| 不信任测试 CA | 返回 `*tls.CertificateVerificationError` / x509 类错误 | 与人为 RST 的错误不同；没有证据要求跳过证书验证。仍须比较客户实际连接收到的链。 | +| 正常连接复用 | 第二个请求 `reused=true`；关闭 idle 连接后重新建 TCP 可恢复 TLS session | keep-alive 与 TLS session 复用是两件事。首次新 transport 就失败时，此分支优先级低。 | + +### 完整 Server、IAM 和恢复 + +使用三个本地编译的完整 Server，独立空数据/配置目录、独立 CA 和临时凭据；未登录真实 IdP。 + +| 场景 | 实际结果 | +| --- | --- | +| 旧版、故障版连接正常 IdP | discovery + JWKS 成功；一条 TLS 连接；cluster health 200；Console HTTP 200；Admin ListUsers 成功。 | +| 当前版连接持续 reset 的 IdP | IAM 持续等待；cluster health 503，`X-Minio-Server-Status: iam-offline`；Console 端口尚未提供服务；5 秒限时的 Admin ListUsers 未完成。 | +| 上述场景恢复 IdP，不重启 Server | 约 0.43 秒后 cluster/Console 200，ListUsers 成功。该时间是单次本地样本，不是恢复 SLA。 | +| 旧版 + `tlsmlkem=0`，IdP 拒绝 ML-KEM | 完整启动成功。 | +| 故障版 + `tlsmlkem=0`，相同拒绝规则 | IAM 等待、cluster 503；撤掉规则后约 1.38 秒内完整恢复，无需重启。 | +| 当前版 discovery 成功、JWKS 返回 503 | 同样阻塞 IAM；JWKS 恢复后约 0.33 秒内恢复。只验证 discovery 200 不够。 | +| 当前版先不配置 OIDC，再经 Admin API 添加 | IdP reset 时返回同型 `Get ... read tcp ... connection reset by peer`；恢复后同名创建成功，`restart=true`。失败校验没有保存该 provider。 | + +在本地 IAM 阻塞的场景中，`/minio/health/live` 和 `/minio/health/ready` **仍为 200**。判断这次恢复应使用 `/minio/health/cluster` 并验证受认证操作和 Console，不能只看 ready。源码上 cluster 的 `checkHealth` 检查 IAM，而 ready 没有此检查；这是已有行为，本文不扩展为一次健康检查重构。[health 检查](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/healthcheck-handler.go#L32-L65)、[ready 检查](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/healthcheck-handler.go#L129-L186)。 + +现有 IAM 重试间隔随机为 0–3 秒，GET 本身还会占用网络等待时间；初始化成功前不会继续创建 IAM store，Console 又在 IAM 调用返回后启动。外部连接恢复可由现有重试自行恢复；这不意味着靠增加重试能修复持续不兼容。缺少整体请求期限、请求取消的部分是另外一个可单独修复的启动健壮性问题。[重试逻辑](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/iam.go#L342-L365)、[Console 启动顺序](https://github.com/pgsty/silo/blob/d1105bbb3d4a0afa33b3a4ac11b821235038ed0e/cmd/server-main.go#L1007-L1027)。 + +已通过：`CGO_ENABLED=0 GOWORK=off go test -mod=readonly -count=1 ./internal/http ./internal/config/identity/openid`。这些测试没有替代真实 Keycloak 登录或 Linux 故障网络的验证。 + +## 最少补充证据与诊断命令 + +先收集第一轮，按结果才展开后续。所有请求只取公开 discovery，不需要客户端密钥、密码、token 或私钥。不要求环境变量全量导出、配置导出或证书私钥。 + +### 第一轮：运行身份、网络一致性、协议阶段 + +在**已有故障容器/Pod 的实际网络环境**中运行；旧版也做同样检查。不要以新建默认网络容器替代。如果实际进程经启动脚本修改过环境，探针也应使用修改后的相关环境和同一 CA 挂载。 + +```sh +# 选择实际 Server 可执行文件；记录输出中的版本、Go、OS/架构。 +silo --version +# 旧镜像的程序名可能是 minio。 + +# Linux：PID 设为实际 Server 进程 PID，不预设一定是 1。 +# 只输出 Go 调试选项以及相关环境项是否存在，不输出代理凭据/地址。 +tr '\0' '\n' < "/proc/$PID/environ" | awk ' + /^GODEBUG=/ { print; next } + /^(HTTP_PROXY|HTTPS_PROXY|NO_PROXY|ALL_PROXY|http_proxy|https_proxy|no_proxy|all_proxy|SSL_CERT_FILE|SSL_CERT_DIR)=/ { + split($0, a, "="); print a[1] "=" + }' + +# OIDC_URL 仅在本地设为原 config_url；URL 不应带凭据或令牌。 +export OIDC_URL +curl --http1.1 --connect-timeout 5 --max-time 20 -sS -o /dev/null \ + -w 'ip=%{remote_ip} http=%{http_version} status=%{http_code} verify=%{ssl_verify_result}\n' "$OIDC_URL" +curl --http2 --connect-timeout 5 --max-time 20 -sS -o /dev/null \ + -w 'ip=%{remote_ip} http=%{http_version} status=%{http_code} verify=%{ssl_verify_result}\n' "$OIDC_URL" + +# 由维护者从对应源码构建的探针；OIDC_CA 是与 Server 相同的 CAs 目录。 +./oidc-probe -ca "$OIDC_CA" +``` + +探针从 `OIDC_URL` 读取 URL。URL、响应体、请求头不会打印；输出的 IP 可按一致映射替换为 IP-A/IP-B。它使用真实 Server transport 构造函数，但添加 20 秒总期限、不跟随重定向、限制响应体读取为 1 MiB，并使用 `issue-154-probe` UA；因此是定位连接阶段的工具，不是完整 OIDC 流程。它没有执行 Server 的 CLI 初始化，也不继承该进程的 `--interface`、socket buffer、TCP user timeout 或存量 DNS 缓存；若使用这些非默认参数，必须对齐后才能归因。若 Server 将自己的公开服务证书也作为根信任，需要把相同公开证书加入探针的临时 CA 目录。 + +读结果的方法： + +- `tls_start` 后 `tls_done ... err=reset`：先查 TLS ClientHello、代理 CONNECT 或 TLS 终止设备；尚不能从客户端确定 RST 由终端还是中间设备发出。 +- `tls_done ... err=none`、`wrote_request` 后 reset：检查 HTTP/WAF/UA/入口路由。此时更换证书信任或密钥交换没有针对性。 +- 出现 x509 类错误：比较该进程实际收到的证书链、SNI、系统 CA 和自定义 CA；保持验证开启。 +- 两次 curl 的 IP 不同，或探针目标与 curl 不同：先做同 IP 对照。curl HTTP/1.1 成功也不代表 Go ClientHello 相同。 +- 仅 curl h2 成功：确认实际协商的 `http_version` 是 2，再检查入口 HTTP/1.1 支持；不要先全局启用 Server HTTP/2。 + +### 只对命中的分支做 A/B + +```sh +# TLS 阶段失败：仅移除 hybrid key exchange，仍支持 TLS 1.3 和验证证书。 +./oidc-probe -ca "$OIDC_CA" -classical + +# 如果旧进程确实使用 tlsmlkem=0，验证最小候选是否恢复其效果。 +# 应保留原 GODEBUG 的其他相关选项；以下假定没有需要保留的其他值。 +GODEBUG=tlsmlkem=0 ./oidc-probe -ca "$OIDC_CA" -default-curves + +# 只有 classical 仍失败时，作为鉴别实验测试 TLS 1.2-only。 +./oidc-probe -ca "$OIDC_CA" -tls12 + +# 只有 HTTP/ALPN 对照指向此分支时才测试。 +./oidc-probe -ca "$OIDC_CA" -h2 + +# HTTP 阶段才失败：UA_OLD / UA_NEW 是两版实际请求的完整 UA，非密钥。 +./oidc-probe -ca "$OIDC_CA" -ua "$UA_OLD" +./oidc-probe -ca "$OIDC_CA" -ua "$UA_NEW" +``` + +若 first-hop 使用代理，先比较两进程的代理选择和 `NO_PROXY`，不公开含密码的代理 URL。只在明确允许直连的部署中使用 `-direct`。确认直连后，可针对每个 DNS 地址运行以下两项，保留原 URL 主机名与 SNI，不能直接把 HTTPS URL 改成 IP： + +```sh +curl --noproxy '*' --resolve "$OIDC_HOST:443:$IP_A" --http1.1 \ + --connect-timeout 5 --max-time 20 -sS -o /dev/null \ + -w 'ip=%{remote_ip} status=%{http_code} verify=%{ssl_verify_result}\n' "$OIDC_URL" +./oidc-probe -ca "$OIDC_CA" -direct -ip "$IP_A" +# 对 IP-B 重复；端口不是 443 时据实修改 --resolve。 +``` + +仅第二次请求失败时才补 `-n 2` 与 `-n 2 -fresh`；后者重建 TCP，但同一 transport 的 TLS session cache 仍保留。若仍无法区分，下一步要的是入口侧同一时间窗口的握手失败原因/命中规则，或由客户自行脱敏后的 ClientHello 参数和 RST 阶段，不是完整认证流量包。 + +## 条件性最小修复方案 + +### 1. 路由、代理或入口策略差异已证实 + +优先统一有问题的 IdP 入口、修正具体域名的代理/NO_PROXY 或后端节点配置；更新错误拒绝合法 ClientHello 的 TLS 终止器/WAF。证书仍按原 hostname 和有效 CA 验证，OIDC issuer 不随意改名。若是 `Silo` UA 被规则拒绝，调整该规则；不把全产品 UA 改回 MinIO。 + +这是配置层处理，可以不改 SILO。工作量取决于入口归属；成功标准是原版故障二进制在原网络环境中完成 discovery、JWKS 和完整登录，而非仅 curl 200。 + +### 2. 证实旧环境依赖 `tlsmlkem=0`，且 classical / default-curves 对照成功 + +最小代码候选是为外部 OpenID 请求使用 Go 的默认曲线集合，恢复已有 GODEBUG 选项的效果；保留当前 trust pool、SNI、密码套件、超时、代理及 HTTP/1.1 行为。候选代码如下，**已在隔离副本完成上述验证，尚未应用到产品工作区**： + +```go +func NewOpenIDHTTPTransport() *http.Transport { + tr := NewHTTPTransport() + tr.TLSClientConfig.CurvePreferences = nil + return tr +} +``` + +当时的候选只将 `cmd/iam.go` 和 `cmd/config-current.go` 两处 OpenID 调用改用该 helper，通过现有 UA wrapper 传入 `openid.LookupConfig`。后续排查确认节点互联、复制、远端存储等连接也存在同样的问题，此局部方案已被 [SILO 跨组件修复](go127-stack.md) 取代；请勿再应用下面归档的 OIDC-only 补丁。 + +候选已在真实 transport 探针及第二轮完整 Linux Server 中验证：`CurvePreferences=nil` + Go 1.27.1 + `tlsmlkem=0` 会移除 ML-KEM，并通过 `reject-mlkem` fixture、配置添加和合成登录。它仍不能通过 `reject-mldsa` fixture，说明此方案针对的是一个明确分支。 + +影响需要明确： + +- 不设置 GODEBUG 时会采用完整 Go 默认集合，实测额外提供 SecP256r1MLKEM768 和 SecP384r1MLKEM1024；这也是一项兼容性变化。第二轮默认 TLS 1.3 登录通过，仍不能称为完全无行为变化或所有曲线均已覆盖。 +- `GODEBUG` 是进程级设置，其他使用 Go 默认曲线的客户端也可能受到影响；本次 helper 的改动范围是 OpenID，但该环境选项本身不是逐 provider 开关。 +- 禁用 hybrid 后仍有标准 ECDHE/TLS 和证书验证，失去的是相应后量子密钥交换保护。优先修正入口，临时兼容设置应有撤销条件；不能自动遇到 reset 就降级重试。 +- 当前 Console IdP transport 本来使用默认曲线，同一进程中的该 GODEBUG 策略可以与之保持一致；第二轮合成登录链路已经验证，真实 IdP 和浏览器验收仍待进行。 +- 隔离源码副本中的候选实现及上述本地验证已完成；真实端点 A/B 证据、生产适用性和发布是尚未完成的步骤。 + +### 3. 未设置上述选项，或 classical 仍失败 + +不要套用方案 2。若同 IP、同代理、同 UA 下仅 Go 1.27 失败，优先收集入口对新签名算法/扩展的处理证据。`-tls12` 成功只能缩小到 ClientHello/TLS 特征集合；它同时移除 hybrid key share 和 TLS 1.3 特有签名编号，不能唯一证明 ML-DSA。 + +优先更新入口或获得 Go 上游可复现用例。只有真实证据证明 TLS 1.2 兼容模式是必要且有效、入口又短期无法处理时，才评估**明确限定于该 IdP**的临时 TLS 1.2 选项，并保留现代 ECDHE/AEAD 和证书验证。不要把 `MaxVersion=TLS12` 全局写死，不引入自定义 ClientHello/TLS 栈或未受支持的“关闭 ML-DSA”环境选项。该分支尚不足以确定补丁或工期。 + +### 4. 启动健壮性可单独改进 + +如需小幅改善可诊断性，应单独给 discovery/JWKS 加明确阶段标识和有限总请求期限，让 IAM 重试可感知取消；在请求完成前发生 stall 时及时释放资源。日志避免输出 client secret/token，错误保留原始 cause。保留已配置 OIDC 的失败关闭行为及 IdP 恢复后的自动初始化，不自动关闭 OIDC，也不把无限重试包装成根因修复。 + +这类改动约 0.5–1 个工程日，可分别回归 stalled body、取消、重试后恢复；它不会使持续 RST 的 TLS 连接成功，不应替代前面鉴别。 + +## 临时处置与验收边界 + +当前可沿用报告中已经恢复服务的旧版回退状态，尽快完成上述定位。不要将旧版本长期保留视为解决方案，也不要为了它整体降级新版本依赖。本次空数据实验不证明任意生产数据/配置的降级兼容；再次切换版本前应沿既有备份和升级边界操作。 + +修复应按以下范围验证，均从 PGSTY 源码本地构建： + +1. 对确认的分支增加最小回归：实际 OpenID transport、匹配的 ClientHello/入口拒绝条件、默认设置与明确 opt-out；确保通用和 internode transport 不变。 +2. TLS 1.2（报告密码套件）与 TLS 1.3、有效自定义 CA、错误 CA 和 hostname 拒绝；适用时覆盖代理及多地址入口。不放宽证书、JWT 签名或 audience 等认证校验。 +3. 完整 Server 的 discovery 与 JWKS、IdP 中断后恢复、cluster health、受认证 Admin 操作；Console 添加配置、浏览器重定向、回调、令牌交换、STS 授权和登出。mc 添加/读取配置路径应一致。 +4. 在实际 Linux 容器/Pod 网络和每个 IdP 入口地址复验。证据应绑定最终 Server/Console/pkg/mc commit 和编译器；发布、镜像及生产可用性属于后续独立验收。 + +第二轮完成 Linux loopback 上的合成 OAuth token/STS 登录；本次没有真实 Keycloak、真实 Linux 故障路径、浏览器页面或生产数据升级测试。当前 main 对正常 fixture 成功，并不能据此宣告 #154 修复。下一项最有价值的新增证据是**实际进程的 `tlsmlkem` 设置和一个带 TLS 完成事件的同环境 GET trace**。 + +## 复现实验 + +从本任务 worktree 根目录执行；工具均使用本地源码，输出目录必须是新建临时目录。 + +```sh +LAB_DIR=$(mktemp -d) +CGO_ENABLED=0 GOWORK=off go build -mod=readonly -tags kqueue \ + -o "$LAB_DIR/silo" . +CGO_ENABLED=0 GOWORK=off go build -mod=readonly -tags kqueue \ + -o "$LAB_DIR/probe" docs/investigations/issue-154/probe.go +go build -o "$LAB_DIR/fixture" docs/investigations/issue-154/fixture.go +go build -mod=readonly -o "$LAB_DIR/admin-check" docs/investigations/issue-154/admin-check.go +"$LAB_DIR/fixture" -dir "$LAB_DIR/idp" > "$LAB_DIR/hello.jsonl" 2> "$LAB_DIR/fixture.log" & +FIXTURE_PID=$! +trap 'kill "$FIXTURE_PID" 2>/dev/null || true' EXIT +attempt=0 +while [ ! -s "$LAB_DIR/idp/url" ] && [ "$attempt" -lt 50 ]; do + sleep 0.1 + attempt=$((attempt + 1)) +done +test -s "$LAB_DIR/idp/url" || exit 1 +# 私钥仅保存在 fixture 内存。 +OIDC_URL="$(cat "$LAB_DIR/idp/url")/.well-known/openid-configuration" +export OIDC_URL +"$LAB_DIR/probe" -ca "$LAB_DIR/idp/ca.pem" +printf '%s' reject-mlkem > "$LAB_DIR/idp/mode" +GODEBUG=tlsmlkem=0 "$LAB_DIR/probe" -ca "$LAB_DIR/idp/ca.pem" +GODEBUG=tlsmlkem=0 "$LAB_DIR/probe" -ca "$LAB_DIR/idp/ca.pem" -default-curves +printf '%s' reject-mldsa > "$LAB_DIR/idp/mode" +"$LAB_DIR/probe" -ca "$LAB_DIR/idp/ca.pem" -classical +"$LAB_DIR/probe" -ca "$LAB_DIR/idp/ca.pem" -tls12 +kill "$FIXTURE_PID" +``` + +完整 Server 实验使用上述临时目录下的 `certs/CAs` 和数据目录，设置虚构的 `MINIO_IDENTITY_OPENID_CLIENT_ID`、fixture URL、临时 root 凭据，并显式指定 `--config-dir`、`--certs-dir`、loopback API/Console 地址。用 mode 文件切换 `reset`/`bad-jwks` 到 `normal`，同时检查 cluster health 和 Admin ListUsers；结果已保存在 `evidence.json`。`admin-check add` 只操作 `LAB_SERVER=127.0.0.1:port` 的实验实例，读取临时 `LAB_USER`、`LAB_PASSWORD`、`LAB_OIDC_URL`，使用虚构 OIDC secret。 + +跨版本构建时从各 tag `git archive` 获取源码，把 `probe.go` 放入该 module 根目录；旧版探针仅将 certs 导入替换为 `github.com/minio/pkg/v3/certs`，由旧版 go.mod 选择 PGSTY v3.11.0。分别强制 `GOTOOLCHAIN=go1.26.5` / `go1.27.1`，使用 `-mod=readonly`，不修改历史 go.mod。另将旧源码原依赖用 Go 1.27.1 构建，隔离工具链因素。若为 Linux 客户端构建探针，按已确认的架构设置 `GOOS=linux GOARCH=amd64` 或 `arm64`，不使用 Server 镜像代替。 + +### 第二轮 Linux 完整 Server 对照 + +从本任务根目录运行以下 Bash 命令。需要预先准备 Go 1.26.5、1.27.1 及源码依赖缓存，以及带 Python 3、curl/OpenSSL/HTTP2 的通用 Linux 基础镜像。`GOTOOLCHAIN` 明确选定编译器，`-mod=readonly` 保留依赖版本；实际测试构建用已安装工具链的绝对路径配合 `GOTOOLCHAIN=local`，等价地避免自动切换编译器。以下固定 `arm64` 与本次实验一致。 + +```bash +LAB_DIR=$(mktemp -d) +mkdir -p "$LAB_DIR/old" "$LAB_DIR/head" "$LAB_DIR/candidate" "$LAB_DIR/bin" "$LAB_DIR/out" +git archive d88f46ccee345a9c2fabe2d221d9a9e56bc11aec | tar -x -C "$LAB_DIR/old" +git archive d1105bbb3d4a0afa33b3a4ac11b821235038ed0e | tar -x -C "$LAB_DIR/head" +git archive d1105bbb3d4a0afa33b3a4ac11b821235038ed0e | tar -x -C "$LAB_DIR/candidate" +git -C "$LAB_DIR/candidate" apply "$PWD/docs/investigations/issue-154/openid-default-curves.patch" + +(cd "$LAB_DIR/old" && CGO_ENABLED=0 GOWORK=off GOOS=linux GOARCH=arm64 \ + GOTOOLCHAIN=go1.26.5 go build -mod=readonly -tags kqueue -o "$LAB_DIR/bin/old-go126" .) +(cd "$LAB_DIR/old" && CGO_ENABLED=0 GOWORK=off GOOS=linux GOARCH=arm64 \ + GOTOOLCHAIN=go1.27.1 go build -mod=readonly -tags kqueue -o "$LAB_DIR/bin/old-go127" .) +(cd "$LAB_DIR/head" && CGO_ENABLED=0 GOWORK=off GOOS=linux GOARCH=arm64 \ + GOTOOLCHAIN=go1.27.1 go build -mod=readonly -tags kqueue -o "$LAB_DIR/bin/head-go127" .) +(cd "$LAB_DIR/candidate" && CGO_ENABLED=0 GOWORK=off GOOS=linux GOARCH=arm64 \ + GOTOOLCHAIN=go1.27.1 go build -mod=readonly -tags kqueue -o "$LAB_DIR/bin/candidate-go127" .) +CGO_ENABLED=0 GOWORK=off GOOS=linux GOARCH=arm64 GOTOOLCHAIN=go1.27.1 \ + go build -mod=readonly -o "$LAB_DIR/bin/fixture" docs/investigations/issue-154/fixture.go +CGO_ENABLED=0 GOWORK=off GOOS=linux GOARCH=arm64 GOTOOLCHAIN=go1.27.1 \ + go build -mod=readonly -o "$LAB_DIR/bin/admin-check" docs/investigations/issue-154/admin-check.go + +# 本机已存在的通用 Debian 12 arm64 基础镜像；不拉取镜像，不映射端口。 +LINUX_BASE_IMAGE=sha256:307af7711e2e04ab75759cb42a1eef45c43c4404894c0e30dd19f742b107b922 +docker run --rm --pull=never --network none \ + --mount "type=bind,source=$LAB_DIR/bin,target=/lab/bin,readonly" \ + --mount "type=bind,source=$LAB_DIR/out,target=/lab/out" \ + --mount "type=bind,source=$PWD/docs/investigations/issue-154/run-linux.py,target=/lab/run-linux.py,readonly" \ + --entrypoint python3 "$LINUX_BASE_IMAGE" /lab/run-linux.py +``` + +每组场景输出一行摘要，同时在独立输出目录保存 `result.json`。脚本用 `finally` 终止其 Server/fixture，容器结束自动删除。它没有导出会话 cookie、授权码、JWT、state 或临时密码；原始运行目录只用于该次隔离实验，交付证据只保留握手、结果和构建身份。 diff --git a/docs/investigations/issue-154/admin-check.go b/docs/investigations/issue-154/admin-check.go new file mode 100644 index 000000000..6e230e160 --- /dev/null +++ b/docs/investigations/issue-154/admin-check.go @@ -0,0 +1,41 @@ +//go:build ignore + +// Loopback-only lab client for the Admin API used by Console's OIDC form. +package main + +import ( + "context" + "fmt" + "net" + "os" + "time" + + "github.com/minio/madmin-go/v3" +) + +func main() { + endpoint := os.Getenv("LAB_SERVER") + host, _, err := net.SplitHostPort(endpoint) + if err != nil || host != "127.0.0.1" { + panic("LAB_SERVER must use IPv4 loopback") + } + a, err := madmin.New(endpoint, os.Getenv("LAB_USER"), os.Getenv("LAB_PASSWORD"), false) + if err != nil { + panic(err) + } + ctx, cancel := context.WithTimeout(context.Background(), 5*time.Second) + defer cancel() + if len(os.Args) > 1 && os.Args[1] == "add" { + restart, err := a.AddOrUpdateIDPConfig(ctx, "openid", "local154", "enable=on client_id=local154 client_secret=local154-placeholder config_url="+os.Getenv("LAB_OIDC_URL"), false) + fmt.Printf("add restart=%v err=%v\n", restart, err) + if err != nil { + os.Exit(1) + } + return + } + users, err := a.ListUsers(ctx) + fmt.Printf("list_users count=%d err=%v\n", len(users), err) + if err != nil { + os.Exit(1) + } +} diff --git a/docs/investigations/issue-154/cert-roots.go b/docs/investigations/issue-154/cert-roots.go new file mode 100644 index 000000000..8fdfcf808 --- /dev/null +++ b/docs/investigations/issue-154/cert-roots.go @@ -0,0 +1,41 @@ +//go:build ignore + +// Run only with the public, synthetic CA made by fixture.go. +package main + +import ( + "crypto/x509" + "encoding/json" + "encoding/pem" + "os" + "runtime" + + "github.com/pgsty/silo-pkg/v3/certs" +) + +func main() { + if len(os.Args) != 3 { + panic("usage: cert-roots synthetic-ca.pem explicit-ca-path-or-empty") + } + data, err := os.ReadFile(os.Args[1]) + if err != nil { + panic(err) + } + block, _ := pem.Decode(data) + if block == nil || block.Type != "CERTIFICATE" { + panic("expected public certificate") + } + certificate, err := x509.ParseCertificate(block.Bytes) + if err != nil { + panic(err) + } + roots, err := certs.GetRootCAs(os.Args[2]) + if err != nil { + panic(err) + } + _, err = certificate.Verify(x509.VerifyOptions{Roots: roots}) + _ = json.NewEncoder(os.Stdout).Encode(map[string]any{ + "go": runtime.Version(), "os": runtime.GOOS, + "explicit_ca": os.Args[2] != "", "trusted": err == nil, + }) +} diff --git a/docs/investigations/issue-154/evidence.json b/docs/investigations/issue-154/evidence.json new file mode 100644 index 000000000..37219094c --- /dev/null +++ b/docs/investigations/issue-154/evidence.json @@ -0,0 +1,2499 @@ +{ + "environment": "darwin/arm64; Server and transport probes locally built with CGO_ENABLED=0 and GOWORK=off; auxiliary fixture/Admin programs locally built; no Server/Console images", + "versions": { + "old": { + "sha": "d88f46ccee345a9c2fabe2d221d9a9e56bc11aec", + "toolchain": "go1.26.5" + }, + "reported": { + "sha": "9b11dc9469e650815b775cb47b039610644f5da4", + "toolchain": "go1.27.1" + }, + "current": { + "sha": "d1105bbb3d4a0afa33b3a4ac11b821235038ed0e", + "toolchain": "go1.27.1" + } + }, + "probe_matrix": [ + { + "mode": "normal", + "version": "old", + "options": [], + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1497, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.26.5 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "normal", + "version": "reported", + "options": [], + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "normal", + "version": "current", + "options": [], + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "normal", + "version": "old", + "options": [], + "godebug": "tlsmlkem=0", + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 275, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.26.5 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "normal", + "version": "reported", + "options": [], + "godebug": "tlsmlkem=0", + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "normal", + "version": "current", + "options": [], + "godebug": "tlsmlkem=0", + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "reject-mlkem", + "version": "old", + "options": [], + "godebug": null, + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 1497, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.26.5 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + }, + { + "mode": "reject-mlkem", + "version": "old", + "options": [], + "godebug": "tlsmlkem=0", + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 275, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.26.5 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "reject-mlkem", + "version": "reported", + "options": [], + "godebug": "tlsmlkem=0", + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + }, + { + "mode": "reject-mlkem", + "version": "reported", + "options": [ + "-classical" + ], + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=true tls12=false\nroute=direct curves=[CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "reject-mldsa", + "version": "old", + "options": [], + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1497, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.26.5 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "reject-mldsa", + "version": "reported", + "options": [], + "godebug": null, + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + }, + { + "mode": "reject-mldsa", + "version": "reported", + "options": [ + "-classical" + ], + "godebug": null, + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=true tls12=false\nroute=direct curves=[CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + }, + { + "mode": "reject-mldsa", + "version": "reported", + "options": [ + "-tls12" + ], + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 219, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=true\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "require-h2", + "version": "old", + "options": [], + "godebug": null, + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 1497, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "require-h2", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.26.5 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + }, + { + "mode": "require-h2", + "version": "reported", + "options": [], + "godebug": null, + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "require-h2", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + }, + { + "mode": "require-h2", + "version": "reported", + "options": [ + "-h2" + ], + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 1527, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "require-h2", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=true classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"h2\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/2.0\n" + }, + { + "mode": "reject-silo-ua", + "version": "reported", + "options": [ + "-ua", + "MinIO (local probe)" + ], + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-silo-ua", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "MinIO (local probe)" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "reject-silo-ua", + "version": "reported", + "options": [ + "-ua", + "Silo (local probe)" + ], + "godebug": null, + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-silo-ua", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (local probe)" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nget_error=connection reset by peer (*url.Error)\n" + } + ], + "same_source_toolchains": [ + { + "mode": "normal", + "godebug": null, + "source": "old", + "go": "1.27.1", + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "normal", + "godebug": "tlsmlkem=0", + "source": "old", + "go": "1.27.1", + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "source": "old", + "go": "1.27.1", + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + }, + { + "mode": "reject-mldsa", + "godebug": null, + "source": "old", + "go": "1.27.1", + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false tls12=false\nroute=direct curves=[X25519MLKEM768 CurveP256 X25519 CurveP384 CurveP521]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + } + ], + "candidate_probe": [ + { + "mode": "normal", + "godebug": null, + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 1513, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false default_curves=true tls12=false\nroute=direct curves=[]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "normal", + "godebug": "tlsmlkem=0", + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false default_curves=true tls12=false\nroute=direct curves=[]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "exit": 0, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "issue-154-probe" + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false default_curves=true tls12=false\nroute=direct curves=[]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x303 cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384 alpn=\"\" resumed=false verified_chains=1 err=none\ngot_conn=127.0.0.1:54794 reused=false\nwrote_request err=none\nfirst_response_byte\nstatus=200 protocol=HTTP/1.1\n" + }, + { + "mode": "reject-mldsa", + "godebug": "tlsmlkem=0", + "exit": 1, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "trace": "go=go1.27.1 os=darwin arch=arm64 h2=false classical=false default_curves=true tls12=false\nroute=direct curves=[]\nrequest=1\nconnect=tcp 