From b7fcf4ec3aa1580f655801002287814692c879ce Mon Sep 17 00:00:00 2001 From: wollomatic Date: Sat, 7 Mar 2026 22:28:39 +0100 Subject: [PATCH 1/5] update email address and PGP key --- SECURITY.md | 31 +++++++++++-------------------- 1 file changed, 11 insertions(+), 20 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 7b75bf4..e500f5a 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -1,5 +1,5 @@ -----BEGIN PGP SIGNED MESSAGE----- -Hash: SHA256 +Hash: SHA512 # Security Policy @@ -11,22 +11,22 @@ As no breaking changes to existing features are planned, only the most recent ve The docker images are signed with cosign. The public key is available in the repository, on [https://wollomatic.de/socket-proxy/cosign.pub](https://wollomatic.de/socket-proxy/cosign.pub) and here: ``` -- -----BEGIN PUBLIC KEY----- +- - -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYdXlfRbkO6KqPU7Khn1mSjbOIaD3 um421A0NeT1wi840iWNp6MVKyj3tpnAyaQcLgd5/22O+eEHY+5+EHwB+eA== -- -----END PUBLIC KEY----- +- - -----END PUBLIC KEY----- ``` The signature is stored at Docker hub as well. For more information about cosign, see [https://github.com/sigstore/cosign#readme](https://github.com/sigstore/cosign#readme). ## Reporting a Vulnerability -Please report vulnerabilities to security2025(at)wollomatic.de +Please report vulnerabilities to git2026(at)wollomatic.dev Feel free to encrypt the message if you like: - +[Download PGP public key 9123F130](http://wollomatic.dev/gpg/9123F130.gpg.asc) ``` -- - -----BEGIN PGP PUBLIC KEY BLOCK----- +- - - -----BEGIN PGP PUBLIC KEY BLOCK----- Comment: Benutzer-ID: Comment: Gültig seit: 30.12.2021 18:15 Comment: Gültig bis: 31.12.2025 12:00 @@ -83,21 +83,12 @@ AGx0J/IYKvNwbYErCoOsqM78lZZ20hvKwDCW1jNEZibqiL98yhQhoEymTu9FHShR WrjWE3RoPNCEPKwCVSh08Y/bVcUyfkDNKkN3l8lT34TIEUOkzdXD2JLL6cogLpn2 Q/PCqEw9 =6UYI -- - -----END PGP PUBLIC KEY BLOCK----- +- - - -----END PGP PUBLIC KEY BLOCK----- ``` -----BEGIN PGP SIGNATURE----- -iQIzBAEBCAAdFiEE1XQkrHwmL0tE9FtXVYa3pNFebKcFAmUlklgACgkQVYa3pNFe -bKf0IA/9ECqre6kojV3oE4KK5JRjHLHCNcwDHcu8WBOcf7gcZmAdkBf3oh3iBB8H -wPhBcE3UWYRwT6dCGiTNct9KmpiB82JWX/kbGWNY501m8UTP04TB4M6Pp0ZowkkR -GQgqcXSgFRyd6wvoVQVuQSLjCWwvjh+jzdQL24l038eskrXN6GaLXQbasCABDcma -VeTe0BMtkQ+5EBRssMFQimgOod37AuMc3haJoAj4tfsJuH4pOCcU4v9NTF1fOc1u -Gz3jty7v4LmQ/qShrYPXR0O5Id2Jttg5yqpYtox3ULN637UXlkGQSEREVep6lgYE -+9zBLm7lyjmX0jBI/YgJxWE8+BVL7SujnIl+MB8Jx9ySh+JYVQ/qDk79hL+1Cykk -TFPtk9OWqjIHXvsePOCIpx5OhzGdV96OI+m5UapNbBw1EfYgEDGmF2R23bMQECVd -HeGYgVeK/PqOc/sP1fVN9c7qbtEplU4AIcys3rugnn4XVsiHTY7SbxoUx+hZnYLO -Dn0/xj8hIaV9kgVwIzIWhfAF47UsxlN162Rx2Kmqyr1INA7TWa+k+v6x5vc5iMul -xTIJoNUgwtjneyZEceNFwJkjfAn1aT4Ruy4R2s0rWkvWYj/rbR9dgWurhgpnjJke -kgnVHf8ZLligrqyP1HNZnm8bYGCnefdmlNPRt91/996219jKq7Y= -=RUM/ +iHUEARYKAB0WIQQX7u5MQzQWc4kIq7Te/gx2oe2rbQUCaayYSQAKCRDe/gx2oe2r +bS2sAP4kY96akK4rUfUhzAnerKF0pw/LV0u6xvNzPNMb9WuPJQD8Cu2ZwsFXDfel +PpKQUQl3LrP4Jc56U3+HCsDyKgRT6gw= +=mFlT -----END PGP SIGNATURE----- From 12f07f16b58395f81e7e30ccaf06e34aa0340e8c Mon Sep 17 00:00:00 2001 From: wollomatic Date: Sat, 7 Mar 2026 22:29:33 +0100 Subject: [PATCH 2/5] update to upcoming version 1.11.4 --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 5aebb80..c873274 100644 --- a/README.md +++ b/README.md @@ -1,7 +1,7 @@ # socket-proxy ## Latest image -- `wollomatic/socket-proxy:1.11.3` / `ghcr.io/wollomatic/socket-proxy:1.11.3` +- `wollomatic/socket-proxy:1.11.4` / `ghcr.io/wollomatic/socket-proxy:1.11.4` - `wollomatic/socket-proxy:1` / `ghcr.io/wollomatic/socket-proxy:1` > [!IMPORTANT] From 