mirror of
https://github.com/hanzoai/notify.git
synced 2026-10-30 15:04:32 +00:00
zeekayandHanzo Dev
bc7c81f256
notifyd reached github.com/hanzoai/kms/sdk/go/kmsclient transitively through
base v1.5.8's plugins/platform. That repo is archived and renamed (kms-v1), so
the module resolves only from the proxy's immutable cache: it cannot take a
push, therefore it cannot take a security fix. Holding secrets code there is
the worst version of that problem.
base v1.5.16 already speaks native ZAP to luxfi/kms, so the bump removes the
dependency outright rather than pinning a patched copy of it. Nothing here
imported the SDK directly; the whole reach was through base.
Two changes the bump forces:
- hanzoai/tasks v1.52.9 (required by base v1.5.16) renamed client.Options
.HostPort to .Address. Same meaning, and it now also accepts a unix socket
path.
- KMSEndpoint is no longer handed to the platform plugin. Base rejects an
http(s) KMS endpoint outright, while notify's own kmsbridge deliberately
rewrites zap:// to http:// because it speaks HTTP. Feeding base the
normalized HTTP endpoint would panic MustRegister at boot. Unset, base uses
its in-cluster ZAP default; notify's own secret reads are untouched.
go vet and the full test suite are clean before and after under CGO_ENABLED=0,
which is how Base ships and now enforces at runtime: 50 packages and 133 test
names, identical on both sides.
Co-authored-by: Hanzo Dev <[email protected]>