127.0.0.1:54794\nconnected=127.0.0.1:54794 err=none\ntls_start\ntls_done=0x0 cipher=0x0000 alpn=\"\" resumed=false verified_chains=0 err=connection reset by peer (*net.OpError)\nget_error=connection reset by peer (*url.Error)\n" + } + ], + "server_cases": [ + { + "case": "startup-old", + "version": "old", + "mode": "normal", + "godebug": null, + "before": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 200, + "server_status": null + }, + "console": { + "status": 200, + "server_status": null + } + }, + "before_admin": "list_users count=0 err=", + "events": [ + { + "alpn": null, + "bytes_read": 1497, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "MinIO (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "MinIO (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + } + ] + }, + { + "case": "startup-reported", + "version": "reported", + "mode": "normal", + "godebug": null, + "before": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 200, + "server_status": null + }, + "console": { + "status": 200, + "server_status": null + } + }, + "before_admin": "list_users count=0 err=", + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + } + ] + }, + { + "case": "startup-current-reset-recovery", + "version": "current", + "mode": "reset", + "godebug": null, + "before": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 503, + "server_status": "iam-offline" + }, + "console": { + "error": "URLError" + } + }, + "before_admin": "list_users count=0 err=context deadline exceeded", + "recovery_seconds": 0.433, + "after": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 200, + "server_status": null + }, + "console": { + "status": 200, + "server_status": null + } + }, + "after_admin": "list_users count=0 err=", + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reset", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reset", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reset", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + } + ] + }, + { + "case": "startup-old-debug", + "version": "old", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "before": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 200, + "server_status": null + }, + "console": { + "status": 200, + "server_status": null + } + }, + "before_admin": "list_users count=0 err=", + "events": [ + { + "alpn": null, + "bytes_read": 275, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "MinIO (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "MinIO (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + } + ] + }, + { + "case": "startup-reported-debug", + "version": "reported", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "before": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 503, + "server_status": "iam-offline" + }, + "console": { + "error": "URLError" + } + }, + "before_admin": "list_users count=0 err=context deadline exceeded", + "recovery_seconds": 1.38, + "after": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 200, + "server_status": null + }, + "console": { + "status": 200, + "server_status": null + } + }, + "after_admin": "list_users count=0 err=", + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + } + ] + }, + { + "case": "startup-current-jwks-recovery", + "version": "current", + "mode": "bad-jwks", + "godebug": null, + "before": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 503, + "server_status": "iam-offline" + }, + "console": { + "error": "URLError" + } + }, + "before_admin": "list_users count=0 err=context deadline exceeded", + "recovery_seconds": 0.328, + "after": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 200, + "server_status": null + }, + "console": { + "status": 200, + "server_status": null + } + }, + "after_admin": "list_users count=0 err=", + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "bad-jwks", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "bad-jwks", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "bad-jwks", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "bad-jwks", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "bad-jwks", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "bad-jwks", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + } + ] + }, + { + "case": "admin-add-valid", + "version": "current", + "mode": "reset", + "godebug": null, + "before": { + "live": { + "status": 200, + "server_status": null + }, + "ready": { + "status": 200, + "server_status": null + }, + "cluster": { + "status": 200, + "server_status": null + }, + "console": { + "status": 200, + "server_status": null + } + }, + "before_admin": "list_users count=0 err=", + "add_failed": { + "exit": 1, + "output": "add restart=false err=Get \"https://127.0.0.1:54794/.well-known/openid-configuration\": read tcp 127.0.0.1:56173->127.0.0.1:54794: read: connection reset by peer" + }, + "add_recovered": { + "exit": 0, + "output": "add restart=true err=" + }, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reset", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "ua": "Silo (darwin; arm64; mode-server-xl-single; source DEVELOPMENT.GOGET DEVELOPMENT.GOGET DEVELOPMENT.GOGET; CPU (total_cpus:1, total_cores:1; vendor:; family:0; model:0; stepping:0; model_name:Apple M5 Max))" + } + ] + } + ], + "binary_build_info": { + "old": [ + "go1.26.5", + "\tdep\tgithub.com/coreos/go-oidc/v3\tv3.17.0\th1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=", + "\t=>\tgithub.com/pgsty/silo-console\tv0.0.0-20260804042150-b952a1202869\th1:HLfc2ZdAycnI/bLl+TdsuckyzSWrwQarK38pS14yH/Q=", + "\t=>\tgithub.com/pgsty/mc\tv0.0.0-20260801042411-ad10a2a10b76\th1:UIlUuz0LQKw4QlAljhv7nPDDFC1+n+e0iED7rWZrgZ8=", + "\t=>\tgithub.com/pgsty/silo-pkg/v3\tv3.11.0\th1:wjN5d+tWD8Twq+e7k/KBBVhnWXC8xTIlfTcnGIKkmjc=", + "\tdep\tgolang.org/x/crypto\tv0.54.0\th1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=", + "\tdep\tgolang.org/x/net\tv0.57.0\th1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=", + "\tdep\tgolang.org/x/oauth2\tv0.36.0\th1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=", + "\tbuild\t-tags=kqueue", + "\tbuild\tCGO_ENABLED=0", + "\tbuild\tGOARCH=arm64", + "\tbuild\tGOOS=darwin" + ], + "reported": [ + "go1.27.1", + "\tdep\tgithub.com/coreos/go-oidc/v3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=", + "\t=>\tgithub.com/pgsty/silo-console\tv0.0.0-20260903111932-464a59d73ada\th1:vJkxm7GTLL0AvIGIt+JxMfhjMO5+msmj4rLeFueTaG8=", + "\t=>\tgithub.com/pgsty/mc\tv0.0.0-20260903063637-a2ef95c035d9\th1:kJkqK0hJrmvdTOPiI98HoPmET0SHYI9+ytaTRzQdGAs=", + "\tdep\tgithub.com/pgsty/silo-pkg/v3\tv3.13.2\th1:Clw11c/J54Tx6pijNCWtXiC7e0fwP/f5Tgeb6fsXg2w=", + "\tdep\tgolang.org/x/crypto\tv0.56.0\th1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=", + "\tdep\tgolang.org/x/net\tv0.58.0\th1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=", + "\tdep\tgolang.org/x/oauth2\tv0.36.0\th1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=", + "\tbuild\t-tags=kqueue", + "\tbuild\tCGO_ENABLED=0", + "\tbuild\tGOARCH=arm64", + "\tbuild\tGOOS=darwin" + ], + "current": [ + "go1.27.1", + "\tdep\tgithub.com/coreos/go-oidc/v3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=", + "\t=>\tgithub.com/pgsty/silo-console\tv0.0.0-20260908142700-c103d08ec36a\th1:aHLqQ7INozqGLEOB1tr+n/eKgrBhlQ20fHyLmeNu+ao=", + "\t=>\tgithub.com/pgsty/mc\tv0.0.0-20260909015522-fcd5cad8247f\th1:JiL/FcsGMsAhA+Iv+0Jzk9VnEAVVv4HUNbR0cGf+/CE=", + "\tdep\tgithub.com/pgsty/silo-pkg/v3\tv3.13.3\th1:d2xYTn4LXoWIAIjBlW/17wtA/Ut1ap29t+1ww4TFa8o=", + "\tdep\tgolang.org/x/crypto\tv0.56.0\th1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=", + "\tdep\tgolang.org/x/net\tv0.58.0\th1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=", + "\tdep\tgolang.org/x/oauth2\tv0.36.0\th1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=", + "\tbuild\t-tags=kqueue", + "\tbuild\tCGO_ENABLED=0", + "\tbuild\tGOARCH=arm64", + "\tbuild\tGOOS=darwin" + ] + } +} diff --git a/docs/investigations/issue-154/fixture.go b/docs/investigations/issue-154/fixture.go new file mode 100644 index 000000000..728819781 --- /dev/null +++ b/docs/investigations/issue-154/fixture.go @@ -0,0 +1,179 @@ +//go:build ignore + +// Loopback-only synthetic OIDC/TLS fixture. Only disposable lab identities are used. +// Rejection modes model hypotheses; they are not evidence about the user's IdP. +package main + +import ( + "crypto" + "crypto/rand" + "crypto/rsa" + "crypto/sha256" + "crypto/tls" + "crypto/x509" + "crypto/x509/pkix" + "encoding/base64" + "encoding/json" + "encoding/pem" + "errors" + "flag" + "fmt" + "math/big" + "net" + "net/http" + "net/url" + "os" + "path/filepath" + "slices" + "strings" + "sync" + "time" +) + +type observedConn struct { + net.Conn + readBytes int +} + +func (c *observedConn) Read(p []byte) (int, error) { + n, e := c.Conn.Read(p) + c.readBytes += n + return n, e +} +func (c *observedConn) reset() { _ = c.Conn.(*net.TCPConn).SetLinger(0); _ = c.Conn.Close() } + +type observedListener struct{ net.Listener } + +func (l observedListener) Accept() (net.Conn, error) { + c, e := l.Listener.Accept() + if e != nil { + return nil, e + } + return &observedConn{Conn: c}, nil +} + +func main() { + dir := flag.String("dir", "", "isolated output directory for public CA, URL, and mode file") + tls13 := flag.Bool("tls13", false, "allow TLS 1.3 in addition to the TLS 1.2 baseline") + flag.Parse() + if *dir == "" { + panic("-dir required") + } + must(os.MkdirAll(*dir, 0700)) + key, err := rsa.GenerateKey(rand.Reader, 2048) + must(err) + root := &x509.Certificate{SerialNumber: big.NewInt(1), Subject: pkix.Name{CommonName: "issue-154 local CA"}, NotBefore: time.Now().Add(-time.Hour), NotAfter: time.Now().Add(24 * time.Hour), IsCA: true, BasicConstraintsValid: true, KeyUsage: x509.KeyUsageCertSign | x509.KeyUsageDigitalSignature} + rootDER, err := x509.CreateCertificate(rand.Reader, root, root, &key.PublicKey, key) + must(err) + leaf := &x509.Certificate{SerialNumber: big.NewInt(2), Subject: pkix.Name{CommonName: "localhost"}, DNSNames: []string{"localhost"}, IPAddresses: []net.IP{net.ParseIP("127.0.0.1")}, NotBefore: root.NotBefore, NotAfter: root.NotAfter, ExtKeyUsage: []x509.ExtKeyUsage{x509.ExtKeyUsageServerAuth}, KeyUsage: x509.KeyUsageDigitalSignature} + leafDER, err := x509.CreateCertificate(rand.Reader, leaf, root, &key.PublicKey, key) + must(err) + must(os.WriteFile(filepath.Join(*dir, "ca.pem"), pem.EncodeToMemory(&pem.Block{Type: "CERTIFICATE", Bytes: rootDER}), 0600)) + ln, err := net.Listen("tcp", "127.0.0.1:0") + must(err) + base := "https://" + ln.Addr().String() + must(os.WriteFile(filepath.Join(*dir, "url"), []byte(base), 0600)) + mode := func() string { b, _ := os.ReadFile(filepath.Join(*dir, "mode")); return strings.TrimSpace(string(b)) } + var mu sync.Mutex + log := func(v any) { mu.Lock(); defer mu.Unlock(); _ = json.NewEncoder(os.Stdout).Encode(v) } + tc := &tls.Config{Certificates: []tls.Certificate{{Certificate: [][]byte{leafDER, rootDER}, PrivateKey: key}}, MinVersion: tls.VersionTLS12, MaxVersion: tls.VersionTLS12, CurvePreferences: []tls.CurveID{tls.CurveP256}, CipherSuites: []uint16{tls.TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384}} + if *tls13 { + tc.MaxVersion = tls.VersionTLS13 + } + peerConfig := tc.Clone() + peerConfig.NextProtos = []string{"h2", "http/1.1"} + // net/http validates HTTP/2 support before GetConfigForClient; the fixture + // then deliberately selects only the reported AES-256 suite. + tc.CipherSuites = append(tc.CipherSuites, tls.TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256) + tc.GetConfigForClient = func(chi *tls.ClientHelloInfo) (*tls.Config, error) { + m := mode() + c := chi.Conn.(*observedConn) + log(map[string]any{"event": "hello", "mode": m, "bytes_read": c.readBytes, "curves": chi.SupportedCurves, "signatures": chi.SignatureSchemes, "alpn": chi.SupportedProtos, "versions": chi.SupportedVersions}) + reject := m == "reset" || m == "reject-mlkem" && slices.Contains(chi.SupportedCurves, tls.CurveID(4588)) || m == "reject-mldsa" && slices.Contains(chi.SignatureSchemes, tls.SignatureScheme(0x0904)) || m == "require-h2" && !slices.Contains(chi.SupportedProtos, "h2") + if reject { + c.reset() + return nil, errors.New("synthetic ClientHello rejection") + } + return peerConfig, nil + } + server := &http.Server{TLSConfig: tc, ReadHeaderTimeout: 5 * time.Second} + var codes sync.Map + server.Handler = http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) { + log(map[string]any{"event": "request", "path": r.URL.Path, "protocol": r.Proto, "tls": r.TLS.Version, "cipher": r.TLS.CipherSuite, "resumed": r.TLS.DidResume, "ua": r.UserAgent()}) + if mode() == "reject-silo-ua" && strings.HasPrefix(r.UserAgent(), "Silo") { + c, _, e := w.(http.Hijacker).Hijack() + if e == nil { + c.(*tls.Conn).NetConn().(*observedConn).reset() + } + return + } + w.Header().Set("Content-Type", "application/json") + switch r.URL.Path { + case "/authorize": + q := r.URL.Query() + redirect, err := url.Parse(q.Get("redirect_uri")) + if err != nil || redirect.Scheme != "http" || redirect.Hostname() != "127.0.0.1" || redirect.Path != "/oauth_callback" || q.Get("client_id") != "local154" { + http.Error(w, "loopback lab authorization only", 400) + return + } + codeBytes := make([]byte, 18) + _, err = rand.Read(codeBytes) + must(err) + code := base64.RawURLEncoding.EncodeToString(codeBytes) + codes.Store(code, q.Get("nonce")) + values := redirect.Query() + values.Set("code", code) + values.Set("state", q.Get("state")) + redirect.RawQuery = values.Encode() + http.Redirect(w, r, redirect.String(), http.StatusFound) + case "/token": + if r.Method != http.MethodPost || r.ParseForm() != nil { + http.Error(w, "bad token request", 400) + return + } + id, secret, ok := r.BasicAuth() + if !ok { + id, secret = r.Form.Get("client_id"), r.Form.Get("client_secret") + } + nonce, found := codes.LoadAndDelete(r.Form.Get("code")) + if id != "local154" || secret != "local154-placeholder" || !found || r.Form.Get("grant_type") != "authorization_code" { + w.WriteHeader(400) + _ = json.NewEncoder(w).Encode(map[string]string{"error": "invalid_grant"}) + return + } + audience := id + if mode() == "bad-audience" { + audience = "different-lab-client" + } + claims, _ := json.Marshal(map[string]any{"iss": base, "sub": "local154-user", "aud": audience, "iat": time.Now().Unix(), "exp": time.Now().Add(time.Hour).Unix(), "policy": "readwrite", "nonce": nonce}) + header := base64.RawURLEncoding.EncodeToString([]byte(`{"alg":"RS256","kid":"local-154","typ":"JWT"}`)) + payload := header + "." + base64.RawURLEncoding.EncodeToString(claims) + hash := sha256.Sum256([]byte(payload)) + signature, err := rsa.SignPKCS1v15(rand.Reader, key, crypto.SHA256, hash[:]) + must(err) + if mode() == "bad-signature" { + signature[0] ^= 1 + } + token := payload + "." + base64.RawURLEncoding.EncodeToString(signature) + _ = json.NewEncoder(w).Encode(map[string]any{"access_token": token, "id_token": token, "token_type": "Bearer", "expires_in": 3600}) + case "/.well-known/openid-configuration": + _ = json.NewEncoder(w).Encode(map[string]any{"issuer": base, "jwks_uri": base + "/jwks", "authorization_endpoint": base + "/authorize", "token_endpoint": base + "/token", "response_types_supported": []string{"code"}, "subject_types_supported": []string{"public"}, "id_token_signing_alg_values_supported": []string{"RS256"}, "scopes_supported": []string{"openid"}}) + case "/jwks": + if mode() == "bad-jwks" { + http.Error(w, "synthetic JWKS outage", 503) + return + } + _ = json.NewEncoder(w).Encode(map[string]any{"keys": []any{map[string]any{"kty": "RSA", "kid": "local-154", "use": "sig", "alg": "RS256", "n": base64.RawURLEncoding.EncodeToString(key.N.Bytes()), "e": "AQAB"}}}) + default: + http.NotFound(w, r) + } + }) + fmt.Fprintln(os.Stderr, base) + must(server.ServeTLS(observedListener{ln}, "", "")) +} + +func must(err error) { + if err != nil { + panic(err) + } +} diff --git a/docs/investigations/issue-154/linux-evidence.json b/docs/investigations/issue-154/linux-evidence.json new file mode 100644 index 000000000..9554943f5 --- /dev/null +++ b/docs/investigations/issue-154/linux-evidence.json @@ -0,0 +1,3423 @@ +{ + "recorded_utc": "2026-09-09T08:19:11.671834+00:00", + "scope": "Isolated linux/arm64 integration tests of locally source-built Server and embedded Console. Synthetic loopback OIDC issuer; not the customer endpoint or real Keycloak. Browser flow driven through real Console HTTP APIs; no rendered browser UI validation.", + "container": { + "base_image": "existing generic pgsty/d12a:build", + "image_id": "sha256:307af7711e2e04ab75759cb42a1eef45c43c4404894c0e30dd19f742b107b922", + "os_arch": "linux/arm64", + "network": "none; all fixture/Server/Console traffic inside one loopback namespace", + "published_ports": [], + "server_or_console_image_used": false, + "curl": "7.88.1, OpenSSL 3.0.20, nghttp2, same namespace as Server" + }, + "build_flags": { + "CGO_ENABLED": "0", + "GOWORK": "off", + "GOOS": "linux", + "GOARCH": "arm64", + "GOTOOLCHAIN": "local", + "arguments": [ + "build", + "-mod=readonly", + "-tags", + "kqueue" + ], + "release_ldflags_used": false + }, + "candidate": { + "base_commit": "d1105bbb3d4a0afa33b3a4ac11b821235038ed0e", + "changed_files": [ + "cmd/config-current.go", + "cmd/iam.go", + "cmd/utils.go" + ], + "patch_sha256": "2a6095aa641805f3f6a79ec09f2c11fed2dc0ac38ae344a00a29734e9fb9aff9", + "product_worktree_modified": false, + "description": "Use Go default CurvePreferences only in the Server OpenID transport passed by IAM initialization and config validation." + }, + "builds": [ + { + "binary": "old-go126", + "commit": "d88f46ccee345a9c2fabe2d221d9a9e56bc11aec", + "go": "go1.26.5", + "sha256": "a75631117667c7533cc512ad7a71ee697d4e0149dd354cb20e3be64277ee5719", + "go_mod_sha256": "451822c94ee2431b9dcb019afadbb5366ab881317afd55cd95432707c8fc68fd", + "go_sum_sha256": "d5a4236fee117ccfbc63564c6d97b68e0e9d2290842b331d37135ae840cb47fa", + "dependencies": [ + "dep\taead.dev/mem\tv0.2.0\th1:ufgkESS9+lHV/GUjxgc2ObF43FLZGSemh+W+y27QFMI=", + "dep\taead.dev/minisign\tv0.3.0\th1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA=", + "dep\taead.dev/mtls\tv0.3.0\th1:a+C0t15Y9SRX6qP1EqmQFZ4ZSMm88TPvNDymasu4ahQ=", + "dep\tcel.dev/expr\tv0.25.1\th1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=", + "dep\tcloud.google.com/go\tv0.123.0\th1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=", + "dep\tcloud.google.com/go/auth\tv0.20.0\th1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=", + "dep\tcloud.google.com/go/auth/oauth2adapt\tv0.2.8\th1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=", + "dep\tcloud.google.com/go/compute/metadata\tv0.9.0\th1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=", + "dep\tcloud.google.com/go/iam\tv1.5.3\th1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=", + "dep\tcloud.google.com/go/monitoring\tv1.24.3\th1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=", + "dep\tcloud.google.com/go/storage\tv1.61.3\th1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=", + "dep\tfilippo.io/edwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azcore\tv1.21.1\th1:jHb/wfvRikGdxMXYV3QG/SzUOPYN9KEUUuC0Yd0/vC0=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azidentity\tv1.13.1\th1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/internal\tv1.12.0\th1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/storage/azblob\tv1.6.4\th1:jWQK1GI+LeGGUKBADtcH2rRqPxYB1Ljwms5gFA2LqrM=", + "dep\tgithub.com/Azure/go-ntlmssp\tv0.1.1\th1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=", + "dep\tgithub.com/AzureAD/microsoft-authentication-library-for-go\tv1.7.0\th1:4iB+IesclUXdP0ICgAabvq2FYLXrJWKx1fJQ+GxSo3Y=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp\tv1.32.0\th1:rIkQfkCOVKc1OiRCNcSDD8ml5RJlZbH/Xsq7lbpynwc=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric\tv0.55.0\th1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping\tv0.55.0\th1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=", + "dep\tgithub.com/IBM/sarama\tv1.45.1\th1:nY30XqYpqyXOXSNoe2XCgjj9jklGM1Ye94ierUb1jQ0=", + "dep\tgithub.com/VividCortex/ewma\tv1.2.0\th1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=", + "dep\tgithub.com/acarl005/stripansi\tv0.0.0-20180116102854-5a71ef0e047d\th1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=", + "dep\tgithub.com/alecthomas/participle\tv0.7.1\th1:2bN7reTw//5f0cugJcTOnY/NYZcWQOaajW+BwZB5xWs=", + "dep\tgithub.com/apache/thrift\tv0.24.0\th1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=", + "dep\tgithub.com/aymanbagabas/go-osc52/v2\tv2.0.1\th1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=", + "dep\tgithub.com/beevik/ntp\tv1.5.0\th1:y+uj/JjNwlY2JahivxYvtmv4ehfi3h74fAuABB9ZSM4=", + "dep\tgithub.com/beorn7/perks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=", + "dep\tgithub.com/buger/jsonparser\tv1.1.2\th1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=", + "dep\tgithub.com/cespare/xxhash/v2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=", + "dep\tgithub.com/charmbracelet/bubbles\tv1.0.0\th1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=", + "dep\tgithub.com/charmbracelet/bubbletea\tv1.3.10\th1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=", + "dep\tgithub.com/charmbracelet/colorprofile\tv0.4.3\th1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=", + "dep\tgithub.com/charmbracelet/harmonica\tv0.2.0\th1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=", + "dep\tgithub.com/charmbracelet/lipgloss\tv1.1.0\th1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=", + "dep\tgithub.com/charmbracelet/x/ansi\tv0.11.6\th1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=", + "dep\tgithub.com/charmbracelet/x/cellbuf\tv0.0.15\th1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=", + "dep\tgithub.com/charmbracelet/x/term\tv0.2.2\th1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=", + "dep\tgithub.com/cheggaaa/pb\tv1.0.29\th1