05203141f37ac8f39bf6938160da4d8d1a028f01 Mon Sep 17 00:00:00 2001 From: wollomatic Date: Sat, 7 Mar 2026 22:29:51 +0100 Subject: [PATCH 3/5] Go 1.26.1 --- Dockerfile | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 4bb4870..5286614 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,6 @@ # syntax=docker/dockerfile:1 -FROM --platform=$BUILDPLATFORM golang:1.26.0-alpine3.23@sha256:d4c4845f5d60c6a974c6000ce58ae079328d03ab7f721a0734277e69905473e5 AS build + +FROM --platform=$BUILDPLATFORM golang:1.26.1-alpine3.23@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS build WORKDIR /application COPY . ./ ARG TARGETOS From f483f9e87494b0a3034f36b6fa89807dc8618c46 Mon Sep 17 00:00:00 2001 From: wollomatic Date: Sat, 7 Mar 2026 22:33:12 +0100 Subject: [PATCH 4/5] remove unnecessary blank line --- Dockerfile | 1 - 1 file changed, 1 deletion(-) diff --git a/Dockerfile b/Dockerfile index 5286614..4d979cb 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,4 @@ # syntax=docker/dockerfile:1 - FROM --platform=$BUILDPLATFORM golang:1.26.1-alpine3.23@sha256:2389ebfa5b7f43eeafbd6be0c3700cc46690ef842ad962f6c5bd6be49ed82039 AS build WORKDIR /application COPY . ./ From d108ca44db4a9701efef46e73f2481d1a830fe2d Mon Sep 17 00:00:00 2001 From: wollomatic Date: Sat, 7 Mar 2026 22:40:42 +0100 Subject: [PATCH 5/5] fix link --- SECURITY.md | 18 +++++++++--------- 1 file changed, 9 insertions(+), 9 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index e500f5a..2ae0e39 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -11,10 +11,10 @@ As no breaking changes to existing features are planned, only the most recent ve The docker images are signed with cosign. The public key is available in the repository, on [https://wollomatic.de/socket-proxy/cosign.pub](https://wollomatic.de/socket-proxy/cosign.pub) and here: ``` -- - -----BEGIN PUBLIC KEY----- +- - - -----BEGIN PUBLIC KEY----- MFkwEwYHKoZIzj0CAQYIKoZIzj0DAQcDQgAEYdXlfRbkO6KqPU7Khn1mSjbOIaD3 um421A0NeT1wi840iWNp6MVKyj3tpnAyaQcLgd5/22O+eEHY+5+EHwB+eA== -- - -----END PUBLIC KEY----- +- - - -----END PUBLIC KEY----- ``` The signature is stored at Docker hub as well. For more information about cosign, see [https://github.com/sigstore/cosign#readme](https://github.com/sigstore/cosign#readme). @@ -24,9 +24,9 @@ The signature is stored at Docker hub as well. For more information about cosign Please report vulnerabilities to git2026(at)wollomatic.dev Feel free to encrypt the message if you like: -[Download PGP public key 9123F130](http://wollomatic.dev/gpg/9123F130.gpg.asc) +[Download PGP public key 9123F130](https://wollomatic.dev/gpg/9123F130.gpg.asc) ``` -- - - -----BEGIN PGP PUBLIC KEY BLOCK----- +- - - - -----BEGIN PGP PUBLIC KEY BLOCK----- Comment: Benutzer-ID: Comment: Gültig seit: 30.12.2021 18:15 Comment: Gültig bis: 31.12.2025 12:00 @@ -83,12 +83,12 @@ AGx0J/IYKvNwbYErCoOsqM78lZZ20hvKwDCW1jNEZibqiL98yhQhoEymTu9FHShR WrjWE3RoPNCEPKwCVSh08Y/bVcUyfkDNKkN3l8lT34TIEUOkzdXD2JLL6cogLpn2 Q/PCqEw9 =6UYI -- - - -----END PGP PUBLIC KEY BLOCK----- +- - - - -----END PGP PUBLIC KEY BLOCK----- ``` -----BEGIN PGP SIGNATURE----- -iHUEARYKAB0WIQQX7u5MQzQWc4kIq7Te/gx2oe2rbQUCaayYSQAKCRDe/gx2oe2r -bS2sAP4kY96akK4rUfUhzAnerKF0pw/LV0u6xvNzPNMb9WuPJQD8Cu2ZwsFXDfel -PpKQUQl3LrP4Jc56U3+HCsDyKgRT6gw= -=mFlT +iHUEARYKAB0WIQQX7u5MQzQWc4kIq7Te/gx2oe2rbQUCaaybJwAKCRDe/gx2oe2r +bYhkAQCRbh/Bn1+/7sFlP2jU9BKfNUkSy/Ss5PA9DpYlHu4SaAD/RJXH70xYb7jW +t90C39ppKOCFyshcaTWPGWmE5treYQo= +=er7Z -----END PGP SIGNATURE-----