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo=", + "dep\tgithub.com/clipperhouse/displaywidth\tv0.11.0\th1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=", + "dep\tgithub.com/clipperhouse/uax29/v2\tv2.7.0\th1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=", + "dep\tgithub.com/cncf/xds/go\tv0.0.0-20260202195803-dba9d589def2\th1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=", + "dep\tgithub.com/coreos/go-oidc/v3\tv3.17.0\th1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=", + "dep\tgithub.com/coreos/go-semver\tv0.3.1\th1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=", + "dep\tgithub.com/coreos/go-systemd/v22\tv22.7.0", + "=>\tgithub.com/coreos/go-systemd/v22\tv22.6.0\th1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=", + "dep\tgithub.com/cosnicolaou/pbzip2\tv1.0.6\th1:FYF6b2j4X4q3hZezd2AoUN/emLCtH/MbDGwJjiOacak=", + "dep\tgithub.com/davecgh/go-spew\tv1.1.2-0.20180830191138-d8f796af33cc\th1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=", + "dep\tgithub.com/dchest/siphash\tv1.2.3\th1:QXwFc8cFOR2dSa/gE6o/HokBMWtLUaNDVd+22aKHeEA=", + "dep\tgithub.com/docker/go-units\tv0.5.0\th1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=", + "dep\tgithub.com/dustin/go-humanize\tv1.0.1\th1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=", + "dep\tgithub.com/eapache/go-resiliency\tv1.7.0\th1:n3NRTnBn5N0Cbi/IeOHuQn9s2UwVUH7Ga0ZWcP+9JTA=", + "dep\tgithub.com/eapache/go-xerial-snappy\tv0.0.0-20230731223053-c322873962e3\th1:Oy0F4ALJ04o5Qqpdz8XLIpNA3WM/iSIXqxtqo7UGVws=", + "dep\tgithub.com/eapache/queue\tv1.1.0\th1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=", + "dep\tgithub.com/eclipse/paho.mqtt.golang\tv1.5.1\th1:/VSOv3oDLlpqR2Epjn1Q7b2bSTplJIeV2ISgCl2W7nE=", + "dep\tgithub.com/elastic/go-elasticsearch/v7\tv7.17.10\th1:TCQ8i4PmIJuBunvBS6bwT2ybzVFxxUhhltAs3Gyu1yo=", + "dep\tgithub.com/envoyproxy/go-control-plane/envoy\tv1.37.0\th1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=", + "dep\tgithub.com/envoyproxy/protoc-gen-validate\tv1.3.3\th1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=", + "dep\tgithub.com/fatih/color\tv1.19.0\th1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=", + "dep\tgithub.com/fatih/structs\tv1.1.0\th1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=", + "dep\tgithub.com/felixge/fgprof\tv0.9.5\th1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=", + "dep\tgithub.com/felixge/httpsnoop\tv1.0.4\th1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=", + "dep\tgithub.com/fraugster/parquet-go\tv0.12.0\th1:1slnC5y2VWEOUSlzbeXatM0BvSWcLUDsR/EcZsXXCZc=", + "dep\tgithub.com/go-asn1-ber/asn1-ber\tv1.5.8\th1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=", + "dep\tgithub.com/go-ini/ini\tv1.67.0\th1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=", + "dep\tgithub.com/go-jose/go-jose/v4\tv4.1.4\th1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=", + "dep\tgithub.com/go-ldap/ldap/v3\tv3.4.14\th1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=", + "dep\tgithub.com/go-logr/logr\tv1.4.3\th1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=", + "dep\tgithub.com/go-logr/stdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=", + "dep\tgithub.com/go-openapi/analysis\tv0.25.0\th1:EnjAq1yO8wEO9HbPmY8vLPEIkdZuuFhCAKBPvCB7bCs=", + "dep\tgithub.com/go-openapi/errors\tv0.22.7\th1:JLFBGC0Apwdzw3484MmBqspjPbwa2SHvpDm0u5aGhUA=", + "dep\tgithub.com/go-openapi/jsonpointer\tv0.23.1\th1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=", + "dep\tgithub.com/go-openapi/jsonreference\tv0.21.5\th1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=", + "dep\tgithub.com/go-openapi/loads\tv0.23.3\th1:g5Xap1JfwKkUnZdn+S0L3SzBDpcTIYzZ5Qaag0YDkKQ=", + "dep\tgithub.com/go-openapi/runtime\tv0.29.3\th1:h5twGaEqxtQg40ePiYm9vFFH1q06Czd7Ot6ufdK0w/Y=", + "dep\tgithub.com/go-openapi/spec\tv0.22.4\th1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ=", + "dep\tgithub.com/go-openapi/strfmt\tv0.26.2\th1:ysjheCh4i1rmFEo2LanhELDNucNzfWTZhUDKgWWPaFM=", + "dep\tgithub.com/go-openapi/swag\tv0.25.5\th1:pNkwbUEeGwMtcgxDr+2GBPAk4kT+kJ+AaB+TMKAg+TU=", + "dep\tgithub.com/go-openapi/swag/cmdutils\tv0.25.5\th1:yh5hHrpgsw4NwM9KAEtaDTXILYzdXh/I8Whhx9hKj7c=", + "dep\tgithub.com/go-openapi/swag/conv\tv0.28.0\th1:GtqqbyFe7vR5Y7ehxG9W6/OvrSFdf1OLeTGp40TqxH8=", + "dep\tgithub.com/go-openapi/swag/fileutils\tv0.25.5\th1:B6JTdOcs2c0dBIs9HnkyTW+5gC+8NIhVBUwERkFhMWk=", + "dep\tgithub.com/go-openapi/swag/jsonname\tv0.26.0\th1:gV1NFX9M8avo0YSpmWogqfQISigCmpaiNci8cGECU5w=", + "dep\tgithub.com/go-openapi/swag/jsonutils\tv0.25.5\th1:XUZF8awQr75MXeC+/iaw5usY/iM7nXPDwdG3Jbl9vYo=", + "dep\tgithub.com/go-openapi/swag/loading\tv0.25.5\th1:odQ/umlIZ1ZVRteI6ckSrvP6e2w9UTF5qgNdemJHjuU=", + "dep\tgithub.com/go-openapi/swag/mangling\tv0.25.5\th1:hyrnvbQRS7vKePQPHHDso+k6CGn5ZBs5232UqWZmJZw=", + "dep\tgithub.com/go-openapi/swag/netutils\tv0.25.5\th1:LZq2Xc2QI8+7838elRAaPCeqJnHODfSyOa7ZGfxDKlU=", + "dep\tgithub.com/go-openapi/swag/stringutils\tv0.25.5\th1:NVkoDOA8YBgtAR/zvCx5rhJKtZF3IzXcDdwOsYzrB6M=", + "dep\tgithub.com/go-openapi/swag/typeutils\tv0.28.0\th1:nRBKSBXjDgf01VDPB3fWeD9nQuhCOVeIYAkUx2tbkyY=", + "dep\tgithub.com/go-openapi/swag/yamlutils\tv0.25.5\th1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ=", + "dep\tgithub.com/go-openapi/validate\tv0.25.2\th1:12NsfLAwGegqbGWr2CnvT65X/Q2USJipmJ9b7xDJZz0=", + "dep\tgithub.com/go-sql-driver/mysql\tv1.9.3\th1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=", + "dep\tgithub.com/go-viper/mapstructure/v2\tv2.5.0\th1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=", + "dep\tgithub.com/gobwas/httphead\tv0.1.0\th1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=", + "dep\tgithub.com/gobwas/pool\tv0.2.1\th1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=", + "dep\tgithub.com/gobwas/ws\tv1.4.0\th1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=", + "dep\tgithub.com/gogo/protobuf\tv1.3.2\th1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=", + "dep\tgithub.com/golang-jwt/jwt/v4\tv4.5.2\th1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=", + "dep\tgithub.com/golang-jwt/jwt/v5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=", + "dep\tgithub.com/golang/protobuf\tv1.5.4\th1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=", + "dep\tgithub.com/golang/snappy\tv1.0.0\th1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=", + "dep\tgithub.com/gomodule/redigo\tv1.9.3\th1:dNPSXeXv6HCq2jdyWfjgmhBdqnR6PRO3m/G05nvpPC8=", + "dep\tgithub.com/google/pprof\tv0.0.0-20260507013755-92041b743c96\th1:YDDnaZ9afWajDboPMt9Vikqca/yWAX7KAxVzb4lJU1M=", + "dep\tgithub.com/google/s2a-go\tv0.1.9\th1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=", + "dep\tgithub.com/google/shlex\tv0.0.0-20191202100458-e7afc7fbc510\th1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=", + "dep\tgithub.com/google/uuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=", + "dep\tgithub.com/googleapis/enterprise-certificate-proxy\tv0.3.15\th1:xolVQTEXusUcAA5UgtyRLjelpFFHWlPQ4XfWGc7MBas=", + "dep\tgithub.com/googleapis/gax-go/v2\tv2.22.0\th1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=", + "dep\tgithub.com/gorilla/websocket\tv1.5.4-0.20250319132907-e064f32e3674\th1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=", + "dep\tgithub.com/grafana/regexp\tv0.0.0-20250905093917-f7b3be9d1853\th1:cLN4IBkmkYZNnk7EAJ0BHIethd+J6LqxFNw5mSiI2bM=", + "dep\tgithub.com/grpc-ecosystem/grpc-gateway/v2\tv2.29.0\th1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=", + "dep\tgithub.com/hashicorp/errwrap\tv1.1.0\th1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=", + "dep\tgithub.com/hashicorp/go-multierror\tv1.1.1\th1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=", + "dep\tgithub.com/hashicorp/go-uuid\tv1.0.3\th1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=", + "dep\tgithub.com/inconshreveable/mousetrap\tv1.1.0\th1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=", + "dep\tgithub.com/jcmturner/aescts/v2\tv2.0.0\th1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=", + "dep\tgithub.com/jcmturner/dnsutils/v2\tv2.0.0\th1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=", + "dep\tgithub.com/jcmturner/gofork\tv1.7.6\th1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=", + "dep\tgithub.com/jcmturner/gokrb5/v8\tv8.4.4\th1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=", + "dep\tgithub.com/jcmturner/rpc/v2\tv2.0.3\th1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=", + "dep\tgithub.com/jedib0t/go-pretty/v6\tv6.7.8\th1:BVYrDy5DPBA3Qn9ICT+PokP9cvCv1KaHv2i+Hc8sr5o=", + "dep\tgithub.com/jessevdk/go-flags\tv1.6.1\th1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=", + "dep\tgithub.com/json-iterator/go\tv1.1.12\th1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=", + "dep\tgithub.com/juju/ratelimit\tv1.0.2\th1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=", + "dep\tgithub.com/klauspost/compress\tv1.18.7\th1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=", + "dep\tgithub.com/klauspost/cpuid/v2\tv2.3.0\th1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=", + "dep\tgithub.com/klauspost/crc32\tv1.3.0\th1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=", + "dep\tgithub.com/klauspost/filepathx\tv1.1.1\th1:201zvAsL1PhZvmXTP+QLer3AavWrO3U1NILWpniHK4w=", + "dep\tgithub.com/klauspost/pgzip\tv1.2.6\th1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=", + "dep\tgithub.com/klauspost/readahead\tv1.4.0\th1:w4hQ3BpdLjBnRQkZyNi+nwdHU7eGP9buTexWK9lU7gY=", + "dep\tgithub.com/klauspost/reedsolomon\tv1.13.3\th1:01GwnO2xoCSaM0ShP4qwl+FsHg3csFShC6Tu/RS1ji0=", + "dep\tgithub.com/kr/fs\tv0.1.0\th1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=", + "dep\tgithub.com/kylelemons/godebug\tv1.1.0\th1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=", + "dep\tgithub.com/lestrrat-go/blackmagic\tv1.0.4\th1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=", + "dep\tgithub.com/lestrrat-go/dsig\tv1.0.0\th1:OE09s2r9Z81kxzJYRn07TFM9XA4akrUdoMwr0L8xj38=", + "dep\tgithub.com/lestrrat-go/httpcc\tv1.0.1\th1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=", + "dep\tgithub.com/lestrrat-go/httprc/v3\tv3.0.1\th1:3n7Es68YYGZb2Jf+k//llA4FTZMl3yCwIjFIk4ubevI=", + "dep\tgithub.com/lestrrat-go/jwx/v3\tv3.0.12\th1:p25r68Y4KrbBdYjIsQweYxq794CtGCzcrc5dGzJIRjg=", + "dep\tgithub.com/lestrrat-go/option\tv1.0.1\th1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=", + "dep\tgithub.com/lestrrat-go/option/v2\tv2.0.0\th1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=", + "dep\tgithub.com/lib/pq\tv1.10.9\th1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=", + "dep\tgithub.com/lithammer/shortuuid/v4\tv4.2.0\th1:LMFOzVB3996a7b8aBuEXxqOBflbfPQAiVzkIcHO0h8c=", + "dep\tgithub.com/lucasb-eyer/go-colorful\tv1.3.0\th1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=", + "dep\tgithub.com/mattn/go-colorable\tv0.1.15\th1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=", + "dep\tgithub.com/mattn/go-ieproxy\tv0.0.12\th1:OZkUFJC3ESNZPQ+6LzC3VJIFSnreeFLQyqvBWtvfL2M=", + "dep\tgithub.com/mattn/go-isatty\tv0.0.24\th1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=", + "dep\tgithub.com/mattn/go-runewidth\tv0.0.21\th1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=", + "dep\tgithub.com/matttproud/golang_protobuf_extensions\tv1.0.4\th1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=", + "dep\tgithub.com/miekg/dns\tv1.1.72\th1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=", + "dep\tgithub.com/minio/cli\tv1.24.2\th1:J+fCUh9mhPLjN3Lj/YhklXvxj8mnyE/D6FpFduXJ2jg=", + "dep\tgithub.com/minio/colorjson\tv1.0.8\th1:AS6gEQ1dTRYHmC4xuoodPDRILHP/9Wz5wYUGDQfPLpg=", + "dep\tgithub.com/minio/console\tv1.7.6", + "=>\tgithub.com/pgsty/silo-console\tv0.0.0-20260804042150-b952a1202869\th1:HLfc2ZdAycnI/bLl+TdsuckyzSWrwQarK38pS14yH/Q=", + "dep\tgithub.com/minio/crc64nvme\tv1.1.1\th1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=", + "dep\tgithub.com/minio/csvparser\tv1.0.0\th1:xJEHcYK8ZAjeW4hNV9Zu30u+/2o4UyPnYgyjWp8b7ZU=", + "dep\tgithub.com/minio/dnscache\tv0.1.1\th1:AMYLqomzskpORiUA1ciN9k7bZT1oB3YZN4cEIi88W5o=", + "dep\tgithub.com/minio/dperf\tv0.7.1\th1:eBwtaBBjuANwgUy1waWoS+wP+0i5fkXJOdGU2RXuDxo=", + "dep\tgithub.com/minio/filepath\tv1.0.0\th1:fvkJu1+6X+ECRA6G3+JJETj4QeAYO9sV43I79H8ubDY=", + "dep\tgithub.com/minio/highwayhash\tv1.0.4\th1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=", + "dep\tgithub.com/minio/kms-go/kes\tv0.3.1\th1:K3sPFAvFbJx33XlCTUBnQo8JRmSZyDvT6T2/MQ2iC3A=", + "dep\tgithub.com/minio/kms-go/kms\tv0.6.0\th1:oGdGUyjfCZwRIi7em0aj4wk+oOm7+4a0lzSZny7ZIDU=", + "dep\tgithub.com/minio/madmin-go/v3\tv3.0.110\th1:FIYekj7YPc430ffpXFWiUtyut3qBt/unIAcDzJn9H5M=", + "dep\tgithub.com/minio/mc\tv0.0.0-20251106162529-77f82e18b540", + "=>\tgithub.com/pgsty/mc\tv0.0.0-20260801042411-ad10a2a10b76\th1:UIlUuz0LQKw4QlAljhv7nPDDFC1+n+e0iED7rWZrgZ8=", + "dep\tgithub.com/minio/md5-simd\tv1.1.2\th1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=", + "dep\tgithub.com/minio/minio-go/v7\tv7.0.99\th1:2vH/byrwUkIpFQFOilvTfaUpvAX3fEFhEzO+DR3DlCE=", + "dep\tgithub.com/minio/mux\tv1.9.2\th1:dQchne49BUBgOlxIHjx5wVe1gl5VXF2sxd4YCXkikTw=", + "dep\tgithub.com/minio/pkg/v3\tv3.6.1", + "=>\tgithub.com/pgsty/silo-pkg/v3\tv3.11.0\th1:wjN5d+tWD8Twq+e7k/KBBVhnWXC8xTIlfTcnGIKkmjc=", + "dep\tgithub.com/minio/selfupdate\tv0.6.0\th1:i76PgT0K5xO9+hjzKcacQtO7+MjJ4JKA8Ak8XQ9DDwU=", + "dep\tgithub.com/minio/simdjson-go\tv0.4.5\th1:r4IQwjRGmWCQ2VeMc7fGiilu1z5du0gJ/I/FsKwgo5A=", + "dep\tgithub.com/minio/sio\tv0.4.3\th1:JqyID1XM86KwBZox5RAdLD4MLPIDoCY2cke2CXCJCkg=", + "dep\tgithub.com/minio/websocket\tv1.6.0\th1:CPvnQvNvlVaQmvw5gtJNyYQhg4+xRmrPNhBbv8BdpAE=", + "dep\tgithub.com/minio/xxml\tv0.0.3\th1:ZIpPQpfyG5uZQnqqC0LZuWtPk/WT8G/qkxvO6jb7zMU=", + "dep\tgithub.com/minio/zipindex\tv0.5.0\th1:QydEWJW+uAFMd5xmQa580bm7JtC5krpuAtARXIQr72U=", + "dep\tgithub.com/mitchellh/go-homedir\tv1.1.0\th1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=", + "dep\tgithub.com/modern-go/concurrent\tv0.0.0-20180306012644-bacd9c7ef1dd\th1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=", + "dep\tgithub.com/modern-go/reflect2\tv1.0.3-0.20250322232337-35a7c28c31ee\th1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=", + "dep\tgithub.com/muesli/ansi\tv0.0.0-20230316100256-276c6243b2f6\th1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=", + "dep\tgithub.com/muesli/cancelreader\tv0.2.2\th1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=", + "dep\tgithub.com/muesli/reflow\tv0.3.0\th1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=", + "dep\tgithub.com/muesli/termenv\tv0.16.0\th1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=", + "dep\tgithub.com/munnerz/goautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=", + "dep\tgithub.com/nats-io/nats.go\tv1.49.0\th1:yh/WvY59gXqYpgl33ZI+XoVPKyut/IcEaqtsiuTJpoE=", + "dep\tgithub.com/nats-io/nkeys\tv0.4.15\th1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=", + "dep\tgithub.com/nats-io/nuid\tv1.0.1\th1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=", + "dep\tgithub.com/nats-io/stan.go\tv0.10.4\th1:19GS/eD1SeQJaVkeM9EkvEYattnvnWrZ3wkSWSw4uXw=", + "dep\tgithub.com/ncw/directio\tv1.0.5\th1:JSUBhdjEvVaJvOoyPAbcW0fnd0tvRXD76wEfZ1KcQz4=", + "dep\tgithub.com/nsqio/go-nsq\tv1.1.0\th1:PQg+xxiUjA7V+TLdXw7nVrJ5Jbl3sN86EhGCQj4+FYE=", + "dep\tgithub.com/oklog/ulid/v2\tv2.1.1\th1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=", + "dep\tgithub.com/olekukonko/tablewriter\tv0.0.5\th1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=", + "dep\tgithub.com/philhofer/fwd\tv1.2.0\th1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=", + "dep\tgithub.com/pierrec/lz4/v4\tv4.1.26\th1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=", + "dep\tgithub.com/pkg/browser\tv0.0.0-20240102092130-5ac0b6a4141c\th1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=", + "dep\tgithub.com/pkg/errors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=", + "dep\tgithub.com/pkg/sftp\tv1.13.10\th1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=", + "dep\tgithub.com/pkg/xattr\tv0.4.12\th1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=", + "dep\tgithub.com/posener/complete\tv1.2.3\th1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=", + "dep\tgithub.com/prometheus/client_golang\tv1.23.2\th1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=", + "dep\tgithub.com/prometheus/client_model\tv0.6.2\th1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=", + "dep\tgithub.com/prometheus/common\tv0.67.5\th1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=", + "dep\tgithub.com/prometheus/procfs\tv0.20.1\th1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=", + "dep\tgithub.com/prometheus/prom2json\tv1.5.0\th1:WIcAOjLE1x476W3dUlmTL6E/e98CgVGuwwYusl6MPP8=", + "dep\tgithub.com/prometheus/prometheus\tv0.311.3\th1:3IrVxQv6v5i/ZCGi6OrYeBhtCwaPTn6Z3DYruXoYm3M=", + "dep\tgithub.com/puzpuzpuz/xsync/v3\tv3.5.1\th1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=", + "dep\tgithub.com/rabbitmq/amqp091-go\tv1.10.0\th1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=", + "dep\tgithub.com/rcrowley/go-metrics\tv0.0.0-20250401214520-65e299d6c5c9\th1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=", + "dep\tgithub.com/rivo/uniseg\tv0.4.7\th1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=", + "dep\tgithub.com/rjeczalik/notify\tv0.9.3\th1:6rJAzHTGKXGj76sbRgDiDcYj/HniypXmSJo1SWakZeY=", + "dep\tgithub.com/rs/cors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=", + "dep\tgithub.com/rs/xid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=", + "dep\tgithub.com/safchain/ethtool\tv0.7.0\th1:rlJzfDetsVvT61uz8x1YIcFn12akMfuPulHtZjtb7Is=", + "dep\tgithub.com/secure-io/sio-go\tv0.3.1\th1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rRc=", + "dep\tgithub.com/shirou/gopsutil/v3\tv3.24.5\th1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=", + "dep\tgithub.com/spiffe/go-spiffe/v2\tv2.6.0\th1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=", + "dep\tgithub.com/tidwall/gjson\tv1.18.0\th1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=", + "dep\tgithub.com/tidwall/match\tv1.2.0\th1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=", + "dep\tgithub.com/tidwall/pretty\tv1.2.1\th1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=", + "dep\tgithub.com/tinylib/msgp\tv1.6.4\th1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=", + "dep\tgithub.com/tklauser/go-sysconf\tv0.3.16\th1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=", + "dep\tgithub.com/tklauser/numcpus\tv0.11.0\th1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=", + "dep\tgithub.com/unrolled/secure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=", + "dep\tgithub.com/valyala/bytebufferpool\tv1.0.0\th1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=", + "dep\tgithub.com/valyala/fastjson\tv1.6.4\th1:uAUNq9Z6ymTgGhcm0UynUAB6tlbakBrz6CQFax3BXVQ=", + "dep\tgithub.com/vbauerster/mpb/v8\tv8.12.0\th1:+gneY3ifzc88tKDzOtfG8k8gfngCx615S2ZmFM4liWg=", + "dep\tgithub.com/xdg/scram\tv1.0.5\th1:TuS0RFmt5Is5qm9Tm2SoD89OPqe4IRiFtyFY4iwWXsw=", + "dep\tgithub.com/xdg/stringprep\tv1.0.3\th1:cmL5Enob4W83ti/ZHuZLuKD/xqJfus4fVPwE+/BDm+4=", + "dep\tgithub.com/xo/terminfo\tv0.0.0-20220910002029-abceb7e1c41e\th1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=", + "dep\tgithub.com/zeebo/xxh3\tv1.1.0\th1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=", + "dep\tgo.etcd.io/etcd/api/v3\tv3.6.9\th1:UA7iKfEW1AzgihcBSGXci2kDGQiokSq41F9HMCI/RTI=", + "dep\tgo.etcd.io/etcd/client/pkg/v3\tv3.6.9\th1:T8nuk8Lz64C+Hzb0coBFLMSlVSQZBpAtFk46swdM1DA=", + "dep\tgo.etcd.io/etcd/client/v3\tv3.6.9\th1:3X555hQXmhRr27O37wls53g68CpUiPOiHXrZfz2Al+o=", + "dep\tgo.opentelemetry.io/auto/sdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=", + "dep\tgo.opentelemetry.io/contrib/detectors/gcp\tv1.43.0\th1:62yY3dT7/ShwOxzA0RsKRgshBmfElKI4d/Myu2OxDFU=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc\tv0.67.0\th1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/net/http/otelhttp\tv0.69.0\th1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=", + "dep\tgo.opentelemetry.io/otel\tv1.44.0\th1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=", + "dep\tgo.opentelemetry.io/otel/metric\tv1.44.0\th1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=", + "dep\tgo.opentelemetry.io/otel/sdk\tv1.44.0\th1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=", + "dep\tgo.opentelemetry.io/otel/sdk/metric\tv1.44.0\th1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=", + "dep\tgo.opentelemetry.io/otel/trace\tv1.44.0\th1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=", + "dep\tgo.uber.org/atomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=", + "dep\tgo.uber.org/multierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=", + "dep\tgo.uber.org/zap\tv1.28.0\th1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=", + "dep\tgo.yaml.in/yaml/v2\tv2.4.4\th1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=", + "dep\tgo.yaml.in/yaml/v3\tv3.0.5\th1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=", + "dep\tgoftp.io/server/v2\tv2.0.2\th1:tkZpqyXys+vC15W5yGMi8Kzmbv1QSgeKr8qJXBnJbm8=", + "dep\tgolang.org/x/crypto\tv0.54.0\th1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=", + "dep\tgolang.org/x/net\tv0.57.0\th1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=", + "dep\tgolang.org/x/oauth2\tv0.36.0\th1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=", + "dep\tgolang.org/x/sync\tv0.22.0\th1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=", + "dep\tgolang.org/x/sys\tv0.47.0\th1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=", + "dep\tgolang.org/x/term\tv0.45.0\th1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=", + "dep\tgolang.org/x/text\tv0.40.0\th1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=", + "dep\tgolang.org/x/time\tv0.15.0\th1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=", + "dep\tgoogle.golang.org/api\tv0.278.0\th1:W7jiRvRi53VYFfZ/HoZjQBtJk7gOFbHD8ot1RzVZU6E=", + "dep\tgoogle.golang.org/genproto\tv0.0.0-20260319201613-d00831a3d3e7\th1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=", + "dep\tgoogle.golang.org/genproto/googleapis/api\tv0.0.0-20260526163538-3dc84a4a5aaa\th1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=", + "dep\tgoogle.golang.org/genproto/googleapis/rpc\tv0.0.0-20260526163538-3dc84a4a5aaa\th1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=", + "dep\tgoogle.golang.org/grpc\tv1.82.1\th1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=", + "dep\tgoogle.golang.org/protobuf\tv1.36.11\th1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=", + "dep\tgopkg.in/yaml.v2\tv2.4.0\th1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=" + ], + "build_settings": [ + "build\t-buildmode=exe", + "build\t-compiler=gc", + "build\t-tags=kqueue", + "build\tCGO_ENABLED=0", + "build\tGOARCH=arm64", + "build\tGOOS=linux", + "build\tGOARM64=v8.0" + ], + "patched": false, + "dependency_graph_sha256": "692c41d253e666fea024ec976b9d2728552bb58f75cdafe05ddb47dc15d4bad8" + }, + { + "binary": "old-go127", + "commit": "d88f46ccee345a9c2fabe2d221d9a9e56bc11aec", + "go": "go1.27.1", + "sha256": "b6bac7e3299575d1508257286edf5f081ac5aebb390cfc0fc49af695cc56f0c1", + "go_mod_sha256": "451822c94ee2431b9dcb019afadbb5366ab881317afd55cd95432707c8fc68fd", + "go_sum_sha256": "d5a4236fee117ccfbc63564c6d97b68e0e9d2290842b331d37135ae840cb47fa", + "dependencies": [ + "dep\taead.dev/mem\tv0.2.0\th1:ufgkESS9+lHV/GUjxgc2ObF43FLZGSemh+W+y27QFMI=", + "dep\taead.dev/minisign\tv0.3.0\th1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA=", + "dep\taead.dev/mtls\tv0.3.0\th1:a+C0t15Y9SRX6qP1EqmQFZ4ZSMm88TPvNDymasu4ahQ=", + "dep\tcel.dev/expr\tv0.25.1\th1:1KrZg61W6TWSxuNZ37Xy49ps13NUovb66QLprthtwi4=", + "dep\tcloud.google.com/go\tv0.123.0\th1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=", + "dep\tcloud.google.com/go/auth\tv0.20.0\th1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=", + "dep\tcloud.google.com/go/auth/oauth2adapt\tv0.2.8\th1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=", + "dep\tcloud.google.com/go/compute/metadata\tv0.9.0\th1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=", + "dep\tcloud.google.com/go/iam\tv1.5.3\th1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=", + "dep\tcloud.google.com/go/monitoring\tv1.24.3\th1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=", + "dep\tcloud.google.com/go/storage\tv1.61.3\th1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=", + "dep\tfilippo.io/edwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azcore\tv1.21.1\th1:jHb/wfvRikGdxMXYV3QG/SzUOPYN9KEUUuC0Yd0/vC0=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azidentity\tv1.13.1\th1:Hk5QBxZQC1jb2Fwj6mpzme37xbCDdNTxU7O9eb5+LB4=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/internal\tv1.12.0\th1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/storage/azblob\tv1.6.4\th1:jWQK1GI+LeGGUKBADtcH2rRqPxYB1Ljwms5gFA2LqrM=", + "dep\tgithub.com/Azure/go-ntlmssp\tv0.1.1\th1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=", + "dep\tgithub.com/AzureAD/microsoft-authentication-library-for-go\tv1.7.0\th1:4iB+IesclUXdP0ICgAabvq2FYLXrJWKx1fJQ+GxSo3Y=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp\tv1.32.0\th1:rIkQfkCOVKc1OiRCNcSDD8ml5RJlZbH/Xsq7lbpynwc=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric\tv0.55.0\th1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping\tv0.55.0\th1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=", + "dep\tgithub.com/IBM/sarama\tv1.45.1\th1:nY30XqYpqyXOXSNoe2XCgjj9jklGM1Ye94ierUb1jQ0=", + "dep\tgithub.com/VividCortex/ewma\tv1.2.0\th1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=", + "dep\tgithub.com/acarl005/stripansi\tv0.0.0-20180116102854-5a71ef0e047d\th1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=", + "dep\tgithub.com/alecthomas/participle\tv0.7.1\th1:2bN7reTw//5f0cugJcTOnY/NYZcWQOaajW+BwZB5xWs=", + "dep\tgithub.com/apache/thrift\tv0.24.0\th1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=", + "dep\tgithub.com/aymanbagabas/go-osc52/v2\tv2.0.1\th1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=", + "dep\tgithub.com/beevik/ntp\tv1.5.0\th1:y+uj/JjNwlY2JahivxYvtmv4ehfi3h74fAuABB9ZSM4=", + "dep\tgithub.com/beorn7/perks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=", + "dep\tgithub.com/buger/jsonparser\tv1.1.2\th1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=", + "dep\tgithub.com/cespare/xxhash/v2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=", + "dep\tgithub.com/charmbracelet/bubbles\tv1.0.0\th1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=", + "dep\tgithub.com/charmbracelet/bubbletea\tv1.3.10\th1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=", + "dep\tgithub.com/charmbracelet/colorprofile\tv0.4.3\th1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=", + "dep\tgithub.com/charmbracelet/harmonica\tv0.2.0\th1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=", + "dep\tgithub.com/charmbracelet/lipgloss\tv1.1.0\th1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=", + "dep\tgithub.com/charmbracelet/x/ansi\tv0.11.6\th1:GhV21SiDz/45W9AnV2R61xZMRri5NlLnl6CVF7ihZW8=", + "dep\tgithub.com/charmbracelet/x/cellbuf\tv0.0.15\th1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=", + "dep\tgithub.com/charmbracelet/x/term\tv0.2.2\th1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=", + "dep\tgithub.com/cheggaaa/pb\tv1.0.29\th1:FckUN5ngEk2LpvuG0fw1GEFx6LtyY2pWI/Z2QgCnEYo=", + "dep\tgithub.com/clipperhouse/displaywidth\tv0.11.0\th1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=", + "dep\tgithub.com/clipperhouse/uax29/v2\tv2.7.0\th1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=", + "dep\tgithub.com/cncf/xds/go\tv0.0.0-20260202195803-dba9d589def2\th1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=", + "dep\tgithub.com/coreos/go-oidc/v3\tv3.17.0\th1:hWBGaQfbi0iVviX4ibC7bk8OKT5qNr4klBaCHVNvehc=", + "dep\tgithub.com/coreos/go-semver\tv0.3.1\th1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=", + "dep\tgithub.com/coreos/go-systemd/v22\tv22.7.0", + "=>\tgithub.com/coreos/go-systemd/v22\tv22.6.0\th1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=", + "dep\tgithub.com/cosnicolaou/pbzip2\tv1.0.6\th1:FYF6b2j4X4q3hZezd2AoUN/emLCtH/MbDGwJjiOacak=", + "dep\tgithub.com/davecgh/go-spew\tv1.1.2-0.20180830191138-d8f796af33cc\th1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=", + "dep\tgithub.com/dchest/siphash\tv1.2.3\th1:QXwFc8cFOR2dSa/gE6o/HokBMWtLUaNDVd+22aKHeEA=", + "dep\tgithub.com/docker/go-units\tv0.5.0\th1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=", + "dep\tgithub.com/dustin/go-humanize\tv1.0.1\th1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=", + "dep\tgithub.com/eapache/go-resiliency\tv1.7.0\th1:n3NRTnBn5N0Cbi/IeOHuQn9s2UwVUH7Ga0ZWcP+9JTA=", + "dep\tgithub.com/eapache/go-xerial-snappy\tv0.0.0-20230731223053-c322873962e3\th1:Oy0F4ALJ04o5Qqpdz8XLIpNA3WM/iSIXqxtqo7UGVws=", + "dep\tgithub.com/eapache/queue\tv1.1.0\th1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=", + "dep\tgithub.com/eclipse/paho.mqtt.golang\tv1.5.1\th1:/VSOv3oDLlpqR2Epjn1Q7b2bSTplJIeV2ISgCl2W7nE=", + "dep\tgithub.com/elastic/go-elasticsearch/v7\tv7.17.10\th1:TCQ8i4PmIJuBunvBS6bwT2ybzVFxxUhhltAs3Gyu1yo=", + "dep\tgithub.com/envoyproxy/go-control-plane/envoy\tv1.37.0\th1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=", + "dep\tgithub.com/envoyproxy/protoc-gen-validate\tv1.3.3\th1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=", + "dep\tgithub.com/fatih/color\tv1.19.0\th1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=", + "dep\tgithub.com/fatih/structs\tv1.1.0\th1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=", + "dep\tgithub.com/felixge/fgprof\tv0.9.5\th1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=", + "dep\tgithub.com/felixge/httpsnoop\tv1.0.4\th1:NFTV2Zj1bL4mc9sqWACXbQFVBBg2W3GPvqp8/ESS2Wg=", + "dep\tgithub.com/fraugster/parquet-go\tv0.12.0\th1:1slnC5y2VWEOUSlzbeXatM0BvSWcLUDsR/EcZsXXCZc=", + "dep\tgithub.com/go-asn1-ber/asn1-ber\tv1.5.8\th1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=", + "dep\tgithub.com/go-ini/ini\tv1.67.0\th1:z6ZrTEZqSWOTyH2FlglNbNgARyHG8oLW9gMELqKr06A=", + "dep\tgithub.com/go-jose/go-jose/v4\tv4.1.4\th1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=", + "dep\tgithub.com/go-ldap/ldap/v3\tv3.4.14\th1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=", + "dep\tgithub.com/go-logr/logr\tv1.4.3\th1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=", + "dep\tgithub.com/go-logr/stdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=", + "dep\tgithub.com/go-openapi/analysis\tv0.25.0\th1:EnjAq1yO8wEO9HbPmY8vLPEIkdZuuFhCAKBPvCB7bCs=", + "dep\tgithub.com/go-openapi/errors\tv0.22.7\th1:JLFBGC0Apwdzw3484MmBqspjPbwa2SHvpDm0u5aGhUA=", + "dep\tgithub.com/go-openapi/jsonpointer\tv0.23.1\th1:1HBACs7XIwR2RcmItfdSFlALhGbe6S92p0ry4d1GWg4=", + "dep\tgithub.com/go-openapi/jsonreference\tv0.21.5\th1:6uCGVXU/aNF13AQNggxfysJ+5ZcU4nEAe+pJyVWRdiE=", + "dep\tgithub.com/go-openapi/loads\tv0.23.3\th1:g5Xap1JfwKkUnZdn+S0L3SzBDpcTIYzZ5Qaag0YDkKQ=", + "dep\tgithub.com/go-openapi/runtime\tv0.29.3\th1:h5twGaEqxtQg40ePiYm9vFFH1q06Czd7Ot6ufdK0w/Y=", + "dep\tgithub.com/go-openapi/spec\tv0.22.4\th1:4pxGjipMKu0FzFiu/DPwN3CTBRlVM2yLf/YTWorYfDQ=", + "dep\tgithub.com/go-openapi/strfmt\tv0.26.2\th1:ysjheCh4i1rmFEo2LanhELDNucNzfWTZhUDKgWWPaFM=", + "dep\tgithub.com/go-openapi/swag\tv0.25.5\th1:pNkwbUEeGwMtcgxDr+2GBPAk4kT+kJ+AaB+TMKAg+TU=", + "dep\tgithub.com/go-openapi/swag/cmdutils\tv0.25.5\th1:yh5hHrpgsw4NwM9KAEtaDTXILYzdXh/I8Whhx9hKj7c=", + "dep\tgithub.com/go-openapi/swag/conv\tv0.28.0\th1:GtqqbyFe7vR5Y7ehxG9W6/OvrSFdf1OLeTGp40TqxH8=", + "dep\tgithub.com/go-openapi/swag/fileutils\tv0.25.5\th1:B6JTdOcs2c0dBIs9HnkyTW+5gC+8NIhVBUwERkFhMWk=", + "dep\tgithub.com/go-openapi/swag/jsonname\tv0.26.0\th1:gV1NFX9M8avo0YSpmWogqfQISigCmpaiNci8cGECU5w=", + "dep\tgithub.com/go-openapi/swag/jsonutils\tv0.25.5\th1:XUZF8awQr75MXeC+/iaw5usY/iM7nXPDwdG3Jbl9vYo=", + "dep\tgithub.com/go-openapi/swag/loading\tv0.25.5\th1:odQ/umlIZ1ZVRteI6ckSrvP6e2w9UTF5qgNdemJHjuU=", + "dep\tgithub.com/go-openapi/swag/mangling\tv0.25.5\th1:hyrnvbQRS7vKePQPHHDso+k6CGn5ZBs5232UqWZmJZw=", + "dep\tgithub.com/go-openapi/swag/netutils\tv0.25.5\th1:LZq2Xc2QI8+7838elRAaPCeqJnHODfSyOa7ZGfxDKlU=", + "dep\tgithub.com/go-openapi/swag/stringutils\tv0.25.5\th1:NVkoDOA8YBgtAR/zvCx5rhJKtZF3IzXcDdwOsYzrB6M=", + "dep\tgithub.com/go-openapi/swag/typeutils\tv0.28.0\th1:nRBKSBXjDgf01VDPB3fWeD9nQuhCOVeIYAkUx2tbkyY=", + "dep\tgithub.com/go-openapi/swag/yamlutils\tv0.25.5\th1:kASCIS+oIeoc55j28T4o8KwlV2S4ZLPT6G0iq2SSbVQ=", + "dep\tgithub.com/go-openapi/validate\tv0.25.2\th1:12NsfLAwGegqbGWr2CnvT65X/Q2USJipmJ9b7xDJZz0=", + "dep\tgithub.com/go-sql-driver/mysql\tv1.9.3\th1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=", + "dep\tgithub.com/go-viper/mapstructure/v2\tv2.5.0\th1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=", + "dep\tgithub.com/gobwas/httphead\tv0.1.0\th1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=", + "dep\tgithub.com/gobwas/pool\tv0.2.1\th1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=", + "dep\tgithub.com/gobwas/ws\tv1.4.0\th1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=", + "dep\tgithub.com/gogo/protobuf\tv1.3.2\th1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=", + "dep\tgithub.com/golang-jwt/jwt/v4\tv4.5.2\th1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=", + "dep\tgithub.com/golang-jwt/jwt/v5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=", + "dep\tgithub.com/golang/protobuf\tv1.5.4\th1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=", + "dep\tgithub.com/golang/snappy\tv1.0.0\th1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=", + "dep\tgithub.com/gomodule/redigo\tv1.9.3\th1:dNPSXeXv6HCq2jdyWfjgmhBdqnR6PRO3m/G05nvpPC8=", + "dep\tgithub.com/google/pprof\tv0.0.0-20260507013755-92041b743c96\th1:YDDnaZ9afWajDboPMt9Vikqca/yWAX7KAxVzb4lJU1M=", + "dep\tgithub.com/google/s2a-go\tv0.1.9\th1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=", + "dep\tgithub.com/google/shlex\tv0.0.0-20191202100458-e7afc7fbc510\th1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=", + "dep\tgithub.com/google/uuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=", + "dep\tgithub.com/googleapis/enterprise-certificate-proxy\tv0.3.15\th1:xolVQTEXusUcAA5UgtyRLjelpFFHWlPQ4XfWGc7MBas=", + "dep\tgithub.com/googleapis/gax-go/v2\tv2.22.0\th1:PjIWBpgGIVKGoCXuiCoP64altEJCj3/Ei+kSU5vlZD4=", + "dep\tgithub.com/gorilla/websocket\tv1.5.4-0.20250319132907-e064f32e3674\th1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=", + "dep\tgithub.com/grafana/regexp\tv0.0.0-20250905093917-f7b3be9d1853\th1:cLN4IBkmkYZNnk7EAJ0BHIethd+J6LqxFNw5mSiI2bM=", + "dep\tgithub.com/grpc-ecosystem/grpc-gateway/v2\tv2.29.0\th1:5VipnvEpbqr2gA2VbM+nYVbkIF28c5ZQfqCBQ5g2xfk=", + "dep\tgithub.com/hashicorp/errwrap\tv1.1.0\th1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=", + "dep\tgithub.com/hashicorp/go-multierror\tv1.1.1\th1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=", + "dep\tgithub.com/hashicorp/go-uuid\tv1.0.3\th1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=", + "dep\tgithub.com/inconshreveable/mousetrap\tv1.1.0\th1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=", + "dep\tgithub.com/jcmturner/aescts/v2\tv2.0.0\th1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=", + "dep\tgithub.com/jcmturner/dnsutils/v2\tv2.0.0\th1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=", + "dep\tgithub.com/jcmturner/gofork\tv1.7.6\th1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=", + "dep\tgithub.com/jcmturner/gokrb5/v8\tv8.4.4\th1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=", + "dep\tgithub.com/jcmturner/rpc/v2\tv2.0.3\th1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=", + "dep\tgithub.com/jedib0t/go-pretty/v6\tv6.7.8\th1:BVYrDy5DPBA3Qn9ICT+PokP9cvCv1KaHv2i+Hc8sr5o=", + "dep\tgithub.com/jessevdk/go-flags\tv1.6.1\th1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=", + "dep\tgithub.com/json-iterator/go\tv1.1.12\th1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=", + "dep\tgithub.com/juju/ratelimit\tv1.0.2\th1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=", + "dep\tgithub.com/klauspost/compress\tv1.18.7\th1:aUyZsS4kH3QTKurYhAOwAHxllVPnOthb3vPfnF1Ehjw=", + "dep\tgithub.com/klauspost/cpuid/v2\tv2.3.0\th1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=", + "dep\tgithub.com/klauspost/crc32\tv1.3.0\th1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=", + "dep\tgithub.com/klauspost/filepathx\tv1.1.1\th1:201zvAsL1PhZvmXTP+QLer3AavWrO3U1NILWpniHK4w=", + "dep\tgithub.com/klauspost/pgzip\tv1.2.6\th1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=", + "dep\tgithub.com/klauspost/readahead\tv1.4.0\th1:w4hQ3BpdLjBnRQkZyNi+nwdHU7eGP9buTexWK9lU7gY=", + "dep\tgithub.com/klauspost/reedsolomon\tv1.13.3\th1:01GwnO2xoCSaM0ShP4qwl+FsHg3csFShC6Tu/RS1ji0=", + "dep\tgithub.com/kr/fs\tv0.1.0\th1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=", + "dep\tgithub.com/kylelemons/godebug\tv1.1.0\th1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=", + "dep\tgithub.com/lestrrat-go/blackmagic\tv1.0.4\th1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=", + "dep\tgithub.com/lestrrat-go/dsig\tv1.0.0\th1:OE09s2r9Z81kxzJYRn07TFM9XA4akrUdoMwr0L8xj38=", + "dep\tgithub.com/lestrrat-go/httpcc\tv1.0.1\th1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=", + "dep\tgithub.com/lestrrat-go/httprc/v3\tv3.0.1\th1:3n7Es68YYGZb2Jf+k//llA4FTZMl3yCwIjFIk4ubevI=", + "dep\tgithub.com/lestrrat-go/jwx/v3\tv3.0.12\th1:p25r68Y4KrbBdYjIsQweYxq794CtGCzcrc5dGzJIRjg=", + "dep\tgithub.com/lestrrat-go/option\tv1.0.1\th1:oAzP2fvZGQKWkvHa1/SAcFolBEca1oN+mQ7eooNBEYU=", + "dep\tgithub.com/lestrrat-go/option/v2\tv2.0.0\th1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=", + "dep\tgithub.com/lib/pq\tv1.10.9\th1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=", + "dep\tgithub.com/lithammer/shortuuid/v4\tv4.2.0\th1:LMFOzVB3996a7b8aBuEXxqOBflbfPQAiVzkIcHO0h8c=", + "dep\tgithub.com/lucasb-eyer/go-colorful\tv1.3.0\th1:2/yBRLdWBZKrf7gB40FoiKfAWYQ0lqNcbuQwVHXptag=", + "dep\tgithub.com/mattn/go-colorable\tv0.1.15\th1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=", + "dep\tgithub.com/mattn/go-ieproxy\tv0.0.12\th1:OZkUFJC3ESNZPQ+6LzC3VJIFSnreeFLQyqvBWtvfL2M=", + "dep\tgithub.com/mattn/go-isatty\tv0.0.24\th1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=", + "dep\tgithub.com/mattn/go-runewidth\tv0.0.21\th1:jJKAZiQH+2mIinzCJIaIG9Be1+0NR+5sz/lYEEjdM8w=", + "dep\tgithub.com/matttproud/golang_protobuf_extensions\tv1.0.4\th1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=", + "dep\tgithub.com/miekg/dns\tv1.1.72\th1:vhmr+TF2A3tuoGNkLDFK9zi36F2LS+hKTRW0Uf8kbzI=", + "dep\tgithub.com/minio/cli\tv1.24.2\th1:J+fCUh9mhPLjN3Lj/YhklXvxj8mnyE/D6FpFduXJ2jg=", + "dep\tgithub.com/minio/colorjson\tv1.0.8\th1:AS6gEQ1dTRYHmC4xuoodPDRILHP/9Wz5wYUGDQfPLpg=", + "dep\tgithub.com/minio/console\tv1.7.6", + "=>\tgithub.com/pgsty/silo-console\tv0.0.0-20260804042150-b952a1202869\th1:HLfc2ZdAycnI/bLl+TdsuckyzSWrwQarK38pS14yH/Q=", + "dep\tgithub.com/minio/crc64nvme\tv1.1.1\th1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=", + "dep\tgithub.com/minio/csvparser\tv1.0.0\th1:xJEHcYK8ZAjeW4hNV9Zu30u+/2o4UyPnYgyjWp8b7ZU=", + "dep\tgithub.com/minio/dnscache\tv0.1.1\th1:AMYLqomzskpORiUA1ciN9k7bZT1oB3YZN4cEIi88W5o=", + "dep\tgithub.com/minio/dperf\tv0.7.1\th1:eBwtaBBjuANwgUy1waWoS+wP+0i5fkXJOdGU2RXuDxo=", + "dep\tgithub.com/minio/filepath\tv1.0.0\th1:fvkJu1+6X+ECRA6G3+JJETj4QeAYO9sV43I79H8ubDY=", + "dep\tgithub.com/minio/highwayhash\tv1.0.4\th1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=", + "dep\tgithub.com/minio/kms-go/kes\tv0.3.1\th1:K3sPFAvFbJx33XlCTUBnQo8JRmSZyDvT6T2/MQ2iC3A=", + "dep\tgithub.com/minio/kms-go/kms\tv0.6.0\th1:oGdGUyjfCZwRIi7em0aj4wk+oOm7+4a0lzSZny7ZIDU=", + "dep\tgithub.com/minio/madmin-go/v3\tv3.0.110\th1:FIYekj7YPc430ffpXFWiUtyut3qBt/unIAcDzJn9H5M=", + "dep\tgithub.com/minio/mc\tv0.0.0-20251106162529-77f82e18b540", + "=>\tgithub.com/pgsty/mc\tv0.0.0-20260801042411-ad10a2a10b76\th1:UIlUuz0LQKw4QlAljhv7nPDDFC1+n+e0iED7rWZrgZ8=", + "dep\tgithub.com/minio/md5-simd\tv1.1.2\th1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=", + "dep\tgithub.com/minio/minio-go/v7\tv7.0.99\th1:2vH/byrwUkIpFQFOilvTfaUpvAX3fEFhEzO+DR3DlCE=", + "dep\tgithub.com/minio/mux\tv1.9.2\th1:dQchne49BUBgOlxIHjx5wVe1gl5VXF2sxd4YCXkikTw=", + "dep\tgithub.com/minio/pkg/v3\tv3.6.1", + "=>\tgithub.com/pgsty/silo-pkg/v3\tv3.11.0\th1:wjN5d+tWD8Twq+e7k/KBBVhnWXC8xTIlfTcnGIKkmjc=", + "dep\tgithub.com/minio/selfupdate\tv0.6.0\th1:i76PgT0K5xO9+hjzKcacQtO7+MjJ4JKA8Ak8XQ9DDwU=", + "dep\tgithub.com/minio/simdjson-go\tv0.4.5\th1:r4IQwjRGmWCQ2VeMc7fGiilu1z5du0gJ/I/FsKwgo5A=", + "dep\tgithub.com/minio/sio\tv0.4.3\th1:JqyID1XM86KwBZox5RAdLD4MLPIDoCY2cke2CXCJCkg=", + "dep\tgithub.com/minio/websocket\tv1.6.0\th1:CPvnQvNvlVaQmvw5gtJNyYQhg4+xRmrPNhBbv8BdpAE=", + "dep\tgithub.com/minio/xxml\tv0.0.3\th1:ZIpPQpfyG5uZQnqqC0LZuWtPk/WT8G/qkxvO6jb7zMU=", + "dep\tgithub.com/minio/zipindex\tv0.5.0\th1:QydEWJW+uAFMd5xmQa580bm7JtC5krpuAtARXIQr72U=", + "dep\tgithub.com/mitchellh/go-homedir\tv1.1.0\th1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=", + "dep\tgithub.com/modern-go/concurrent\tv0.0.0-20180306012644-bacd9c7ef1dd\th1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=", + "dep\tgithub.com/modern-go/reflect2\tv1.0.3-0.20250322232337-35a7c28c31ee\th1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=", + "dep\tgithub.com/muesli/ansi\tv0.0.0-20230316100256-276c6243b2f6\th1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=", + "dep\tgithub.com/muesli/cancelreader\tv0.2.2\th1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=", + "dep\tgithub.com/muesli/reflow\tv0.3.0\th1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=", + "dep\tgithub.com/muesli/termenv\tv0.16.0\th1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=", + "dep\tgithub.com/munnerz/goautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=", + "dep\tgithub.com/nats-io/nats.go\tv1.49.0\th1:yh/WvY59gXqYpgl33ZI+XoVPKyut/IcEaqtsiuTJpoE=", + "dep\tgithub.com/nats-io/nkeys\tv0.4.15\th1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=", + "dep\tgithub.com/nats-io/nuid\tv1.0.1\th1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=", + "dep\tgithub.com/nats-io/stan.go\tv0.10.4\th1:19GS/eD1SeQJaVkeM9EkvEYattnvnWrZ3wkSWSw4uXw=", + "dep\tgithub.com/ncw/directio\tv1.0.5\th1:JSUBhdjEvVaJvOoyPAbcW0fnd0tvRXD76wEfZ1KcQz4=", + "dep\tgithub.com/nsqio/go-nsq\tv1.1.0\th1:PQg+xxiUjA7V+TLdXw7nVrJ5Jbl3sN86EhGCQj4+FYE=", + "dep\tgithub.com/oklog/ulid/v2\tv2.1.1\th1:suPZ4ARWLOJLegGFiZZ1dFAkqzhMjL3J1TzI+5wHz8s=", + "dep\tgithub.com/olekukonko/tablewriter\tv0.0.5\th1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=", + "dep\tgithub.com/philhofer/fwd\tv1.2.0\th1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=", + "dep\tgithub.com/pierrec/lz4/v4\tv4.1.26\th1:GrpZw1gZttORinvzBdXPUXATeqlJjqUG/D87TKMnhjY=", + "dep\tgithub.com/pkg/browser\tv0.0.0-20240102092130-5ac0b6a4141c\th1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=", + "dep\tgithub.com/pkg/errors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=", + "dep\tgithub.com/pkg/sftp\tv1.13.10\th1:+5FbKNTe5Z9aspU88DPIKJ9z2KZoaGCu6Sr6kKR/5mU=", + "dep\tgithub.com/pkg/xattr\tv0.4.12\th1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=", + "dep\tgithub.com/posener/complete\tv1.2.3\th1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=", + "dep\tgithub.com/prometheus/client_golang\tv1.23.2\th1:Je96obch5RDVy3FDMndoUsjAhG5Edi49h0RJWRi/o0o=", + "dep\tgithub.com/prometheus/client_model\tv0.6.2\th1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=", + "dep\tgithub.com/prometheus/common\tv0.67.5\th1:pIgK94WWlQt1WLwAC5j2ynLaBRDiinoAb86HZHTUGI4=", + "dep\tgithub.com/prometheus/procfs\tv0.20.1\th1:XwbrGOIplXW/AU3YhIhLODXMJYyC1isLFfYCsTEycfc=", + "dep\tgithub.com/prometheus/prom2json\tv1.5.0\th1:WIcAOjLE1x476W3dUlmTL6E/e98CgVGuwwYusl6MPP8=", + "dep\tgithub.com/prometheus/prometheus\tv0.311.3\th1:3IrVxQv6v5i/ZCGi6OrYeBhtCwaPTn6Z3DYruXoYm3M=", + "dep\tgithub.com/puzpuzpuz/xsync/v3\tv3.5.1\th1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=", + "dep\tgithub.com/rabbitmq/amqp091-go\tv1.10.0\th1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=", + "dep\tgithub.com/rcrowley/go-metrics\tv0.0.0-20250401214520-65e299d6c5c9\th1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=", + "dep\tgithub.com/rivo/uniseg\tv0.4.7\th1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=", + "dep\tgithub.com/rjeczalik/notify\tv0.9.3\th1:6rJAzHTGKXGj76sbRgDiDcYj/HniypXmSJo1SWakZeY=", + "dep\tgithub.com/rs/cors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=", + "dep\tgithub.com/rs/xid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=", + "dep\tgithub.com/safchain/ethtool\tv0.7.0\th1:rlJzfDetsVvT61uz8x1YIcFn12akMfuPulHtZjtb7Is=", + "dep\tgithub.com/secure-io/sio-go\tv0.3.1\th1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rRc=", + "dep\tgithub.com/shirou/gopsutil/v3\tv3.24.5\th1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=", + "dep\tgithub.com/spiffe/go-spiffe/v2\tv2.6.0\th1:l+DolpxNWYgruGQVV0xsfeya3CsC7m8iBzDnMpsbLuo=", + "dep\tgithub.com/tidwall/gjson\tv1.18.0\th1:FIDeeyB800efLX89e5a8Y0BNH+LOngJyGrIWxG2FKQY=", + "dep\tgithub.com/tidwall/match\tv1.2.0\th1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=", + "dep\tgithub.com/tidwall/pretty\tv1.2.1\th1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=", + "dep\tgithub.com/tinylib/msgp\tv1.6.4\th1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=", + "dep\tgithub.com/tklauser/go-sysconf\tv0.3.16\th1:frioLaCQSsF5Cy1jgRBrzr6t502KIIwQ0MArYICU0nA=", + "dep\tgithub.com/tklauser/numcpus\tv0.11.0\th1:nSTwhKH5e1dMNsCdVBukSZrURJRoHbSEQjdEbY+9RXw=", + "dep\tgithub.com/unrolled/secure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=", + "dep\tgithub.com/valyala/bytebufferpool\tv1.0.0\th1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=", + "dep\tgithub.com/valyala/fastjson\tv1.6.4\th1:uAUNq9Z6ymTgGhcm0UynUAB6tlbakBrz6CQFax3BXVQ=", + "dep\tgithub.com/vbauerster/mpb/v8\tv8.12.0\th1:+gneY3ifzc88tKDzOtfG8k8gfngCx615S2ZmFM4liWg=", + "dep\tgithub.com/xdg/scram\tv1.0.5\th1:TuS0RFmt5Is5qm9Tm2SoD89OPqe4IRiFtyFY4iwWXsw=", + "dep\tgithub.com/xdg/stringprep\tv1.0.3\th1:cmL5Enob4W83ti/ZHuZLuKD/xqJfus4fVPwE+/BDm+4=", + "dep\tgithub.com/xo/terminfo\tv0.0.0-20220910002029-abceb7e1c41e\th1:JVG44RsyaB9T2KIHavMF/ppJZNG9ZpyihvCd0w101no=", + "dep\tgithub.com/zeebo/xxh3\tv1.1.0\th1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=", + "dep\tgo.etcd.io/etcd/api/v3\tv3.6.9\th1:UA7iKfEW1AzgihcBSGXci2kDGQiokSq41F9HMCI/RTI=", + "dep\tgo.etcd.io/etcd/client/pkg/v3\tv3.6.9\th1:T8nuk8Lz64C+Hzb0coBFLMSlVSQZBpAtFk46swdM1DA=", + "dep\tgo.etcd.io/etcd/client/v3\tv3.6.9\th1:3X555hQXmhRr27O37wls53g68CpUiPOiHXrZfz2Al+o=", + "dep\tgo.opentelemetry.io/auto/sdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=", + "dep\tgo.opentelemetry.io/contrib/detectors/gcp\tv1.43.0\th1:62yY3dT7/ShwOxzA0RsKRgshBmfElKI4d/Myu2OxDFU=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc\tv0.67.0\th1:yI1/OhfEPy7J9eoa6Sj051C7n5dvpj0QX8g4sRchg04=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/net/http/otelhttp\tv0.69.0\th1:8tvICD4vSTOOsNrsI4Ljf6C+6UKvpTEH5XY3JMoyPoo=", + "dep\tgo.opentelemetry.io/otel\tv1.44.0\th1:JjwHmHpA4iZ3wBxluu2fbbE7j4kqlE8jXyAyPXH7HqU=", + "dep\tgo.opentelemetry.io/otel/metric\tv1.44.0\th1:1w0gILTcHdr3YI+ixLyjemwrVnsMURbTZFrSYCdDdmc=", + "dep\tgo.opentelemetry.io/otel/sdk\tv1.44.0\th1:nHYwb9lK+fJPU/dnT6s7W7Z8itMWyqrnVfbheVYrZ58=", + "dep\tgo.opentelemetry.io/otel/sdk/metric\tv1.44.0\th1:3LlKgI+VjbVsjNRFZJZAJ30WjXC5VkNRks6si09iEfI=", + "dep\tgo.opentelemetry.io/otel/trace\tv1.44.0\th1:jxF5CsGYCe74MCRx2X4g7WsY/VBKRqqpNvXlX/6gtIk=", + "dep\tgo.uber.org/atomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=", + "dep\tgo.uber.org/multierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=", + "dep\tgo.uber.org/zap\tv1.28.0\th1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=", + "dep\tgo.yaml.in/yaml/v2\tv2.4.4\th1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=", + "dep\tgo.yaml.in/yaml/v3\tv3.0.5\th1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=", + "dep\tgoftp.io/server/v2\tv2.0.2\th1:tkZpqyXys+vC15W5yGMi8Kzmbv1QSgeKr8qJXBnJbm8=", + "dep\tgolang.org/x/crypto\tv0.54.0\th1:YLIA59K4fiNzHzjnZt2tUJQjQtUWfWbeHBqKtk3eScw=", + "dep\tgolang.org/x/net\tv0.57.0\th1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=", + "dep\tgolang.org/x/oauth2\tv0.36.0\th1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=", + "dep\tgolang.org/x/sync\tv0.22.0\th1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=", + "dep\tgolang.org/x/sys\tv0.47.0\th1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=", + "dep\tgolang.org/x/term\tv0.45.0\th1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=", + "dep\tgolang.org/x/text\tv0.40.0\th1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=", + "dep\tgolang.org/x/time\tv0.15.0\th1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=", + "dep\tgoogle.golang.org/api\tv0.278.0\th1:W7jiRvRi53VYFfZ/HoZjQBtJk7gOFbHD8ot1RzVZU6E=", + "dep\tgoogle.golang.org/genproto\tv0.0.0-20260319201613-d00831a3d3e7\th1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=", + "dep\tgoogle.golang.org/genproto/googleapis/api\tv0.0.0-20260526163538-3dc84a4a5aaa\th1:Kjn0N0tCrDgiAFW+lGO4JZ3ck44CehvJQMAwj9QF0G8=", + "dep\tgoogle.golang.org/genproto/googleapis/rpc\tv0.0.0-20260526163538-3dc84a4a5aaa\th1:mZHHdPZl0dbGHCflZgAq/Q468DWVFcU2whhB2KAo8fk=", + "dep\tgoogle.golang.org/grpc\tv1.82.1\th1:NnAxzGRA0677vCa4BUkOAnO5+FfQqVl9iUXeD0IqcGE=", + "dep\tgoogle.golang.org/protobuf\tv1.36.11\th1:fV6ZwhNocDyBLK0dj+fg8ektcVegBBuEolpbTQyBNVE=", + "dep\tgopkg.in/yaml.v2\tv2.4.0\th1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=" + ], + "build_settings": [ + "build\t-buildmode=exe", + "build\t-compiler=gc", + "build\t-tags=kqueue", + "build\tDefaultGODEBUG=tracebacklabels=0,x509sslcertoverrideplatform=0", + "build\tCGO_ENABLED=0", + "build\tGOARCH=arm64", + "build\tGOOS=linux", + "build\tGOARM64=v8.0" + ], + "patched": false, + "dependency_graph_sha256": "692c41d253e666fea024ec976b9d2728552bb58f75cdafe05ddb47dc15d4bad8" + }, + { + "binary": "head-go127", + "commit": "d1105bbb3d4a0afa33b3a4ac11b821235038ed0e", + "go": "go1.27.1", + "sha256": "55d2f2d73d5db4b449f7b4e037e8083acb3f26235e2df36114c50265b219ce1b", + "go_mod_sha256": "f8182f00d130b89bd794041cb804ac3255ce7b035c0b73f8e6ca7094d6ea4035", + "go_sum_sha256": "6913c1a5d63af9f1cc4b21205bf45a98bd3f53855e4aa49dd3eccac06cd6ef19", + "dependencies": [ + "dep\taead.dev/mem\tv0.2.0\th1:ufgkESS9+lHV/GUjxgc2ObF43FLZGSemh+W+y27QFMI=", + "dep\taead.dev/minisign\tv0.3.0\th1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA=", + "dep\taead.dev/mtls\tv0.3.0\th1:a+C0t15Y9SRX6qP1EqmQFZ4ZSMm88TPvNDymasu4ahQ=", + "dep\tcel.dev/expr\tv0.25.2\th1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=", + "dep\tcloud.google.com/go\tv0.123.0\th1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=", + "dep\tcloud.google.com/go/auth\tv0.20.0\th1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=", + "dep\tcloud.google.com/go/auth/oauth2adapt\tv0.2.8\th1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=", + "dep\tcloud.google.com/go/compute/metadata\tv0.9.0\th1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=", + "dep\tcloud.google.com/go/iam\tv1.5.3\th1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=", + "dep\tcloud.google.com/go/monitoring\tv1.24.3\th1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=", + "dep\tcloud.google.com/go/storage\tv1.61.3\th1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=", + "dep\tfilippo.io/edwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azcore\tv1.22.0\th1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azidentity\tv1.14.0\th1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/internal\tv1.12.0\th1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/storage/azblob\tv1.6.4\th1:jWQK1GI+LeGGUKBADtcH2rRqPxYB1Ljwms5gFA2LqrM=", + "dep\tgithub.com/Azure/go-ntlmssp\tv0.1.1\th1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=", + "dep\tgithub.com/AzureAD/microsoft-authentication-library-for-go\tv1.7.2\th1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp\tv1.33.0\th1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric\tv0.55.0\th1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping\tv0.55.0\th1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=", + "dep\tgithub.com/IBM/sarama\tv1.45.1\th1:nY30XqYpqyXOXSNoe2XCgjj9jklGM1Ye94ierUb1jQ0=", + "dep\tgithub.com/VividCortex/ewma\tv1.2.0\th1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=", + "dep\tgithub.com/acarl005/stripansi\tv0.0.0-20180116102854-5a71ef0e047d\th1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=", + "dep\tgithub.com/alecthomas/participle\tv0.7.1\th1:2bN7reTw//5f0cugJcTOnY/NYZcWQOaajW+BwZB5xWs=", + "dep\tgithub.com/apache/thrift\tv0.24.0\th1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=", + "dep\tgithub.com/aymanbagabas/go-osc52/v2\tv2.0.1\th1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=", + "dep\tgithub.com/beevik/ntp\tv1.5.0\th1:y+uj/JjNwlY2JahivxYvtmv4ehfi3h74fAuABB9ZSM4=", + "dep\tgithub.com/beorn7/perks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=", + "dep\tgithub.com/buger/jsonparser\tv1.1.2\th1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=", + "dep\tgithub.com/cespare/xxhash/v2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=", + "dep\tgithub.com/charmbracelet/bubbles\tv1.0.0\th1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=", + "dep\tgithub.com/charmbracelet/bubbletea\tv1.3.10\th1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=", + "dep\tgithub.com/charmbracelet/colorprofile\tv0.4.3\th1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=", + "dep\tgithub.com/charmbracelet/harmonica\tv0.2.0\th1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=", + "dep\tgithub.com/charmbracelet/lipgloss\tv1.1.0\th1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=", + "dep\tgithub.com/charmbracelet/x/ansi\tv0.11.8\th1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=", + "dep\tgithub.com/charmbracelet/x/cellbuf\tv0.0.15\th1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=", + "dep\tgithub.com/charmbracelet/x/term\tv0.2.2\th1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=", + "dep\tgithub.com/cheggaaa/pb\tv1.0.30\th1:NylhgqJfXx3JVBGx6ywsXuhpz8caSMPmLArXyAv1bwU=", + "dep\tgithub.com/clipperhouse/displaywidth\tv0.11.0\th1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=", + "dep\tgithub.com/clipperhouse/uax29/v2\tv2.7.0\th1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=", + "dep\tgithub.com/cncf/xds/go\tv0.0.0-20260202195803-dba9d589def2\th1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=", + "dep\tgithub.com/coreos/go-oidc/v3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=", + "dep\tgithub.com/coreos/go-semver\tv0.3.1\th1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=", + "dep\tgithub.com/coreos/go-systemd/v22\tv22.7.0", + "=>\tgithub.com/coreos/go-systemd/v22\tv22.6.0\th1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=", + "dep\tgithub.com/cosnicolaou/pbzip2\tv1.0.6\th1:FYF6b2j4X4q3hZezd2AoUN/emLCtH/MbDGwJjiOacak=", + "dep\tgithub.com/davecgh/go-spew\tv1.1.2-0.20180830191138-d8f796af33cc\th1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=", + "dep\tgithub.com/dchest/siphash\tv1.2.3\th1:QXwFc8cFOR2dSa/gE6o/HokBMWtLUaNDVd+22aKHeEA=", + "dep\tgithub.com/docker/go-units\tv0.5.0\th1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=", + "dep\tgithub.com/dustin/go-humanize\tv1.0.1\th1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=", + "dep\tgithub.com/eapache/go-resiliency\tv1.7.0\th1:n3NRTnBn5N0Cbi/IeOHuQn9s2UwVUH7Ga0ZWcP+9JTA=", + "dep\tgithub.com/eapache/go-xerial-snappy\tv0.0.0-20230731223053-c322873962e3\th1:Oy0F4ALJ04o5Qqpdz8XLIpNA3WM/iSIXqxtqo7UGVws=", + "dep\tgithub.com/eapache/queue\tv1.1.0\th1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=", + "dep\tgithub.com/eclipse/paho.mqtt.golang\tv1.5.1\th1:/VSOv3oDLlpqR2Epjn1Q7b2bSTplJIeV2ISgCl2W7nE=", + "dep\tgithub.com/elastic/go-elasticsearch/v7\tv7.17.10\th1:TCQ8i4PmIJuBunvBS6bwT2ybzVFxxUhhltAs3Gyu1yo=", + "dep\tgithub.com/envoyproxy/go-control-plane/envoy\tv1.37.0\th1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=", + "dep\tgithub.com/envoyproxy/protoc-gen-validate\tv1.3.3\th1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=", + "dep\tgithub.com/fatih/color\tv1.19.0\th1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=", + "dep\tgithub.com/fatih/structs\tv1.1.0\th1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=", + "dep\tgithub.com/felixge/fgprof\tv0.9.5\th1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=", + "dep\tgithub.com/felixge/httpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=", + "dep\tgithub.com/fraugster/parquet-go\tv0.12.0\th1:1slnC5y2VWEOUSlzbeXatM0BvSWcLUDsR/EcZsXXCZc=", + "dep\tgithub.com/go-asn1-ber/asn1-ber\tv1.5.8\th1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=", + "dep\tgithub.com/go-jose/go-jose/v4\tv4.1.4\th1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=", + "dep\tgithub.com/go-ldap/ldap/v3\tv3.4.14\th1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=", + "dep\tgithub.com/go-logr/logr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=", + "dep\tgithub.com/go-logr/stdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=", + "dep\tgithub.com/go-openapi/analysis\tv0.26.2\th1:Q6wOwXW8mcVAkpDFMshj/F4PlK2Fx86tmLJjZW4vyEs=", + "dep\tgithub.com/go-openapi/errors\tv0.22.8\th1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRejk/I=", + "dep\tgithub.com/go-openapi/jsonpointer\tv1.0.0\th1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=", + "dep\tgithub.com/go-openapi/jsonreference\tv1.0.1\th1:4zJ7AmYDKNmD3aSpfPnFNCFA5E80/xMHUNKgydaLh38=", + "dep\tgithub.com/go-openapi/loads\tv0.25.2\th1:+uNsDlRQfYtZTrh+3pdwampcAqZVPuBJW0IA82aZHII=", + "dep\tgithub.com/go-openapi/runtime\tv0.33.1\th1:jCvhI+wAdsn29byy+RgcPcg+j39YT6E304QOE/WqIVk=", + "dep\tgithub.com/go-openapi/runtime/server-middleware\tv0.33.1\th1:IAeKbwWnBnpsYTpuPVS8t73ZrPpKvRZnK2iJ2KJGUV0=", + "dep\tgithub.com/go-openapi/spec\tv1.0.0\th1:JtB/GHOj+eetjse6YvxqLze88oEekl/4uPBethvzRrA=", + "dep\tgithub.com/go-openapi/strfmt\tv0.27.0\th1:kbcTeaD9TXuXD0hhMXzuYa1sdTo6+dWGvwjW93E80IM=", + "dep\tgithub.com/go-openapi/swag\tv0.29.1\th1:C6EeWzUwQtcWEhE9eqBdUubGXxhWY4PlzHMLD7kLaiQ=", + "dep\tgithub.com/go-openapi/swag/cmdutils\tv0.29.1\th1:3DorPGfUdE80BogKY22EzoHBcHMrkVomZMoV7kS4ANY=", + "dep\tgithub.com/go-openapi/swag/conv\tv0.29.1\th1:AC4Eh/5c/eUDOUCzzsRC9ghmFgOSBHeRMGIngY0ZUGA=", + "dep\tgithub.com/go-openapi/swag/fileutils\tv0.29.1\th1:ZcPzMceVhU1WPbK6N1G6sNQKdd1CWJlf3cA08UHuoM0=", + "dep\tgithub.com/go-openapi/swag/jsonutils\tv0.29.1\th1:AFCxs0eQZ24/QyfhVHM2t49rMz7Vv3XCsZQI6yrNy+c=", + "dep\tgithub.com/go-openapi/swag/loading\tv0.29.1\th1:FCv5fG8UhTdDJa2R7w+5O9Ekpcbw7tt0nFWvmDKGBjc=", + "dep\tgithub.com/go-openapi/swag/mangling\tv0.29.1\th1:lHALtvYCdxVnRl4GrHmFPwfBTZYIObqdGNSKyu/8D6I=", + "dep\tgithub.com/go-openapi/swag/netutils\tv0.29.1\th1:IjIvdEP5duKcghFqJEPSUraRnkKYHoM65kTluTu+Jb4=", + "dep\tgithub.com/go-openapi/swag/pools\tv0.29.1\th1:NRogYxdEW9SjRM4mkAOji9iefO4MRXq3p/ZJcoQbUKg=", + "dep\tgithub.com/go-openapi/swag/stringutils\tv0.29.1\th1:1ykunK7iJQk1uOO7+oUH1ukbsK85fFCOiCFMOVSY+F0=", + "dep\tgithub.com/go-openapi/swag/typeutils\tv0.29.1\th1:Nzv9nhnlLCRBPQqfOX+7lB6Guju370or8StT+lIOf6M=", + "dep\tgithub.com/go-openapi/swag/yamlutils\tv0.29.1\th1:69w3tsBajm7MR/fejLy7HD/3J68Ys1SeeZMEzZ3w2sk=", + "dep\tgithub.com/go-openapi/validate\tv0.26.5\th1:Vm02dSmhevDx/4v4m8KAtMwffHGfq9wRLqICeebE/D4=", + "dep\tgithub.com/go-sql-driver/mysql\tv1.9.3\th1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=", + "dep\tgithub.com/go-viper/mapstructure/v2\tv2.5.0\th1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=", + "dep\tgithub.com/gobwas/httphead\tv0.1.0\th1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=", + "dep\tgithub.com/gobwas/pool\tv0.2.1\th1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=", + "dep\tgithub.com/gobwas/ws\tv1.4.0\th1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=", + "dep\tgithub.com/gogo/protobuf\tv1.3.2\th1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=", + "dep\tgithub.com/golang-jwt/jwt/v4\tv4.5.2\th1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=", + "dep\tgithub.com/golang-jwt/jwt/v5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=", + "dep\tgithub.com/golang/protobuf\tv1.5.4\th1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=", + "dep\tgithub.com/golang/snappy\tv1.0.0\th1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=", + "dep\tgithub.com/gomodule/redigo\tv1.9.3\th1:dNPSXeXv6HCq2jdyWfjgmhBdqnR6PRO3m/G05nvpPC8=", + "dep\tgithub.com/google/pprof\tv0.0.0-20260709232956-b9395ee17fa0\th1:du0WGc8xSKq/++e0cglxhS/mXVqsR7+c7jLEi5Vqduw=", + "dep\tgithub.com/google/s2a-go\tv0.1.9\th1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=", + "dep\tgithub.com/google/shlex\tv0.0.0-20191202100458-e7afc7fbc510\th1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=", + "dep\tgithub.com/google/uuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=", + "dep\tgithub.com/googleapis/enterprise-certificate-proxy\tv0.3.18\th1:hvVi34VucdrV1IIsiWuqYM8kutw/92MxNEFxCJZEh0k=", + "dep\tgithub.com/googleapis/gax-go/v2\tv2.23.0\th1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=", + "dep\tgithub.com/gorilla/websocket\tv1.5.4-0.20250319132907-e064f32e3674\th1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=", + "dep\tgithub.com/grafana/regexp\tv0.0.0-20250905093917-f7b3be9d1853\th1:cLN4IBkmkYZNnk7EAJ0BHIethd+J6LqxFNw5mSiI2bM=", + "dep\tgithub.com/grpc-ecosystem/grpc-gateway/v2\tv2.30.0\th1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=", + "dep\tgithub.com/hashicorp/errwrap\tv1.1.0\th1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=", + "dep\tgithub.com/hashicorp/go-multierror\tv1.1.1\th1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=", + "dep\tgithub.com/hashicorp/go-uuid\tv1.0.3\th1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=", + "dep\tgithub.com/inconshreveable/mousetrap\tv1.1.0\th1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=", + "dep\tgithub.com/jcmturner/aescts/v2\tv2.0.0\th1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=", + "dep\tgithub.com/jcmturner/dnsutils/v2\tv2.0.0\th1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=", + "dep\tgithub.com/jcmturner/gofork\tv1.7.6\th1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=", + "dep\tgithub.com/jcmturner/gokrb5/v8\tv8.4.4\th1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=", + "dep\tgithub.com/jcmturner/rpc/v2\tv2.0.3\th1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=", + "dep\tgithub.com/jedib0t/go-pretty/v6\tv6.8.3\th1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFlmffSQ=", + "dep\tgithub.com/jessevdk/go-flags\tv1.6.1\th1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=", + "dep\tgithub.com/json-iterator/go\tv1.1.12\th1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=", + "dep\tgithub.com/juju/ratelimit\tv1.0.2\th1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=", + "dep\tgithub.com/klauspost/compress\tv1.20.0\th1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=", + "dep\tgithub.com/klauspost/cpuid/v2\tv2.4.0\th1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=", + "dep\tgithub.com/klauspost/crc32\tv1.3.0\th1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=", + "dep\tgithub.com/klauspost/filepathx\tv1.1.1\th1:201zvAsL1PhZvmXTP+QLer3AavWrO3U1NILWpniHK4w=", + "dep\tgithub.com/klauspost/pgzip\tv1.2.6\th1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=", + "dep\tgithub.com/klauspost/readahead\tv1.4.0\th1:w4hQ3BpdLjBnRQkZyNi+nwdHU7eGP9buTexWK9lU7gY=", + "dep\tgithub.com/klauspost/reedsolomon\tv1.13.3\th1:01GwnO2xoCSaM0ShP4qwl+FsHg3csFShC6Tu/RS1ji0=", + "dep\tgithub.com/kr/fs\tv0.1.0\th1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=", + "dep\tgithub.com/kylelemons/godebug\tv1.1.0\th1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=", + "dep\tgithub.com/lestrrat-go/blackmagic\tv1.0.4\th1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=", + "dep\tgithub.com/lestrrat-go/dsig\tv1.4.0\th1:g7LUjK8cT74A5DzBXJI5HzsJuLhoYN0Wzj4nuOMIrH8=", + "dep\tgithub.com/lestrrat-go/httpcc\tv1.0.1\th1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=", + "dep\tgithub.com/lestrrat-go/httprc/v3\tv3.0.6\th1:4FpLQ18KK/ypPbVU3NLWJNRvH3kcYiqKqWfKGqNWxxI=", + "dep\tgithub.com/lestrrat-go/jwx/v3\tv3.2.0\th1:Jb3zBASTSZXz7gzzSAfYqxXF8KejvKC4xWoePLQqXCA=", + "dep\tgithub.com/lestrrat-go/option/v2\tv2.0.0\th1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=", + "dep\tgithub.com/lib/pq\tv1.10.9\th1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=", + "dep\tgithub.com/lithammer/shortuuid/v4\tv4.2.0\th1:LMFOzVB3996a7b8aBuEXxqOBflbfPQAiVzkIcHO0h8c=", + "dep\tgithub.com/lucasb-eyer/go-colorful\tv1.4.1\th1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=", + "dep\tgithub.com/mattn/go-colorable\tv0.1.15\th1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=", + "dep\tgithub.com/mattn/go-ieproxy\tv0.0.12\th1:OZkUFJC3ESNZPQ+6LzC3VJIFSnreeFLQyqvBWtvfL2M=", + "dep\tgithub.com/mattn/go-isatty\tv0.0.24\th1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=", + "dep\tgithub.com/mattn/go-runewidth\tv0.0.29\th1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ=", + "dep\tgithub.com/matttproud/golang_protobuf_extensions\tv1.0.4\th1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=", + "dep\tgithub.com/miekg/dns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=", + "dep\tgithub.com/minio/cli\tv1.24.2\th1:J+fCUh9mhPLjN3Lj/YhklXvxj8mnyE/D6FpFduXJ2jg=", + "dep\tgithub.com/minio/colorjson\tv1.0.8\th1:AS6gEQ1dTRYHmC4xuoodPDRILHP/9Wz5wYUGDQfPLpg=", + "dep\tgithub.com/minio/console\tv1.7.6", + "=>\tgithub.com/pgsty/silo-console\tv0.0.0-20260908142700-c103d08ec36a\th1:aHLqQ7INozqGLEOB1tr+n/eKgrBhlQ20fHyLmeNu+ao=", + "dep\tgithub.com/minio/crc64nvme\tv1.1.1\th1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=", + "dep\tgithub.com/minio/csvparser\tv1.0.0\th1:xJEHcYK8ZAjeW4hNV9Zu30u+/2o4UyPnYgyjWp8b7ZU=", + "dep\tgithub.com/minio/dnscache\tv0.1.1\th1:AMYLqomzskpORiUA1ciN9k7bZT1oB3YZN4cEIi88W5o=", + "dep\tgithub.com/minio/dperf\tv0.7.1\th1:eBwtaBBjuANwgUy1waWoS+wP+0i5fkXJOdGU2RXuDxo=", + "dep\tgithub.com/minio/filepath\tv1.0.0\th1:fvkJu1+6X+ECRA6G3+JJETj4QeAYO9sV43I79H8ubDY=", + "dep\tgithub.com/minio/highwayhash\tv1.0.4\th1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=", + "dep\tgithub.com/minio/kms-go/kes\tv0.3.1\th1:K3sPFAvFbJx33XlCTUBnQo8JRmSZyDvT6T2/MQ2iC3A=", + "dep\tgithub.com/minio/kms-go/kms\tv0.6.0\th1:oGdGUyjfCZwRIi7em0aj4wk+oOm7+4a0lzSZny7ZIDU=", + "dep\tgithub.com/minio/madmin-go/v3\tv3.0.110\th1:FIYekj7YPc430ffpXFWiUtyut3qBt/unIAcDzJn9H5M=", + "dep\tgithub.com/minio/mc\tv0.0.0-20251106162529-77f82e18b540", + "=>\tgithub.com/pgsty/mc\tv0.0.0-20260909015522-fcd5cad8247f\th1:JiL/FcsGMsAhA+Iv+0Jzk9VnEAVVv4HUNbR0cGf+/CE=", + "dep\tgithub.com/minio/md5-simd\tv1.1.2\th1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=", + "dep\tgithub.com/minio/minio-go/v7\tv7.3.1-0.20260828014306-0e78d3f18efe\th1:By2FKNSOUGLOeb0x4D7xJMHr8x/X1ZW8PG780SpKUwQ=", + "dep\tgithub.com/minio/mux\tv1.10.1\th1:grrK8SwRKbkNFE6qG7WAvFGH09bB46d5teOOtKfQ14s=", + "dep\tgithub.com/minio/pkg/v3\tv3.6.1\th1:gaNT80BS/iuIany5ylTkVmfN4s6UYY30OtImFv4GQA8=", + "dep\tgithub.com/minio/selfupdate\tv0.6.0\th1:i76PgT0K5xO9+hjzKcacQtO7+MjJ4JKA8Ak8XQ9DDwU=", + "dep\tgithub.com/minio/simdjson-go\tv0.4.5\th1:r4IQwjRGmWCQ2VeMc7fGiilu1z5du0gJ/I/FsKwgo5A=", + "dep\tgithub.com/minio/sio\tv0.4.3\th1:JqyID1XM86KwBZox5RAdLD4MLPIDoCY2cke2CXCJCkg=", + "dep\tgithub.com/minio/websocket\tv1.6.0\th1:CPvnQvNvlVaQmvw5gtJNyYQhg4+xRmrPNhBbv8BdpAE=", + "dep\tgithub.com/minio/xxml\tv0.0.3\th1:ZIpPQpfyG5uZQnqqC0LZuWtPk/WT8G/qkxvO6jb7zMU=", + "dep\tgithub.com/minio/zipindex\tv0.5.0\th1:QydEWJW+uAFMd5xmQa580bm7JtC5krpuAtARXIQr72U=", + "dep\tgithub.com/mitchellh/go-homedir\tv1.1.0\th1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=", + "dep\tgithub.com/modern-go/concurrent\tv0.0.0-20180306012644-bacd9c7ef1dd\th1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=", + "dep\tgithub.com/modern-go/reflect2\tv1.0.3-0.20250322232337-35a7c28c31ee\th1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=", + "dep\tgithub.com/muesli/ansi\tv0.0.0-20230316100256-276c6243b2f6\th1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=", + "dep\tgithub.com/muesli/cancelreader\tv0.2.2\th1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=", + "dep\tgithub.com/muesli/reflow\tv0.3.0\th1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=", + "dep\tgithub.com/muesli/termenv\tv0.16.0\th1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=", + "dep\tgithub.com/munnerz/goautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=", + "dep\tgithub.com/nats-io/nats.go\tv1.49.0\th1:yh/WvY59gXqYpgl33ZI+XoVPKyut/IcEaqtsiuTJpoE=", + "dep\tgithub.com/nats-io/nkeys\tv0.4.15\th1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=", + "dep\tgithub.com/nats-io/nuid\tv1.0.1\th1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=", + "dep\tgithub.com/nats-io/stan.go\tv0.10.4\th1:19GS/eD1SeQJaVkeM9EkvEYattnvnWrZ3wkSWSw4uXw=", + "dep\tgithub.com/ncw/directio\tv1.0.5\th1:JSUBhdjEvVaJvOoyPAbcW0fnd0tvRXD76wEfZ1KcQz4=", + "dep\tgithub.com/nsqio/go-nsq\tv1.1.0\th1:PQg+xxiUjA7V+TLdXw7nVrJ5Jbl3sN86EhGCQj4+FYE=", + "dep\tgithub.com/oklog/ulid/v2\tv2.1.2\th1:IEclFb9JNvzYA6MW2SCxbLzcHTVsfqm3PrqGQJH5zec=", + "dep\tgithub.com/olekukonko/tablewriter\tv0.0.5\th1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=", + "dep\tgithub.com/pgsty/silo-pkg/v3\tv3.13.3\th1:d2xYTn4LXoWIAIjBlW/17wtA/Ut1ap29t+1ww4TFa8o=", + "dep\tgithub.com/philhofer/fwd\tv1.2.0\th1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=", + "dep\tgithub.com/pierrec/lz4/v4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=", + "dep\tgithub.com/pkg/browser\tv0.0.0-20240102092130-5ac0b6a4141c\th1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=", + "dep\tgithub.com/pkg/errors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=", + "dep\tgithub.com/pkg/sftp\tv1.13.11\th1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=", + "dep\tgithub.com/pkg/xattr\tv0.4.12\th1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=", + "dep\tgithub.com/posener/complete\tv1.2.3\th1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=", + "dep\tgithub.com/prometheus/client_golang\tv1.24.1\th1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=", + "dep\tgithub.com/prometheus/client_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=", + "dep\tgithub.com/prometheus/common\tv0.71.0\th1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=", + "dep\tgithub.com/prometheus/procfs\tv0.22.0\th1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=", + "dep\tgithub.com/prometheus/prom2json\tv1.5.0\th1:WIcAOjLE1x476W3dUlmTL6E/e98CgVGuwwYusl6MPP8=", + "dep\tgithub.com/prometheus/prometheus\tv0.314.0\th1:YjsimqsIi6/mOtzZcrPEYUALO6zpfaht9O5sXqDz2vg=", + "dep\tgithub.com/puzpuzpuz/xsync/v3\tv3.5.1\th1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=", + "dep\tgithub.com/rabbitmq/amqp091-go\tv1.10.0\th1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=", + "dep\tgithub.com/rcrowley/go-metrics\tv0.0.0-20250401214520-65e299d6c5c9\th1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=", + "dep\tgithub.com/rivo/uniseg\tv0.4.7\th1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=", + "dep\tgithub.com/rjeczalik/notify\tv0.9.3\th1:6rJAzHTGKXGj76sbRgDiDcYj/HniypXmSJo1SWakZeY=", + "dep\tgithub.com/rs/cors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=", + "dep\tgithub.com/rs/xid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=", + "dep\tgithub.com/safchain/ethtool\tv0.7.0\th1:rlJzfDetsVvT61uz8x1YIcFn12akMfuPulHtZjtb7Is=", + "dep\tgithub.com/secure-io/sio-go\tv0.3.1\th1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rRc=", + "dep\tgithub.com/shirou/gopsutil/v3\tv3.24.5\th1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=", + "dep\tgithub.com/spiffe/go-spiffe/v2\tv2.7.0\th1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=", + "dep\tgithub.com/tidwall/gjson\tv1.19.0\th1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=", + "dep\tgithub.com/tidwall/match\tv1.2.0\th1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=", + "dep\tgithub.com/tidwall/pretty\tv1.2.1\th1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=", + "dep\tgithub.com/tinylib/msgp\tv1.6.4\th1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=", + "dep\tgithub.com/tklauser/go-sysconf\tv0.4.0\th1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=", + "dep\tgithub.com/tklauser/numcpus\tv0.12.0\th1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=", + "dep\tgithub.com/unrolled/secure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=", + "dep\tgithub.com/valyala/bytebufferpool\tv1.0.0\th1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=", + "dep\tgithub.com/valyala/fastjson\tv1.6.10\th1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=", + "dep\tgithub.com/vbauerster/cupwriter\tv0.0.4\th1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys=", + "dep\tgithub.com/vbauerster/mpb/v8\tv8.16.1\th1:gNYmwMip9xRWNGAiblZOgUNXWeU2P0NIGd5x0f8ffbc=", + "dep\tgithub.com/xdg/scram\tv1.0.5\th1:TuS0RFmt5Is5qm9Tm2SoD89OPqe4IRiFtyFY4iwWXsw=", + "dep\tgithub.com/xdg/stringprep\tv1.0.3\th1:cmL5Enob4W83ti/ZHuZLuKD/xqJfus4fVPwE+/BDm+4=", + "dep\tgithub.com/xo/terminfo\tv1.0.0\th1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=", + "dep\tgithub.com/zeebo/xxh3\tv1.1.0\th1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=", + "dep\tgo.etcd.io/etcd/api/v3\tv3.7.1\th1:KJG0/DcWGfe3Y1otDf/fsBf0TSSgpxZ5RO/L8SFt73E=", + "dep\tgo.etcd.io/etcd/client/pkg/v3\tv3.7.1\th1:rKYsj3pRkR0eK3yjT3XOgrhqfmIfj9pzNgxjh7mfFv4=", + "dep\tgo.etcd.io/etcd/client/v3\tv3.7.1\th1:0PEMMC0KuZmVIN+RAbdqfkZ45pYTgKVtmBEbRCvZFUg=", + "dep\tgo.opentelemetry.io/auto/sdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=", + "dep\tgo.opentelemetry.io/contrib/detectors/gcp\tv1.44.0\th1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc\tv0.70.0\th1:oECp5f+hN7nkwjU/8BxQ/q23bGPb8FIrD839owX222E=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/net/http/otelhttp\tv0.70.0\th1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=", + "dep\tgo.opentelemetry.io/otel\tv1.45.0\th1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=", + "dep\tgo.opentelemetry.io/otel/metric\tv1.45.0\th1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=", + "dep\tgo.opentelemetry.io/otel/sdk\tv1.45.0\th1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=", + "dep\tgo.opentelemetry.io/otel/sdk/metric\tv1.45.0\th1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=", + "dep\tgo.opentelemetry.io/otel/trace\tv1.45.0\th1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=", + "dep\tgo.uber.org/atomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=", + "dep\tgo.uber.org/multierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=", + "dep\tgo.uber.org/zap\tv1.28.0\th1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=", + "dep\tgo.yaml.in/yaml/v3\tv3.0.5\th1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=", + "dep\tgoftp.io/server/v2\tv2.0.3\th1:iz6Gxj7f2SFQVxrj0s1is+gueE6O9yTc+Ab0vtQ6Zn4=", + "dep\tgolang.org/x/crypto\tv0.56.0\th1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=", + "dep\tgolang.org/x/net\tv0.58.0\th1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=", + "dep\tgolang.org/x/oauth2\tv0.36.0\th1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=", + "dep\tgolang.org/x/sync\tv0.22.0\th1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=", + "dep\tgolang.org/x/sys\tv0.47.0\th1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=", + "dep\tgolang.org/x/term\tv0.45.0\th1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=", + "dep\tgolang.org/x/text\tv0.41.0\th1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=", + "dep\tgolang.org/x/time\tv0.15.0\th1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=", + "dep\tgoogle.golang.org/api\tv0.290.0\th1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A=", + "dep\tgoogle.golang.org/genproto\tv0.0.0-20260319201613-d00831a3d3e7\th1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=", + "dep\tgoogle.golang.org/genproto/googleapis/api\tv0.0.0-20260831171406-18b4a7587f8a\th1:i3TAXhpKc7TUP1VAPiBBrv45kamjoizCC3rOC0cAbOs=", + "dep\tgoogle.golang.org/genproto/googleapis/rpc\tv0.0.0-20260831171406-18b4a7587f8a\th1:3Dnd1cDaZlB68lziofO+bJXpjOy8UfRv8Unt+yH8tQ4=", + "dep\tgoogle.golang.org/grpc\tv1.83.2\th1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=", + "dep\tgoogle.golang.org/protobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=", + "dep\tgopkg.in/ini.v1\tv1.67.3\th1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=", + "dep\tgopkg.in/yaml.v2\tv2.4.0\th1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=" + ], + "build_settings": [ + "build\t-buildmode=exe", + "build\t-compiler=gc", + "build\t-tags=kqueue", + "build\tCGO_ENABLED=0", + "build\tGOARCH=arm64", + "build\tGOOS=linux", + "build\tGOARM64=v8.0" + ], + "patched": false, + "dependency_graph_sha256": "8abb47f79286fb552648941de615a293a666e8c88685750ef54f06eab46e8660" + }, + { + "binary": "candidate-go127", + "commit": "d1105bbb3d4a0afa33b3a4ac11b821235038ed0e", + "go": "go1.27.1", + "sha256": "6932cc87cd6d525e4a591abfe66fcc713be243393e9360122468d120031491b3", + "go_mod_sha256": "f8182f00d130b89bd794041cb804ac3255ce7b035c0b73f8e6ca7094d6ea4035", + "go_sum_sha256": "6913c1a5d63af9f1cc4b21205bf45a98bd3f53855e4aa49dd3eccac06cd6ef19", + "dependencies": [ + "dep\taead.dev/mem\tv0.2.0\th1:ufgkESS9+lHV/GUjxgc2ObF43FLZGSemh+W+y27QFMI=", + "dep\taead.dev/minisign\tv0.3.0\th1:8Xafzy5PEVZqYDNP60yJHARlW1eOQtsKNp/Ph2c0vRA=", + "dep\taead.dev/mtls\tv0.3.0\th1:a+C0t15Y9SRX6qP1EqmQFZ4ZSMm88TPvNDymasu4ahQ=", + "dep\tcel.dev/expr\tv0.25.2\th1:K6j46C81hXtZQfuX60cVWQFBJahKSE2gfRbNuvr5bFs=", + "dep\tcloud.google.com/go\tv0.123.0\th1:2NAUJwPR47q+E35uaJeYoNhuNEM9kM8SjgRgdeOJUSE=", + "dep\tcloud.google.com/go/auth\tv0.20.0\th1:kXTssoVb4azsVDoUiF8KvxAqrsQcQtB53DcSgta74CA=", + "dep\tcloud.google.com/go/auth/oauth2adapt\tv0.2.8\th1:keo8NaayQZ6wimpNSmW5OPc283g65QNIiLpZnkHRbnc=", + "dep\tcloud.google.com/go/compute/metadata\tv0.9.0\th1:pDUj4QMoPejqq20dK0Pg2N4yG9zIkYGdBtwLoEkH9Zs=", + "dep\tcloud.google.com/go/iam\tv1.5.3\th1:+vMINPiDF2ognBJ97ABAYYwRgsaqxPbQDlMnbHMjolc=", + "dep\tcloud.google.com/go/monitoring\tv1.24.3\th1:dde+gMNc0UhPZD1Azu6at2e79bfdztVDS5lvhOdsgaE=", + "dep\tcloud.google.com/go/storage\tv1.61.3\th1:VS//ZfBuPGDvakfD9xyPW1RGF1Vy3BWUoVZXgW1KMOg=", + "dep\tfilippo.io/edwards25519\tv1.2.0\th1:crnVqOiS4jqYleHd9vaKZ+HKtHfllngJIiOpNpoJsjo=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azcore\tv1.22.0\th1:aokoqcHvaGjiM3VpjKDfMMnF/8epJ+Q1HLJ7CudztqE=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/azidentity\tv1.14.0\th1:CU4+EJeJi3TKYWEcYuSdWsjzw0nVsK/H0MSQOiPcymU=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/internal\tv1.12.0\th1:fhqpLE3UEXi9lPaBRpQ6XuRW0nU7hgg4zlmZZa+a9q4=", + "dep\tgithub.com/Azure/azure-sdk-for-go/sdk/storage/azblob\tv1.6.4\th1:jWQK1GI+LeGGUKBADtcH2rRqPxYB1Ljwms5gFA2LqrM=", + "dep\tgithub.com/Azure/go-ntlmssp\tv0.1.1\th1:l+FM/EEMb0U9QZE7mKNEDw5Mu3mFiaa2GKOoTSsNDPw=", + "dep\tgithub.com/AzureAD/microsoft-authentication-library-for-go\tv1.7.2\th1:RHK7bS+HQMslb1sZpAokUt+zTVmue0hKSs2C791hhzU=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp\tv1.33.0\th1:l7+6kwRMJNwdCvYdDl7Eax+wzEYHSnNY7zrrfbhDdTA=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/exporter/metric\tv0.55.0\th1:UnDZ/zFfG1JhH/DqxIZYU/1CUAlTUScoXD/LcM2Ykk8=", + "dep\tgithub.com/GoogleCloudPlatform/opentelemetry-operations-go/internal/resourcemapping\tv0.55.0\th1:0s6TxfCu2KHkkZPnBfsQ2y5qia0jl3MMrmBhu3nCOYk=", + "dep\tgithub.com/IBM/sarama\tv1.45.1\th1:nY30XqYpqyXOXSNoe2XCgjj9jklGM1Ye94ierUb1jQ0=", + "dep\tgithub.com/VividCortex/ewma\tv1.2.0\th1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1ow=", + "dep\tgithub.com/acarl005/stripansi\tv0.0.0-20180116102854-5a71ef0e047d\th1:licZJFw2RwpHMqeKTCYkitsPqHNxTmd4SNR5r94FGM8=", + "dep\tgithub.com/alecthomas/participle\tv0.7.1\th1:2bN7reTw//5f0cugJcTOnY/NYZcWQOaajW+BwZB5xWs=", + "dep\tgithub.com/apache/thrift\tv0.24.0\th1:zy31L1a49QTNB2bG1BBfMXol3yJrTH975G3pPubQVLQ=", + "dep\tgithub.com/aymanbagabas/go-osc52/v2\tv2.0.1\th1:HwpRHbFMcZLEVr42D4p7XBqjyuxQH5SMiErDT4WkJ2k=", + "dep\tgithub.com/beevik/ntp\tv1.5.0\th1:y+uj/JjNwlY2JahivxYvtmv4ehfi3h74fAuABB9ZSM4=", + "dep\tgithub.com/beorn7/perks\tv1.0.1\th1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=", + "dep\tgithub.com/buger/jsonparser\tv1.1.2\th1:frqHqw7otoVbk5M8LlE/L7HTnIq2v9RX6EJ48i9AxJk=", + "dep\tgithub.com/cespare/xxhash/v2\tv2.3.0\th1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=", + "dep\tgithub.com/charmbracelet/bubbles\tv1.0.0\th1:12J8/ak/uCZEMQ6KU7pcfwceyjLlWsDLAxB5fXonfvc=", + "dep\tgithub.com/charmbracelet/bubbletea\tv1.3.10\th1:otUDHWMMzQSB0Pkc87rm691KZ3SWa4KUlvF9nRvCICw=", + "dep\tgithub.com/charmbracelet/colorprofile\tv0.4.3\th1:QPa1IWkYI+AOB+fE+mg/5/4HRMZcaXex9t5KX76i20Q=", + "dep\tgithub.com/charmbracelet/harmonica\tv0.2.0\th1:8NxJWRWg/bzKqqEaaeFNipOu77YR5t8aSwG4pgaUBiQ=", + "dep\tgithub.com/charmbracelet/lipgloss\tv1.1.0\th1:vYXsiLHVkK7fp74RkV7b2kq9+zDLoEU4MZoFqR/noCY=", + "dep\tgithub.com/charmbracelet/x/ansi\tv0.11.8\th1:JMFwp0CgDC2+jcOB162HH5k7I3FVbgFSMMYg7dSPBQQ=", + "dep\tgithub.com/charmbracelet/x/cellbuf\tv0.0.15\th1:ur3pZy0o6z/R7EylET877CBxaiE1Sp1GMxoFPAIztPI=", + "dep\tgithub.com/charmbracelet/x/term\tv0.2.2\th1:xVRT/S2ZcKdhhOuSP4t5cLi5o+JxklsoEObBSgfgZRk=", + "dep\tgithub.com/cheggaaa/pb\tv1.0.30\th1:NylhgqJfXx3JVBGx6ywsXuhpz8caSMPmLArXyAv1bwU=", + "dep\tgithub.com/clipperhouse/displaywidth\tv0.11.0\th1:lBc6kY44VFw+TDx4I8opi/EtL9m20WSEFgwIwO+UVM8=", + "dep\tgithub.com/clipperhouse/uax29/v2\tv2.7.0\th1:+gs4oBZ2gPfVrKPthwbMzWZDaAFPGYK72F0NJv2v7Vk=", + "dep\tgithub.com/cncf/xds/go\tv0.0.0-20260202195803-dba9d589def2\th1:aBangftG7EVZoUb69Os8IaYg++6uMOdKK83QtkkvJik=", + "dep\tgithub.com/coreos/go-oidc/v3\tv3.21.0\th1:wZo4Q9Pum8dYEj0eMUPrqR+kvuGkeUplbLpNCkBqoWM=", + "dep\tgithub.com/coreos/go-semver\tv0.3.1\th1:yi21YpKnrx1gt5R+la8n5WgS0kCrsPp33dmEyHReZr4=", + "dep\tgithub.com/coreos/go-systemd/v22\tv22.7.0", + "=>\tgithub.com/coreos/go-systemd/v22\tv22.6.0\th1:aGVa/v8B7hpb0TKl0MWoAavPDmHvobFe5R5zn0bCJWo=", + "dep\tgithub.com/cosnicolaou/pbzip2\tv1.0.6\th1:FYF6b2j4X4q3hZezd2AoUN/emLCtH/MbDGwJjiOacak=", + "dep\tgithub.com/davecgh/go-spew\tv1.1.2-0.20180830191138-d8f796af33cc\th1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=", + "dep\tgithub.com/dchest/siphash\tv1.2.3\th1:QXwFc8cFOR2dSa/gE6o/HokBMWtLUaNDVd+22aKHeEA=", + "dep\tgithub.com/docker/go-units\tv0.5.0\th1:69rxXcBk27SvSaaxTtLh/8llcHD8vYHT7WSdRZ/jvr4=", + "dep\tgithub.com/dustin/go-humanize\tv1.0.1\th1:GzkhY7T5VNhEkwH0PVJgjz+fX1rhBrR7pRT3mDkpeCY=", + "dep\tgithub.com/eapache/go-resiliency\tv1.7.0\th1:n3NRTnBn5N0Cbi/IeOHuQn9s2UwVUH7Ga0ZWcP+9JTA=", + "dep\tgithub.com/eapache/go-xerial-snappy\tv0.0.0-20230731223053-c322873962e3\th1:Oy0F4ALJ04o5Qqpdz8XLIpNA3WM/iSIXqxtqo7UGVws=", + "dep\tgithub.com/eapache/queue\tv1.1.0\th1:YOEu7KNc61ntiQlcEeUIoDTJ2o8mQznoNvUhiigpIqc=", + "dep\tgithub.com/eclipse/paho.mqtt.golang\tv1.5.1\th1:/VSOv3oDLlpqR2Epjn1Q7b2bSTplJIeV2ISgCl2W7nE=", + "dep\tgithub.com/elastic/go-elasticsearch/v7\tv7.17.10\th1:TCQ8i4PmIJuBunvBS6bwT2ybzVFxxUhhltAs3Gyu1yo=", + "dep\tgithub.com/envoyproxy/go-control-plane/envoy\tv1.37.0\th1:u3riX6BoYRfF4Dr7dwSOroNfdSbEPe9Yyl09/B6wBrQ=", + "dep\tgithub.com/envoyproxy/protoc-gen-validate\tv1.3.3\th1:MVQghNeW+LZcmXe7SY1V36Z+WFMDjpqGAGacLe2T0ds=", + "dep\tgithub.com/fatih/color\tv1.19.0\th1:Zp3PiM21/9Ld6FzSKyL5c/BULoe/ONr9KlbYVOfG8+w=", + "dep\tgithub.com/fatih/structs\tv1.1.0\th1:Q7juDM0QtcnhCpeyLGQKyg4TOIghuNXrkL32pHAUMxo=", + "dep\tgithub.com/felixge/fgprof\tv0.9.5\th1:8+vR6yu2vvSKn08urWyEuxx75NWPEvybbkBirEpsbVY=", + "dep\tgithub.com/felixge/httpsnoop\tv1.1.0\th1:3YtUj32ZZkqZtt3sZZsClsymw/QDuVfpNhoA31zeORc=", + "dep\tgithub.com/fraugster/parquet-go\tv0.12.0\th1:1slnC5y2VWEOUSlzbeXatM0BvSWcLUDsR/EcZsXXCZc=", + "dep\tgithub.com/go-asn1-ber/asn1-ber\tv1.5.8\th1:H9AZkK22UOmfX8J84ubyaZxKJZ3FMHVwn8swoMML7iQ=", + "dep\tgithub.com/go-jose/go-jose/v4\tv4.1.4\th1:moDMcTHmvE6Groj34emNPLs/qtYXRVcd6S7NHbHz3kA=", + "dep\tgithub.com/go-ldap/ldap/v3\tv3.4.14\th1:D6PYdEgsaVzsXyr6w/yDC06Ria4uUhWm+Rb+er8lfAs=", + "dep\tgithub.com/go-logr/logr\tv1.4.4\th1:tG4xh9yMsRCAiodLVTxyrkzSZ9+o0L1Kg/+cPVcbP/8=", + "dep\tgithub.com/go-logr/stdr\tv1.2.2\th1:hSWxHoqTgW2S2qGc0LTAI563KZ5YKYRhT3MFKZMbjag=", + "dep\tgithub.com/go-openapi/analysis\tv0.26.2\th1:Q6wOwXW8mcVAkpDFMshj/F4PlK2Fx86tmLJjZW4vyEs=", + "dep\tgithub.com/go-openapi/errors\tv0.22.8\th1:oP7sW7TWc3wFFjrzzj0nI83H2qMBkNjNfSd+XRejk/I=", + "dep\tgithub.com/go-openapi/jsonpointer\tv1.0.0\th1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=", + "dep\tgithub.com/go-openapi/jsonreference\tv1.0.1\th1:4zJ7AmYDKNmD3aSpfPnFNCFA5E80/xMHUNKgydaLh38=", + "dep\tgithub.com/go-openapi/loads\tv0.25.2\th1:+uNsDlRQfYtZTrh+3pdwampcAqZVPuBJW0IA82aZHII=", + "dep\tgithub.com/go-openapi/runtime\tv0.33.1\th1:jCvhI+wAdsn29byy+RgcPcg+j39YT6E304QOE/WqIVk=", + "dep\tgithub.com/go-openapi/runtime/server-middleware\tv0.33.1\th1:IAeKbwWnBnpsYTpuPVS8t73ZrPpKvRZnK2iJ2KJGUV0=", + "dep\tgithub.com/go-openapi/spec\tv1.0.0\th1:JtB/GHOj+eetjse6YvxqLze88oEekl/4uPBethvzRrA=", + "dep\tgithub.com/go-openapi/strfmt\tv0.27.0\th1:kbcTeaD9TXuXD0hhMXzuYa1sdTo6+dWGvwjW93E80IM=", + "dep\tgithub.com/go-openapi/swag\tv0.29.1\th1:C6EeWzUwQtcWEhE9eqBdUubGXxhWY4PlzHMLD7kLaiQ=", + "dep\tgithub.com/go-openapi/swag/cmdutils\tv0.29.1\th1:3DorPGfUdE80BogKY22EzoHBcHMrkVomZMoV7kS4ANY=", + "dep\tgithub.com/go-openapi/swag/conv\tv0.29.1\th1:AC4Eh/5c/eUDOUCzzsRC9ghmFgOSBHeRMGIngY0ZUGA=", + "dep\tgithub.com/go-openapi/swag/fileutils\tv0.29.1\th1:ZcPzMceVhU1WPbK6N1G6sNQKdd1CWJlf3cA08UHuoM0=", + "dep\tgithub.com/go-openapi/swag/jsonutils\tv0.29.1\th1:AFCxs0eQZ24/QyfhVHM2t49rMz7Vv3XCsZQI6yrNy+c=", + "dep\tgithub.com/go-openapi/swag/loading\tv0.29.1\th1:FCv5fG8UhTdDJa2R7w+5O9Ekpcbw7tt0nFWvmDKGBjc=", + "dep\tgithub.com/go-openapi/swag/mangling\tv0.29.1\th1:lHALtvYCdxVnRl4GrHmFPwfBTZYIObqdGNSKyu/8D6I=", + "dep\tgithub.com/go-openapi/swag/netutils\tv0.29.1\th1:IjIvdEP5duKcghFqJEPSUraRnkKYHoM65kTluTu+Jb4=", + "dep\tgithub.com/go-openapi/swag/pools\tv0.29.1\th1:NRogYxdEW9SjRM4mkAOji9iefO4MRXq3p/ZJcoQbUKg=", + "dep\tgithub.com/go-openapi/swag/stringutils\tv0.29.1\th1:1ykunK7iJQk1uOO7+oUH1ukbsK85fFCOiCFMOVSY+F0=", + "dep\tgithub.com/go-openapi/swag/typeutils\tv0.29.1\th1:Nzv9nhnlLCRBPQqfOX+7lB6Guju370or8StT+lIOf6M=", + "dep\tgithub.com/go-openapi/swag/yamlutils\tv0.29.1\th1:69w3tsBajm7MR/fejLy7HD/3J68Ys1SeeZMEzZ3w2sk=", + "dep\tgithub.com/go-openapi/validate\tv0.26.5\th1:Vm02dSmhevDx/4v4m8KAtMwffHGfq9wRLqICeebE/D4=", + "dep\tgithub.com/go-sql-driver/mysql\tv1.9.3\th1:U/N249h2WzJ3Ukj8SowVFjdtZKfu9vlLZxjPXV1aweo=", + "dep\tgithub.com/go-viper/mapstructure/v2\tv2.5.0\th1:vM5IJoUAy3d7zRSVtIwQgBj7BiWtMPfmPEgAXnvj1Ro=", + "dep\tgithub.com/gobwas/httphead\tv0.1.0\th1:exrUm0f4YX0L7EBwZHuCF4GDp8aJfVeBrlLQrs6NqWU=", + "dep\tgithub.com/gobwas/pool\tv0.2.1\th1:xfeeEhW7pwmX8nuLVlqbzVc7udMDrwetjEv+TZIz1og=", + "dep\tgithub.com/gobwas/ws\tv1.4.0\th1:CTaoG1tojrh4ucGPcoJFiAQUAsEWekEWvLy7GsVNqGs=", + "dep\tgithub.com/gogo/protobuf\tv1.3.2\th1:Ov1cvc58UF3b5XjBnZv7+opcTcQFZebYjWzi34vdm4Q=", + "dep\tgithub.com/golang-jwt/jwt/v4\tv4.5.2\th1:YtQM7lnr8iZ+j5q71MGKkNw9Mn7AjHM68uc9g5fXeUI=", + "dep\tgithub.com/golang-jwt/jwt/v5\tv5.3.1\th1:kYf81DTWFe7t+1VvL7eS+jKFVWaUnK9cB1qbwn63YCY=", + "dep\tgithub.com/golang/protobuf\tv1.5.4\th1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek=", + "dep\tgithub.com/golang/snappy\tv1.0.0\th1:Oy607GVXHs7RtbggtPBnr2RmDArIsAefDwvrdWvRhGs=", + "dep\tgithub.com/gomodule/redigo\tv1.9.3\th1:dNPSXeXv6HCq2jdyWfjgmhBdqnR6PRO3m/G05nvpPC8=", + "dep\tgithub.com/google/pprof\tv0.0.0-20260709232956-b9395ee17fa0\th1:du0WGc8xSKq/++e0cglxhS/mXVqsR7+c7jLEi5Vqduw=", + "dep\tgithub.com/google/s2a-go\tv0.1.9\th1:LGD7gtMgezd8a/Xak7mEWL0PjoTQFvpRudN895yqKW0=", + "dep\tgithub.com/google/shlex\tv0.0.0-20191202100458-e7afc7fbc510\th1:El6M4kTTCOh6aBiKaUGG7oYTSPP8MxqL4YI3kZKwcP4=", + "dep\tgithub.com/google/uuid\tv1.6.0\th1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=", + "dep\tgithub.com/googleapis/enterprise-certificate-proxy\tv0.3.18\th1:hvVi34VucdrV1IIsiWuqYM8kutw/92MxNEFxCJZEh0k=", + "dep\tgithub.com/googleapis/gax-go/v2\tv2.23.0\th1:Tchl7qkvE7Ip3y+ztvNufYFvkfqTe7NfLTYGIdJRLuE=", + "dep\tgithub.com/gorilla/websocket\tv1.5.4-0.20250319132907-e064f32e3674\th1:JeSE6pjso5THxAzdVpqr6/geYxZytqFMBCOtn/ujyeo=", + "dep\tgithub.com/grafana/regexp\tv0.0.0-20250905093917-f7b3be9d1853\th1:cLN4IBkmkYZNnk7EAJ0BHIethd+J6LqxFNw5mSiI2bM=", + "dep\tgithub.com/grpc-ecosystem/grpc-gateway/v2\tv2.30.0\th1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=", + "dep\tgithub.com/hashicorp/errwrap\tv1.1.0\th1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=", + "dep\tgithub.com/hashicorp/go-multierror\tv1.1.1\th1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+lD48awMYo=", + "dep\tgithub.com/hashicorp/go-uuid\tv1.0.3\th1:2gKiV6YVmrJ1i2CKKa9obLvRieoRGviZFL26PcT/Co8=", + "dep\tgithub.com/inconshreveable/mousetrap\tv1.1.0\th1:wN+x4NVGpMsO7ErUn/mUI3vEoE6Jt13X2s0bqwp9tc8=", + "dep\tgithub.com/jcmturner/aescts/v2\tv2.0.0\th1:9YKLH6ey7H4eDBXW8khjYslgyqG2xZikXP0EQFKrle8=", + "dep\tgithub.com/jcmturner/dnsutils/v2\tv2.0.0\th1:lltnkeZGL0wILNvrNiVCR6Ro5PGU/SeBvVO/8c/iPbo=", + "dep\tgithub.com/jcmturner/gofork\tv1.7.6\th1:QH0l3hzAU1tfT3rZCnW5zXl+orbkNMMRGJfdJjHVETg=", + "dep\tgithub.com/jcmturner/gokrb5/v8\tv8.4.4\th1:x1Sv4HaTpepFkXbt2IkL29DXRf8sOfZXo8eRKh687T8=", + "dep\tgithub.com/jcmturner/rpc/v2\tv2.0.3\th1:7FXXj8Ti1IaVFpSAziCZWNzbNuZmnvw/i6CqLNdWfZY=", + "dep\tgithub.com/jedib0t/go-pretty/v6\tv6.8.3\th1:yVSk5aemoYHCvcrtqyXklwqcgHQIQzmy/oUzFlmffSQ=", + "dep\tgithub.com/jessevdk/go-flags\tv1.6.1\th1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=", + "dep\tgithub.com/json-iterator/go\tv1.1.12\th1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=", + "dep\tgithub.com/juju/ratelimit\tv1.0.2\th1:sRxmtRiajbvrcLQT7S+JbqU0ntsb9W2yhSdNN8tWfaI=", + "dep\tgithub.com/klauspost/compress\tv1.20.0\th1:a3C1ke2ohxFymNlb2HWAHjDeKCI90scRskErZkR0ezA=", + "dep\tgithub.com/klauspost/cpuid/v2\tv2.4.0\th1:S6Hrbc7+ywsr0r+RLapfGBHfyefhCTwEh3A0tV913Dw=", + "dep\tgithub.com/klauspost/crc32\tv1.3.0\th1:sSmTt3gUt81RP655XGZPElI0PelVTZ6YwCRnPSupoFM=", + "dep\tgithub.com/klauspost/filepathx\tv1.1.1\th1:201zvAsL1PhZvmXTP+QLer3AavWrO3U1NILWpniHK4w=", + "dep\tgithub.com/klauspost/pgzip\tv1.2.6\th1:8RXeL5crjEUFnR2/Sn6GJNWtSQ3Dk8pq4CL3jvdDyjU=", + "dep\tgithub.com/klauspost/readahead\tv1.4.0\th1:w4hQ3BpdLjBnRQkZyNi+nwdHU7eGP9buTexWK9lU7gY=", + "dep\tgithub.com/klauspost/reedsolomon\tv1.13.3\th1:01GwnO2xoCSaM0ShP4qwl+FsHg3csFShC6Tu/RS1ji0=", + "dep\tgithub.com/kr/fs\tv0.1.0\th1:Jskdu9ieNAYnjxsi0LbQp1ulIKZV1LAFgK1tWhpZgl8=", + "dep\tgithub.com/kylelemons/godebug\tv1.1.0\th1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=", + "dep\tgithub.com/lestrrat-go/blackmagic\tv1.0.4\th1:IwQibdnf8l2KoO+qC3uT4OaTWsW7tuRQXy9TRN9QanA=", + "dep\tgithub.com/lestrrat-go/dsig\tv1.4.0\th1:g7LUjK8cT74A5DzBXJI5HzsJuLhoYN0Wzj4nuOMIrH8=", + "dep\tgithub.com/lestrrat-go/httpcc\tv1.0.1\th1:ydWCStUeJLkpYyjLDHihupbn2tYmZ7m22BGkcvZZrIE=", + "dep\tgithub.com/lestrrat-go/httprc/v3\tv3.0.6\th1:4FpLQ18KK/ypPbVU3NLWJNRvH3kcYiqKqWfKGqNWxxI=", + "dep\tgithub.com/lestrrat-go/jwx/v3\tv3.2.0\th1:Jb3zBASTSZXz7gzzSAfYqxXF8KejvKC4xWoePLQqXCA=", + "dep\tgithub.com/lestrrat-go/option/v2\tv2.0.0\th1:XxrcaJESE1fokHy3FpaQ/cXW8ZsIdWcdFzzLOcID3Ss=", + "dep\tgithub.com/lib/pq\tv1.10.9\th1:YXG7RB+JIjhP29X+OtkiDnYaXQwpS4JEWq7dtCCRUEw=", + "dep\tgithub.com/lithammer/shortuuid/v4\tv4.2.0\th1:LMFOzVB3996a7b8aBuEXxqOBflbfPQAiVzkIcHO0h8c=", + "dep\tgithub.com/lucasb-eyer/go-colorful\tv1.4.1\th1:1EO+WB73+EH8EVbzlrG3KLAfEypQWVHIBqlTf+2hNss=", + "dep\tgithub.com/mattn/go-colorable\tv0.1.15\th1:+u9SLTRGnXv73cEsnsmoZBom+dMU88B2M0aDcWy0/jY=", + "dep\tgithub.com/mattn/go-ieproxy\tv0.0.12\th1:OZkUFJC3ESNZPQ+6LzC3VJIFSnreeFLQyqvBWtvfL2M=", + "dep\tgithub.com/mattn/go-isatty\tv0.0.24\th1:tGZZoVgT/KiqK1c8ocVLeDS8BSWMRd47J3Lbz7vsReI=", + "dep\tgithub.com/mattn/go-runewidth\tv0.0.29\th1:3oGF3R/S2N9DQ3ptftzVIvg2eicmojCzlwBEmqEPDfQ=", + "dep\tgithub.com/matttproud/golang_protobuf_extensions\tv1.0.4\th1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=", + "dep\tgithub.com/miekg/dns\tv1.1.73\th1:uhT8nJxmTrPJYClxVxTCX+CVn6qnzSiybRk72Z6DgrE=", + "dep\tgithub.com/minio/cli\tv1.24.2\th1:J+fCUh9mhPLjN3Lj/YhklXvxj8mnyE/D6FpFduXJ2jg=", + "dep\tgithub.com/minio/colorjson\tv1.0.8\th1:AS6gEQ1dTRYHmC4xuoodPDRILHP/9Wz5wYUGDQfPLpg=", + "dep\tgithub.com/minio/console\tv1.7.6", + "=>\tgithub.com/pgsty/silo-console\tv0.0.0-20260908142700-c103d08ec36a\th1:aHLqQ7INozqGLEOB1tr+n/eKgrBhlQ20fHyLmeNu+ao=", + "dep\tgithub.com/minio/crc64nvme\tv1.1.1\th1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=", + "dep\tgithub.com/minio/csvparser\tv1.0.0\th1:xJEHcYK8ZAjeW4hNV9Zu30u+/2o4UyPnYgyjWp8b7ZU=", + "dep\tgithub.com/minio/dnscache\tv0.1.1\th1:AMYLqomzskpORiUA1ciN9k7bZT1oB3YZN4cEIi88W5o=", + "dep\tgithub.com/minio/dperf\tv0.7.1\th1:eBwtaBBjuANwgUy1waWoS+wP+0i5fkXJOdGU2RXuDxo=", + "dep\tgithub.com/minio/filepath\tv1.0.0\th1:fvkJu1+6X+ECRA6G3+JJETj4QeAYO9sV43I79H8ubDY=", + "dep\tgithub.com/minio/highwayhash\tv1.0.4\th1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=", + "dep\tgithub.com/minio/kms-go/kes\tv0.3.1\th1:K3sPFAvFbJx33XlCTUBnQo8JRmSZyDvT6T2/MQ2iC3A=", + "dep\tgithub.com/minio/kms-go/kms\tv0.6.0\th1:oGdGUyjfCZwRIi7em0aj4wk+oOm7+4a0lzSZny7ZIDU=", + "dep\tgithub.com/minio/madmin-go/v3\tv3.0.110\th1:FIYekj7YPc430ffpXFWiUtyut3qBt/unIAcDzJn9H5M=", + "dep\tgithub.com/minio/mc\tv0.0.0-20251106162529-77f82e18b540", + "=>\tgithub.com/pgsty/mc\tv0.0.0-20260909015522-fcd5cad8247f\th1:JiL/FcsGMsAhA+Iv+0Jzk9VnEAVVv4HUNbR0cGf+/CE=", + "dep\tgithub.com/minio/md5-simd\tv1.1.2\th1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=", + "dep\tgithub.com/minio/minio-go/v7\tv7.3.1-0.20260828014306-0e78d3f18efe\th1:By2FKNSOUGLOeb0x4D7xJMHr8x/X1ZW8PG780SpKUwQ=", + "dep\tgithub.com/minio/mux\tv1.10.1\th1:grrK8SwRKbkNFE6qG7WAvFGH09bB46d5teOOtKfQ14s=", + "dep\tgithub.com/minio/pkg/v3\tv3.6.1\th1:gaNT80BS/iuIany5ylTkVmfN4s6UYY30OtImFv4GQA8=", + "dep\tgithub.com/minio/selfupdate\tv0.6.0\th1:i76PgT0K5xO9+hjzKcacQtO7+MjJ4JKA8Ak8XQ9DDwU=", + "dep\tgithub.com/minio/simdjson-go\tv0.4.5\th1:r4IQwjRGmWCQ2VeMc7fGiilu1z5du0gJ/I/FsKwgo5A=", + "dep\tgithub.com/minio/sio\tv0.4.3\th1:JqyID1XM86KwBZox5RAdLD4MLPIDoCY2cke2CXCJCkg=", + "dep\tgithub.com/minio/websocket\tv1.6.0\th1:CPvnQvNvlVaQmvw5gtJNyYQhg4+xRmrPNhBbv8BdpAE=", + "dep\tgithub.com/minio/xxml\tv0.0.3\th1:ZIpPQpfyG5uZQnqqC0LZuWtPk/WT8G/qkxvO6jb7zMU=", + "dep\tgithub.com/minio/zipindex\tv0.5.0\th1:QydEWJW+uAFMd5xmQa580bm7JtC5krpuAtARXIQr72U=", + "dep\tgithub.com/mitchellh/go-homedir\tv1.1.0\th1:lukF9ziXFxDFPkA1vsr5zpc1XuPDn/wFntq5mG+4E0Y=", + "dep\tgithub.com/modern-go/concurrent\tv0.0.0-20180306012644-bacd9c7ef1dd\th1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=", + "dep\tgithub.com/modern-go/reflect2\tv1.0.3-0.20250322232337-35a7c28c31ee\th1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=", + "dep\tgithub.com/muesli/ansi\tv0.0.0-20230316100256-276c6243b2f6\th1:ZK8zHtRHOkbHy6Mmr5D264iyp3TiX5OmNcI5cIARiQI=", + "dep\tgithub.com/muesli/cancelreader\tv0.2.2\th1:3I4Kt4BQjOR54NavqnDogx/MIoWBFa0StPA8ELUXHmA=", + "dep\tgithub.com/muesli/reflow\tv0.3.0\th1:IFsN6K9NfGtjeggFP+68I4chLZV2yIKsXJFNZ+eWh6s=", + "dep\tgithub.com/muesli/termenv\tv0.16.0\th1:S5AlUN9dENB57rsbnkPyfdGuWIlkmzJjbFf0Tf5FWUc=", + "dep\tgithub.com/munnerz/goautoneg\tv0.0.0-20191010083416-a7dc8b61c822\th1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=", + "dep\tgithub.com/nats-io/nats.go\tv1.49.0\th1:yh/WvY59gXqYpgl33ZI+XoVPKyut/IcEaqtsiuTJpoE=", + "dep\tgithub.com/nats-io/nkeys\tv0.4.15\th1:JACV5jRVO9V856KOapQ7x+EY8Jo3qw1vJt/9Jpwzkk4=", + "dep\tgithub.com/nats-io/nuid\tv1.0.1\th1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=", + "dep\tgithub.com/nats-io/stan.go\tv0.10.4\th1:19GS/eD1SeQJaVkeM9EkvEYattnvnWrZ3wkSWSw4uXw=", + "dep\tgithub.com/ncw/directio\tv1.0.5\th1:JSUBhdjEvVaJvOoyPAbcW0fnd0tvRXD76wEfZ1KcQz4=", + "dep\tgithub.com/nsqio/go-nsq\tv1.1.0\th1:PQg+xxiUjA7V+TLdXw7nVrJ5Jbl3sN86EhGCQj4+FYE=", + "dep\tgithub.com/oklog/ulid/v2\tv2.1.2\th1:IEclFb9JNvzYA6MW2SCxbLzcHTVsfqm3PrqGQJH5zec=", + "dep\tgithub.com/olekukonko/tablewriter\tv0.0.5\th1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=", + "dep\tgithub.com/pgsty/silo-pkg/v3\tv3.13.3\th1:d2xYTn4LXoWIAIjBlW/17wtA/Ut1ap29t+1ww4TFa8o=", + "dep\tgithub.com/philhofer/fwd\tv1.2.0\th1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=", + "dep\tgithub.com/pierrec/lz4/v4\tv4.1.29\th1:CDQY6qZOLI4DW0Nx6R1vRrifrCeQHnNXkMb0hZWXFjg=", + "dep\tgithub.com/pkg/browser\tv0.0.0-20240102092130-5ac0b6a4141c\th1:+mdjkGKdHQG3305AYmdv1U2eRNDiU2ErMBj1gwrq8eQ=", + "dep\tgithub.com/pkg/errors\tv0.9.1\th1:FEBLx1zS214owpjy7qsBeixbURkuhQAwrK5UwLGTwt4=", + "dep\tgithub.com/pkg/sftp\tv1.13.11\th1:0N92SLTB8JqASJB14ZLHHzFnBV8mG9zw4K7jghEFWuE=", + "dep\tgithub.com/pkg/xattr\tv0.4.12\th1:rRTkSyFNTRElv6pkA3zpjHpQ90p/OdHQC1GmGh1aTjM=", + "dep\tgithub.com/posener/complete\tv1.2.3\th1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=", + "dep\tgithub.com/prometheus/client_golang\tv1.24.1\th1:JnJkREXzWxUdCuPFpIWZiPispT9xVV59uiuyR2bPlnU=", + "dep\tgithub.com/prometheus/client_model\tv0.6.3\th1:O0jaTVAYNxTHYInEPFJt5I3+sN8zqBtVMPTB1qyxiEo=", + "dep\tgithub.com/prometheus/common\tv0.71.0\th1:9KDAKb7Mj3HEVKyFCK6Dc/HIwlBzZIN2l7/lrHl3KK8=", + "dep\tgithub.com/prometheus/procfs\tv0.22.0\th1:6q9+/JL9IKAPbCmBrv9n5O5Ty3NKnciV5X7YGw0oics=", + "dep\tgithub.com/prometheus/prom2json\tv1.5.0\th1:WIcAOjLE1x476W3dUlmTL6E/e98CgVGuwwYusl6MPP8=", + "dep\tgithub.com/prometheus/prometheus\tv0.314.0\th1:YjsimqsIi6/mOtzZcrPEYUALO6zpfaht9O5sXqDz2vg=", + "dep\tgithub.com/puzpuzpuz/xsync/v3\tv3.5.1\th1:GJYJZwO6IdxN/IKbneznS6yPkVC+c3zyY/j19c++5Fg=", + "dep\tgithub.com/rabbitmq/amqp091-go\tv1.10.0\th1:STpn5XsHlHGcecLmMFCtg7mqq0RnD+zFr4uzukfVhBw=", + "dep\tgithub.com/rcrowley/go-metrics\tv0.0.0-20250401214520-65e299d6c5c9\th1:bsUq1dX0N8AOIL7EB/X911+m4EHsnWEHeJ0c+3TTBrg=", + "dep\tgithub.com/rivo/uniseg\tv0.4.7\th1:WUdvkW8uEhrYfLC4ZzdpI2ztxP1I582+49Oc5Mq64VQ=", + "dep\tgithub.com/rjeczalik/notify\tv0.9.3\th1:6rJAzHTGKXGj76sbRgDiDcYj/HniypXmSJo1SWakZeY=", + "dep\tgithub.com/rs/cors\tv1.11.1\th1:eU3gRzXLRK57F5rKMGMZURNdIG4EoAmX8k94r9wXWHA=", + "dep\tgithub.com/rs/xid\tv1.6.0\th1:fV591PaemRlL6JfRxGDEPl69wICngIQ3shQtzfy2gxU=", + "dep\tgithub.com/safchain/ethtool\tv0.7.0\th1:rlJzfDetsVvT61uz8x1YIcFn12akMfuPulHtZjtb7Is=", + "dep\tgithub.com/secure-io/sio-go\tv0.3.1\th1:dNvY9awjabXTYGsTF1PiCySl9Ltofk9GA3VdWlo7rRc=", + "dep\tgithub.com/shirou/gopsutil/v3\tv3.24.5\th1:i0t8kL+kQTvpAYToeuiVk3TgDeKOFioZO3Ztz/iZ9pI=", + "dep\tgithub.com/spiffe/go-spiffe/v2\tv2.7.0\th1:uXe1MflJoHw58wAUvxVlcM7WpKtijWG7I1UidcGh6g4=", + "dep\tgithub.com/tidwall/gjson\tv1.19.0\th1:xwxm7n691Uf3u5OFjzngavjGTh55KX5q/9w9xHW88JU=", + "dep\tgithub.com/tidwall/match\tv1.2.0\th1:0pt8FlkOwjN2fPt4bIl4BoNxb98gGHN2ObFEDkrfZnM=", + "dep\tgithub.com/tidwall/pretty\tv1.2.1\th1:qjsOFOWWQl+N3RsoF5/ssm1pHmJJwhjlSbZ51I6wMl4=", + "dep\tgithub.com/tinylib/msgp\tv1.6.4\th1:mOwYbyYDLPj35mkA2BjjYejgJk9BuHxDdvRnb6v2ZcQ=", + "dep\tgithub.com/tklauser/go-sysconf\tv0.4.0\th1:7H0uAN+7RkwWRaxhYXDLqa5V3LPrJeV8wmD9dRUgPQU=", + "dep\tgithub.com/tklauser/numcpus\tv0.12.0\th1:NR85qdvHA9pFse3x3weVZ0r0ST8R6l5RHbZrlRaqob4=", + "dep\tgithub.com/unrolled/secure\tv1.17.0\th1:Io7ifFgo99Bnh0J7+Q+qcMzWM6kaDPCA5FroFZEdbWU=", + "dep\tgithub.com/valyala/bytebufferpool\tv1.0.0\th1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=", + "dep\tgithub.com/valyala/fastjson\tv1.6.10\th1:/yjJg8jaVQdYR3arGxPE2X5z89xrlhS0eGXdv+ADTh4=", + "dep\tgithub.com/vbauerster/cupwriter\tv0.0.4\th1:9sBPe0uXWLZuWQU5lqVbhyFlxX6c09asST/YfatFAys=", + "dep\tgithub.com/vbauerster/mpb/v8\tv8.16.1\th1:gNYmwMip9xRWNGAiblZOgUNXWeU2P0NIGd5x0f8ffbc=", + "dep\tgithub.com/xdg/scram\tv1.0.5\th1:TuS0RFmt5Is5qm9Tm2SoD89OPqe4IRiFtyFY4iwWXsw=", + "dep\tgithub.com/xdg/stringprep\tv1.0.3\th1:cmL5Enob4W83ti/ZHuZLuKD/xqJfus4fVPwE+/BDm+4=", + "dep\tgithub.com/xo/terminfo\tv1.0.0\th1:2ZpYzqWzyyytjk3TP6aJVDhkMAkc99/1xKQdA3TDTBY=", + "dep\tgithub.com/zeebo/xxh3\tv1.1.0\th1:s7DLGDK45Dyfg7++yxI0khrfwq9661w9EN78eP/UZVs=", + "dep\tgo.etcd.io/etcd/api/v3\tv3.7.1\th1:KJG0/DcWGfe3Y1otDf/fsBf0TSSgpxZ5RO/L8SFt73E=", + "dep\tgo.etcd.io/etcd/client/pkg/v3\tv3.7.1\th1:rKYsj3pRkR0eK3yjT3XOgrhqfmIfj9pzNgxjh7mfFv4=", + "dep\tgo.etcd.io/etcd/client/v3\tv3.7.1\th1:0PEMMC0KuZmVIN+RAbdqfkZ45pYTgKVtmBEbRCvZFUg=", + "dep\tgo.opentelemetry.io/auto/sdk\tv1.2.1\th1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=", + "dep\tgo.opentelemetry.io/contrib/detectors/gcp\tv1.44.0\th1:NmLfL734pJhM0JKaYd2Y28+nY9dPRWYAAbxhRCrKXPw=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc\tv0.70.0\th1:oECp5f+hN7nkwjU/8BxQ/q23bGPb8FIrD839owX222E=", + "dep\tgo.opentelemetry.io/contrib/instrumentation/net/http/otelhttp\tv0.70.0\th1:LMuyCAyfalSjDyjdC65nK6N0zoTT63+E/u95X0JovZI=", + "dep\tgo.opentelemetry.io/otel\tv1.45.0\th1:pdrWmLHofpubmArBv1LgFSv1Z0Ie/ppdZzu+kUN5EeU=", + "dep\tgo.opentelemetry.io/otel/metric\tv1.45.0\th1:7Eg1uH7CJ5cXv9is6tnBe1FI6rj1nwUdbFypRm3br/M=", + "dep\tgo.opentelemetry.io/otel/sdk\tv1.45.0\th1:4VVSMgQ83dUgW2aoX5f6JgLvHwIvzcuLnF9lUdCSpCw=", + "dep\tgo.opentelemetry.io/otel/sdk/metric\tv1.45.0\th1:oVFszMfyj1Am6s24Vtc7wBb8BKLcwepJjNEYILuiE3o=", + "dep\tgo.opentelemetry.io/otel/trace\tv1.45.0\th1:l/mP6Uv7oNO7/TblbhpbgMidxhq1uO/rPsikOyVhxag=", + "dep\tgo.uber.org/atomic\tv1.11.0\th1:ZvwS0R+56ePWxUNi+Atn9dWONBPp/AUETXlHW0DxSjE=", + "dep\tgo.uber.org/multierr\tv1.11.0\th1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=", + "dep\tgo.uber.org/zap\tv1.28.0\th1:IZzaP1Fv73/T/pBMLk4VutPl36uNC+OSUh3JLG3FIjo=", + "dep\tgo.yaml.in/yaml/v3\tv3.0.5\th1:N6y/pJk8buWs9NY5ERU2HSMfm+IuD/OtfdAnq6kESPw=", + "dep\tgoftp.io/server/v2\tv2.0.3\th1:iz6Gxj7f2SFQVxrj0s1is+gueE6O9yTc+Ab0vtQ6Zn4=", + "dep\tgolang.org/x/crypto\tv0.56.0\th1:GUh5Ii4J5jtcseSMiRqr1jXCNHoxjeV9Fmekc2oLy6Y=", + "dep\tgolang.org/x/net\tv0.58.0\th1:ynWG7rqYi4ccpTEuPZ2QGWHktVEM9DMCj9yzDE0Q7To=", + "dep\tgolang.org/x/oauth2\tv0.36.0\th1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=", + "dep\tgolang.org/x/sync\tv0.22.0\th1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=", + "dep\tgolang.org/x/sys\tv0.47.0\th1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=", + "dep\tgolang.org/x/term\tv0.45.0\th1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=", + "dep\tgolang.org/x/text\tv0.41.0\th1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=", + "dep\tgolang.org/x/time\tv0.15.0\th1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=", + "dep\tgoogle.golang.org/api\tv0.290.0\th1:eMw0Xo+IfbbMlKmW7aHvpyQRv9RCXuWx/vs8AD+0x9A=", + "dep\tgoogle.golang.org/genproto\tv0.0.0-20260319201613-d00831a3d3e7\th1:XzmzkmB14QhVhgnawEVsOn6OFsnpyxNPRY9QV01dNB0=", + "dep\tgoogle.golang.org/genproto/googleapis/api\tv0.0.0-20260831171406-18b4a7587f8a\th1:i3TAXhpKc7TUP1VAPiBBrv45kamjoizCC3rOC0cAbOs=", + "dep\tgoogle.golang.org/genproto/googleapis/rpc\tv0.0.0-20260831171406-18b4a7587f8a\th1:3Dnd1cDaZlB68lziofO+bJXpjOy8UfRv8Unt+yH8tQ4=", + "dep\tgoogle.golang.org/grpc\tv1.83.2\th1:EManeRomTObA0BU7I8vXgg/78uE5MJ9M8B39EX2WscU=", + "dep\tgoogle.golang.org/protobuf\tv1.36.12\th1:pJOKDDOyeXErUroCihFAd5LQuwXBSpVnKGrj5o/fwxc=", + "dep\tgopkg.in/ini.v1\tv1.67.3\th1:iM9Lhz5MRSGhHVGGwCuzG9KO8PoirCXj/m/qTmOJJQw=", + "dep\tgopkg.in/yaml.v2\tv2.4.0\th1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=" + ], + "build_settings": [ + "build\t-buildmode=exe", + "build\t-compiler=gc", + "build\t-tags=kqueue", + "build\tCGO_ENABLED=0", + "build\tGOARCH=arm64", + "build\tGOOS=linux", + "build\tGOARM64=v8.0" + ], + "patched": true, + "dependency_graph_sha256": "8abb47f79286fb552648941de615a293a666e8c88685750ef54f06eab46e8660" + } + ], + "results": [ + { + "case": "candidate127-add", + "binary": "candidate-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "add_ok": true, + "add_reset": false, + "events": [ + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + } + ], + "server_log_summary": { + "connection_reset_count": 0, + "openid_wait_count": 0, + "untrusted_ca": false + } + }, + { + "case": "candidate127-compat-login", + "binary": "candidate-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "oauth": { + "callback_status": 200, + "login_status": 204, + "buckets_status": 200, + "session_cookie": true + }, + "bad-signature": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "bad-audience": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 269, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-signature", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Silo" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-audience", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 49200, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "Go-http-client/1.1" + } + ], + "server_log_summary": { + "connection_reset_count": 0, + "openid_wait_count": 0, + "untrusted_ca": false + } + }, + { + "case": "candidate127-mldsa", + "binary": "candidate-go127", + "mode": "reject-mldsa", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 503, + "ready": 200, + "console": 0, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "events": [ + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 287, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mldsa", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + } + ], + "server_log_summary": { + "connection_reset_count": 2, + "openid_wait_count": 2, + "untrusted_ca": false + } + }, + { + "case": "candidate127-no-optout", + "binary": "candidate-go127", + "mode": "reject-mlkem", + "godebug": null, + "tls13": false, + "cluster": 503, + "ready": 200, + "console": 0, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "events": [ + { + "alpn": null, + "bytes_read": 1513, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1513, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + } + ], + "server_log_summary": { + "connection_reset_count": 2, + "openid_wait_count": 2, + "untrusted_ca": false + } + }, + { + "case": "candidate127-tls13-login", + "binary": "candidate-go127", + "mode": "normal", + "godebug": null, + "tls13": true, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "oauth": { + "callback_status": 200, + "login_status": 204, + "buckets_status": 200, + "session_cookie": true + }, + "bad-signature": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "bad-audience": { + "callback_status": 200, + "login_status": 500, + "buckets_status": 403, + "session_cookie": false + }, + "events": [ + { + "alpn": null, + "bytes_read": 1513, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Silo" + }, + { + "cipher": 4865, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Silo" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 772, + "user_agent_family": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 1495, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-signature", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Silo" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "alpn": null, + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "bad-audience", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 4865, + "event": "request", + "path": "/authorize", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Python-urllib/3.11" + }, + { + "cipher": 4865, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + }, + { + "cipher": 4865, + "event": "request", + "path": "/token", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 772, + "user_agent_family": "Go-http-client/1.1" + } + ], + "server_log_summary": { + "connection_reset_count": 0, + "openid_wait_count": 0, + "untrusted_ca": false + } + }, + { + "case": "candidate127-untrusted", + "binary": "candidate-go127", + "mode": "normal", + "godebug": null, + "tls13": false, + "cluster": 503, + "ready": 200, + "console": 0, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "events": [ + { + "alpn": null, + "bytes_read": 1513, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1513, + "curves": [ + 4588, + 4587, + 4589, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + } + ], + "server_log_summary": { + "connection_reset_count": 0, + "openid_wait_count": 2, + "untrusted_ca": true + } + }, + { + "case": "head127-add", + "binary": "head-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "add_ok": false, + "add_reset": true, + "events": [ + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + } + ], + "server_log_summary": { + "connection_reset_count": 0, + "openid_wait_count": 0, + "untrusted_ca": false + } + }, + { + "case": "head127-compat", + "binary": "head-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 503, + "ready": 200, + "console": 0, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + } + ], + "server_log_summary": { + "connection_reset_count": 2, + "openid_wait_count": 2, + "untrusted_ca": false + } + }, + { + "case": "old126-compat", + "binary": "old-go126", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "events": [ + { + "alpn": null, + "bytes_read": 275, + "curves": [ + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "MinIO" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "MinIO" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + } + ], + "server_log_summary": { + "connection_reset_count": 0, + "openid_wait_count": 0, + "untrusted_ca": false + } + }, + { + "case": "old126-normal", + "binary": "old-go126", + "mode": "normal", + "godebug": null, + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "events": [ + { + "alpn": null, + "bytes_read": 1497, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "MinIO" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "MinIO" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + } + ], + "server_log_summary": { + "connection_reset_count": 0, + "openid_wait_count": 0, + "untrusted_ca": false + } + }, + { + "case": "old127-compat", + "binary": "old-go127", + "mode": "reject-mlkem", + "godebug": "tlsmlkem=0", + "tls13": false, + "cluster": 503, + "ready": 200, + "console": 0, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "reject-mlkem", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + } + ], + "server_log_summary": { + "connection_reset_count": 2, + "openid_wait_count": 2, + "untrusted_ca": false + } + }, + { + "case": "old127-normal", + "binary": "old-go127", + "mode": "normal", + "godebug": null, + "tls13": false, + "cluster": 200, + "ready": 200, + "console": 200, + "admin_list_ok": true, + "curl": { + "exit": 0, + "status_protocol": "200 2" + }, + "events": [ + { + "alpn": null, + "bytes_read": 1509, + "curves": [ + 4588, + 29, + 23, + 24, + 25 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 2308, + 2309, + 2310, + 2052, + 1027, + 2055, + 2053, + 2054, + 1025, + 1281, + 1537, + 1283, + 1539 + ], + "versions": [ + 772, + 771 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "MinIO" + }, + { + "cipher": 49200, + "event": "request", + "path": "/jwks", + "protocol": "HTTP/1.1", + "resumed": false, + "tls": 771, + "user_agent_family": "MinIO" + }, + { + "alpn": [ + "h2", + "http/1.1" + ], + "bytes_read": 517, + "curves": [ + 29, + 23, + 30, + 25, + 24, + 256, + 257, + 258, + 259, + 260 + ], + "event": "hello", + "mode": "normal", + "signatures": [ + 1027, + 1283, + 1539, + 2055, + 2056, + 2057, + 2058, + 2059, + 2052, + 2053, + 2054, + 1025, + 1281, + 1537, + 771, + 769, + 770, + 1026, + 1282, + 1538 + ], + "versions": [ + 772, + 771, + 770, + 769 + ] + }, + { + "cipher": 49200, + "event": "request", + "path": "/.well-known/openid-configuration", + "protocol": "HTTP/2.0", + "resumed": false, + "tls": 771, + "user_agent_family": "curl/7.88.1" + } + ], + "server_log_summary": { + "connection_reset_count": 0, + "openid_wait_count": 0, + "untrusted_ca": false + } + } + ], + "current_graph_with_old_toolchain": { + "toolchain": "go1.26.7", + "command": "GOTOOLCHAIN=local go list -mod=readonly ./cmd", + "exit": 1, + "error": "go: go.mod requires go >= 1.27.1 (running go 1.26.7; GOTOOLCHAIN=local)", + "server_console_mc_go_directives": "1.27.1" + }, + "limitations": [ + "The reject-mlkem and reject-mldsa policies were deliberately programmed into the synthetic fixture. They prove conditional mechanisms, not the customer ingress behavior.", + "No external network, customer endpoint, real Keycloak, production data, image publication or deployment.", + "TLS 1.3 fixture permits TLS 1.3 and negotiates it using P-256, not a full interoperability matrix for the newly offered PQ groups.", + "The valid TLS 1.2/1.3 OAuth flows, invalid signature and invalid audience use a synthetic lab-only issuer and API-driven callbacks. No real browser UI or logout test.", + "The scoped patch still needs tlsmlkem=0 for the ML-KEM-intolerant fixture, and does not fix ML-DSA intolerance." + ], + "candidate_package_tests": { + "go": "go1.27.1", + "platform": "darwin/arm64", + "CGO_ENABLED": "0", + "GOWORK": "off", + "GOTOOLCHAIN": "local", + "command": "go test -mod=readonly -count=1 ./internal/http ./internal/config/identity/openid", + "exit": 0, + "packages": { + "internal/http": "ok 1.109s", + "internal/config/identity/openid": "ok 1.807s" + } + } +} diff --git a/docs/investigations/issue-154/openid-default-curves.patch b/docs/investigations/issue-154/openid-default-curves.patch new file mode 100644 index 000000000..603fc6e19 --- /dev/null +++ b/docs/investigations/issue-154/openid-default-curves.patch @@ -0,0 +1,40 @@ +# Historical OIDC-only candidate; superseded by ../go127-stack.md. Do not apply on top of the stack fix. +--- a/cmd/utils.go ++++ b/cmd/utils.go +@@ -654,6 +654,14 @@ + return NewHTTPTransportWithTimeout(1 * time.Minute) + } + ++// NewOpenIDHTTPTransport uses Go defaults for external identity-provider key exchange. ++// This lets tlsmlkem/tlssecpmlkem configure their documented default sets. ++func NewOpenIDHTTPTransport() *http.Transport { ++ tr := NewHTTPTransport() ++ tr.TLSClientConfig.CurvePreferences = nil ++ return tr ++} ++ + // Default values for dial timeout + const defaultDialTimeout = 5 * time.Second + +--- a/cmd/iam.go ++++ b/cmd/iam.go +@@ -277,7 +277,7 @@ + for { + if !openidInit { + openidConfig, err := openid.LookupConfig(s, +- xhttp.WithUserAgent(NewHTTPTransport(), func() string { ++ xhttp.WithUserAgent(NewOpenIDHTTPTransport(), func() string { + return getUserAgent(getMinioMode()) + }), xhttp.DrainBody, globalSite.Region()) + if err != nil { +--- a/cmd/config-current.go ++++ b/cmd/config-current.go +@@ -352,7 +352,7 @@ + } + case config.IdentityOpenIDSubSys: + if _, err := openid.LookupConfig(s, +- xhttp.WithUserAgent(NewHTTPTransport(), func() string { ++ xhttp.WithUserAgent(NewOpenIDHTTPTransport(), func() string { + return getUserAgent(getMinioMode()) + }), xhttp.DrainBody, globalSite.Region()); err != nil { + return err diff --git a/docs/investigations/issue-154/probe.go b/docs/investigations/issue-154/probe.go new file mode 100644 index 000000000..ebf8b4ee8 --- /dev/null +++ b/docs/investigations/issue-154/probe.go @@ -0,0 +1,165 @@ +//go:build ignore + +// Diagnostic GET using the Server's actual transport constructor. +// Build explicitly from the SILO module root; see ../issue-154.md. +package main + +import ( + "context" + "crypto/tls" + "errors" + "flag" + "fmt" + "io" + "net" + "net/http" + "net/http/httptrace" + "net/url" + "os" + "runtime" + "strings" + "sync" + "time" + + "github.com/minio/minio/cmd" + xhttp "github.com/minio/minio/internal/http" + "github.com/pgsty/silo-pkg/v3/certs" +) + +func main() { + endpoint := flag.String("url", os.Getenv("OIDC_URL"), "discovery URL; no credentials or query string") + ca := flag.String("ca", "", "same CA file or certs/CAs directory as Server") + h2 := flag.Bool("h2", false, "diagnostic: opt in to HTTP/2") + classical := flag.Bool("classical", false, "diagnostic: omit hybrid key exchange only") + defaultCurves := flag.Bool("default-curves", false, "diagnostic: let Go choose curves and honor its GODEBUG defaults") + tls12 := flag.Bool("tls12", false, "diagnostic: TLS 1.2 only; keeps certificate verification") + direct := flag.Bool("direct", false, "diagnostic: bypass environment proxy") + ip := flag.String("ip", "", "diagnostic: pin destination IP, preserving Host/SNI; requires -direct") + fresh := flag.Bool("fresh", false, "diagnostic: close idle connections between requests") + ua := flag.String("ua", "issue-154-probe", "HTTP User-Agent; supply actual Server UA to investigate a WAF") + n := flag.Int("n", 1, "number of GETs (1 to 3)") + flag.Parse() + u, err := url.Parse(*endpoint) + if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.RawQuery != "" || u.Fragment != "" || *n < 1 || *n > 3 { + fmt.Fprintln(os.Stderr, "require an HTTPS URL without credentials/query/fragment and -n between 1 and 3") + os.Exit(2) + } + if *ip != "" && (!*direct || net.ParseIP(*ip) == nil) { + fmt.Fprintln(os.Stderr, "-ip requires a literal IP and -direct") + os.Exit(2) + } + if *classical && *defaultCurves { + fmt.Fprintln(os.Stderr, "choose at most one of -classical and -default-curves") + os.Exit(2) + } + tr := cmd.NewHTTPTransport() + tr.TLSClientConfig.RootCAs, err = certs.GetRootCAs(*ca) + if err != nil { + fmt.Fprintln(os.Stderr, "CA loading failed; check the local CA path") + os.Exit(2) + } + if *h2 { + tr.ForceAttemptHTTP2 = true + } + if *classical { + tr.TLSClientConfig.CurvePreferences = []tls.CurveID{tls.CurveP256, tls.X25519, tls.CurveP384, tls.CurveP521} + } + if *defaultCurves { + tr.TLSClientConfig.CurvePreferences = nil + } + if *tls12 { + tr.TLSClientConfig.MinVersion = tls.VersionTLS12 + tr.TLSClientConfig.MaxVersion = tls.VersionTLS12 + } + if *direct { + tr.Proxy = nil + } + if *ip != "" { + base := tr.DialContext + tr.DialContext = func(ctx context.Context, network, address string) (net.Conn, error) { + host, port, e := net.SplitHostPort(address) + if e != nil { + return nil, e + } + if host == u.Hostname() { + address = net.JoinHostPort(*ip, port) + } + return base(ctx, network, address) + } + } + defer tr.CloseIdleConnections() + var mu sync.Mutex + log := func(format string, args ...any) { mu.Lock(); defer mu.Unlock(); fmt.Printf(format+"\n", args...) } + log("go=%s os=%s arch=%s h2=%v classical=%v default_curves=%v tls12=%v", runtime.Version(), runtime.GOOS, runtime.GOARCH, *h2, *classical, *defaultCurves, *tls12) + // Deliberately print no URL, headers, body, client ID, secret, or token. + req, _ := http.NewRequest(http.MethodGet, u.String(), nil) + proxy := "direct" + if tr.Proxy != nil { + p, e := tr.Proxy(req) + if e != nil { + log("proxy_selection_error=%T", e) + os.Exit(2) + } + if p != nil { + proxy = p.Scheme + " proxy (address omitted)" + } + } + log("route=%s curves=%v", proxy, tr.TLSClientConfig.CurvePreferences) + client := &http.Client{Transport: xhttp.WithUserAgent(tr, func() string { return *ua }), Timeout: 20 * time.Second, + CheckRedirect: func(_ *http.Request, _ []*http.Request) error { return http.ErrUseLastResponse }} + failed := false + for i := 0; i < *n; i++ { + if *fresh { + tr.CloseIdleConnections() + } + log("request=%d", i+1) + trace := &httptrace.ClientTrace{ + DNSDone: func(d httptrace.DNSDoneInfo) { log("dns_addresses=%v err=%s", d.Addrs, errorClass(d.Err)) }, + ConnectStart: func(network, addr string) { log("connect=%s %s", network, addr) }, + ConnectDone: func(_, addr string, e error) { log("connected=%s err=%s", addr, errorClass(e)) }, + TLSHandshakeStart: func() { log("tls_start") }, + TLSHandshakeDone: func(s tls.ConnectionState, e error) { + log("tls_done=0x%x cipher=%s alpn=%q resumed=%v verified_chains=%d err=%s", s.Version, tls.CipherSuiteName(s.CipherSuite), s.NegotiatedProtocol, s.DidResume, len(s.VerifiedChains), errorClass(e)) + }, + GotConn: func(c httptrace.GotConnInfo) { log("got_conn=%s reused=%v", c.Conn.RemoteAddr(), c.Reused) }, + WroteRequest: func(w httptrace.WroteRequestInfo) { log("wrote_request err=%s", errorClass(w.Err)) }, + GotFirstResponseByte: func() { log("first_response_byte") }, + } + r := req.Clone(httptrace.WithClientTrace(context.Background(), trace)) + resp, e := client.Do(r) + if e != nil { + log("get_error=%s", errorClass(e)) + failed = true + continue + } + log("status=%d protocol=%s", resp.StatusCode, resp.Proto) + _, e = io.Copy(io.Discard, io.LimitReader(resp.Body, 1<<20)) + resp.Body.Close() + if e != nil || resp.StatusCode != http.StatusOK { + failed = true + log("body_error=%s", errorClass(e)) + } + } + if failed { + os.Exit(1) + } +} + +func errorClass(err error) string { + if err == nil { + return "none" + } + if errors.Is(err, context.DeadlineExceeded) { + return "deadline" + } + // Error text may contain a private URL. Emit only category and concrete type. + category := "other" + s := err.Error() + for _, k := range []string{"connection reset by peer", "x509:", "TLS handshake timeout", "connection refused", "EOF"} { + if strings.Contains(s, k) { + category = k + break + } + } + return fmt.Sprintf("%s (%T)", category, err) +} diff --git a/docs/investigations/issue-154/run-linux.py b/docs/investigations/issue-154/run-linux.py new file mode 100644 index 000000000..50306835d --- /dev/null +++ b/docs/investigations/issue-154/run-linux.py @@ -0,0 +1,170 @@ +#!/usr/bin/env python3 +"""Bounded, loopback-only full-Server comparison. See the investigation report. + +Run in an isolated generic Linux container with locally built binaries in +/lab/bin and a new disposable /lab/out. No customer identities or endpoints. +""" +import http.cookiejar +import json +import os +from pathlib import Path +import secrets +import shutil +import socket +import ssl +import subprocess +import time +import urllib.error +import urllib.parse +import urllib.request + +ROOT = Path("/lab") +OUT = ROOT / "out" +BASE = {k: v for k, v in os.environ.items() + if not k.startswith(("MINIO_", "SILO_", "CONSOLE_")) + and k.lower() not in {"http_proxy", "https_proxy", "all_proxy", "no_proxy", "godebug"}} + + +def port(): + with socket.socket() as sock: + sock.bind(("127.0.0.1", 0)) + return sock.getsockname()[1] + + +def request(url, opener=None, payload=None): + headers = {"Origin": f"http://{urllib.parse.urlparse(url).netloc}"} + if payload is not None: + headers["Content-Type"] = "application/json" + req = urllib.request.Request(url, data=None if payload is None else json.dumps(payload).encode(), headers=headers) + try: + response = (opener.open if opener else urllib.request.urlopen)(req, timeout=2) + except urllib.error.HTTPError as err: + response = err + except (urllib.error.URLError, TimeoutError): + return 0, {}, b"" + with response: + return response.code, dict(response.headers), response.read(1 << 20) + + +def stop(proc): + proc.terminate() + try: + proc.wait(timeout=4) + except subprocess.TimeoutExpired: + proc.kill() + proc.wait(timeout=2) + + +class NoRedirect(urllib.request.HTTPRedirectHandler): + def redirect_request(self, req, fp, code, msg, headers, newurl): + return None + + +def login(console, ca): + jar = http.cookiejar.CookieJar() + client = urllib.request.build_opener(urllib.request.HTTPCookieProcessor(jar)) + status, _, raw = request(console + "/api/v1/login", client) + details = json.loads(raw) + rules = details.get("redirectRules", []) + assert status == 200 and len(rules) == 1, (status, details) + auth_url = rules[0]["redirect"] + provider = urllib.request.build_opener(NoRedirect(), urllib.request.HTTPSHandler(context=ssl.create_default_context(cafile=str(ca)))) + status, headers, _ = request(auth_url, provider) + callback = headers.get("Location", headers.get("location", "")) + assert status == 302 and callback.startswith(console + "/oauth_callback?"), (status, callback) + values = urllib.parse.parse_qs(urllib.parse.urlparse(callback).query) + callback_status, _, _ = request(callback, client) + status, _, _ = request(console + "/api/v1/login/oauth2/auth", client, + {"code": values["code"][0], "state": values["state"][0]}) + buckets_status, _, _ = request(console + "/api/v1/buckets", client) + # Do not record cookies, codes, JWTs, or the state value. + return {"callback_status": callback_status, "login_status": status, + "buckets_status": buckets_status, "session_cookie": any(c.name == "token" for c in jar)} + + +def run(name, binary, mode="normal", debug=None, tls13=False, + expected=True, trusted=True, oidc=True, oauth=False, add=False): + d = OUT / name + (d / "certs/CAs").mkdir(parents=True, exist_ok=False) + idp = d / "idp" + idp.mkdir() + (idp / "mode").write_text(mode) + with (d / "fixture.jsonl").open("w") as events, (d / "fixture.stderr").open("w") as errors, (d / "server.log").open("w") as logs: + fixture = subprocess.Popen([str(ROOT / "bin/fixture"), "-dir", str(idp), *(["-tls13"] if tls13 else [])], env=BASE, stdout=events, stderr=errors) + server = None + try: + until = time.monotonic() + 5 + while not (idp / "url").is_file() and time.monotonic() < until: + time.sleep(.05) + assert (idp / "url").is_file(), "fixture did not initialize" + url = (idp / "url").read_text() + "/.well-known/openid-configuration" + if trusted: + shutil.copyfile(idp / "ca.pem", d / "certs/CAs/lab.pem") + sport, cport = port(), port() + address = f"127.0.0.1:{sport}" + api, console = "http://" + address, f"http://127.0.0.1:{cport}" + password = secrets.token_urlsafe(24) + env = dict(BASE, MINIO_ROOT_USER="local154", MINIO_ROOT_PASSWORD=password, MINIO_BROWSER="on") + if debug: + env["GODEBUG"] = debug + if oidc: + env.update(MINIO_IDENTITY_OPENID_CONFIG_URL=url, + MINIO_IDENTITY_OPENID_CLIENT_ID="local154", + MINIO_IDENTITY_OPENID_CLIENT_SECRET="local154-placeholder", + MINIO_IDENTITY_OPENID_REDIRECT_URI=console + "/oauth_callback") + server = subprocess.Popen([str(ROOT / "bin" / binary), "--config-dir", str(d / "config"), "--certs-dir", str(d / "certs"), "server", "--address", address, "--console-address", f"127.0.0.1:{cport}", str(d / "data")], env=env, stdout=logs, stderr=subprocess.STDOUT) + until = time.monotonic() + 15 + while time.monotonic() < until: + assert server.poll() is None, "Server exited; inspect its local log" + status, _, _ = request(api + "/minio/health/cluster") + if status == 200 and request(console)[0] == 200: + break + if not expected and (d / "server.log").read_text().count("Waiting for OpenID") >= 2: + break + time.sleep(.1) + result = {"case": name, "binary": binary, "mode": mode, "godebug": debug, "tls13": tls13, + "cluster": request(api + "/minio/health/cluster")[0], + "ready": request(api + "/minio/health/ready")[0], "console": request(console)[0]} + assert result["cluster"] == (200 if expected else 503), result + aenv = dict(BASE, LAB_SERVER=address, LAB_USER="local154", LAB_PASSWORD=password, LAB_OIDC_URL=url) + if expected: + admin = subprocess.run([str(ROOT / "bin/admin-check")], env=aenv, capture_output=True, text=True, timeout=7) + result["admin_list_ok"] = admin.returncode == 0 + assert result["admin_list_ok"], admin.stdout + curl = subprocess.run(["curl", "--cacert", str(idp / "ca.pem"), "--http2", "--max-time", "3", "-sS", "-o", "/dev/null", "-w", "%{http_code} %{http_version}", url], env=BASE, capture_output=True, text=True, timeout=5) + result["curl"] = {"exit": curl.returncode, "status_protocol": curl.stdout} + if add: + attempt = subprocess.run([str(ROOT / "bin/admin-check"), "add"], env=aenv, capture_output=True, text=True, timeout=7) + result["add_ok"] = attempt.returncode == 0 + result["add_reset"] = "connection reset by peer" in attempt.stdout + assert result["add_ok"] == binary.startswith("candidate"), result + if oauth: + result["oauth"] = login(console, idp / "ca.pem") + assert result["oauth"]["login_status"] == 204 and result["oauth"]["buckets_status"] == 200, result + for bad in ("bad-signature", "bad-audience"): + (idp / "mode").write_text(bad) + result[bad] = login(console, idp / "ca.pem") + assert result[bad]["login_status"] >= 400 and result[bad]["buckets_status"] >= 400, result + # Public handshake metadata only; no authorization parameters. + result["events"] = [json.loads(line) for line in (d / "fixture.jsonl").read_text().splitlines()] + (d / "result.json").write_text(json.dumps(result, indent=2) + "\n") + print(json.dumps({k: v for k, v in result.items() if k != "events"}), flush=True) + finally: + if server is not None: + stop(server) + stop(fixture) + + +if __name__ == "__main__": + run("old126-normal", "old-go126") + run("old127-normal", "old-go127") + run("old126-compat", "old-go126", "reject-mlkem", "tlsmlkem=0") + run("old127-compat", "old-go127", "reject-mlkem", "tlsmlkem=0", expected=False) + run("head127-compat", "head-go127", "reject-mlkem", "tlsmlkem=0", expected=False) + run("candidate127-compat-login", "candidate-go127", "reject-mlkem", "tlsmlkem=0", oauth=True) + run("candidate127-no-optout", "candidate-go127", "reject-mlkem", expected=False) + run("candidate127-tls13-login", "candidate-go127", tls13=True, oauth=True) + run("candidate127-untrusted", "candidate-go127", trusted=False, expected=False) + run("candidate127-mldsa", "candidate-go127", "reject-mldsa", "tlsmlkem=0", expected=False) + run("head127-add", "head-go127", "reject-mlkem", "tlsmlkem=0", oidc=False, add=True) + run("candidate127-add", "candidate-go127", "reject-mlkem", "tlsmlkem=0", oidc=False, add=True) diff --git a/internal/config/etcd/etcd.go b/internal/config/etcd/etcd.go index 9af396b2c..09aa2604e 100644 --- a/internal/config/etcd/etcd.go +++ b/internal/config/etcd/etcd.go @@ -166,7 +166,6 @@ func LookupConfig(kvs config.KVS, rootCAs *x509.CertPool) (Config, error) { NextProtos: []string{"http/1.1", "h2"}, ClientSessionCache: tls.NewLRUClientSessionCache(64), CipherSuites: crypto.TLSCiphersBackwardCompatible(), - CurvePreferences: crypto.TLSCurveIDs(), } // This is only to support client side certificate authentication // https://coreos.com/etcd/docs/latest/op-guide/security.html diff --git a/internal/crypto/crypto.go b/internal/crypto/crypto.go index f4a9b943c..d5705aa60 100644 --- a/internal/crypto/crypto.go +++ b/internal/crypto/crypto.go @@ -70,9 +70,3 @@ func TLSCiphersBackwardCompatible() []uint16 { tls.TLS_RSA_WITH_AES_256_CBC_SHA, } } - -// TLSCurveIDs returns a list of supported elliptic curve IDs -// in preference order. -func TLSCurveIDs() []tls.CurveID { - return []tls.CurveID{tls.X25519MLKEM768, tls.CurveP256, tls.X25519, tls.CurveP384, tls.CurveP521} -} diff --git a/internal/http/transports.go b/internal/http/transports.go index d0741268a..61035f2f2 100644 --- a/internal/http/transports.go +++ b/internal/http/transports.go @@ -46,9 +46,8 @@ type ConnSettings struct { DialTimeout time.Duration // TLS Settings - RootCAs *x509.CertPool - CipherSuites []uint16 - CurvePreferences []tls.CurveID + RootCAs *x509.CertPool + CipherSuites []uint16 // HTTP2 EnableHTTP2 bool @@ -70,7 +69,6 @@ func (s ConnSettings) getDefaultTransport(maxIdleConnsPerHost int) *http.Transpo tlsClientConfig := tls.Config{ RootCAs: s.RootCAs, CipherSuites: s.CipherSuites, - CurvePreferences: s.CurvePreferences, ClientSessionCache: tls.NewLRUClientSessionCache(tlsClientSessionCacheSize), }