Production runs v0.1.2 with two live advisories; README still says pre-deployment #3

New issue

Closed

opened 2026-08-27 03:12:58 +00:00 by jlxq0 · 1 comment

jlxq0 commented 2026-08-27 03:12:58 +00:00

Owner

Copy link

Found while arming branch protection.

The pod

matrix-botfather has been running in matrix on fondue for 41 days, 1/1, 0 restarts, started 2026-07-28T03:58:22Z. Manifests are at oddie-apps/platform:clusters/fondue/matrix/matrix-botfather-{deployment,externalsecret,pvc}.yaml, under the matrix ArgoCD application. The deployment pins forge.oddie.app/jlxq0/matrix-botfather:v0.1.2 and the running imageID matches that tag's Descriptor.digest exactly:

sha256:a7db828366eee48ae8e0b4dc4d5f338b6589b90a3b2ef10763047ad39a2ed8d5

README.md still reads Status: implemented (Rust), pre-deployment. That is wrong and has been for at least 41 days.

The advisories

v0.1.2 was built 2026-06-16 from Cargo.lock with h2 0.4.15 and quinn-proto 0.11.14. Both are now advisories:

• RUSTSEC-2026-0258, h2 unbounded empty DATA frames, published 2026-08-17, fixed in >=0.4.16
• RUSTSEC-2026-0185, remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly, severity 7.5 high, published 2026-06-22, fixed in >=0.11.15

Both are transitive and both are already fixed on main by 1a9576a (cargo update -p h2 -p quinn-proto -> h2 0.4.19, quinn-proto 0.11.17). Nothing has shipped them: the newest release tag is v0.1.2 and there are no release objects.

Whether the bot's own traffic can reach either code path is not established here. quinn arrives through reqwest, h2 through both reqwest and hyper/axum, and the pod does bind BOTFATHER_BIND_ADDR.

What shipping it looks like

clusters/fondue/matrix matches no path-specific rule in platform/renovate.json, so it falls through to BASELINE with automerge: true. A v0.1.3 tag therefore bumps and deploys with nobody performing a merge. Same shape as caldav-mcp.

So: cut v0.1.3 off main (794a25b) and it reaches the cluster unattended, or pin the image by digest first if that is not wanted.

Also

Update README.md so it stops saying pre-deployment.

Found while arming branch protection. ## The pod `matrix-botfather` has been running in `matrix` on fondue for 41 days, 1/1, 0 restarts, started 2026-07-28T03:58:22Z. Manifests are at `oddie-apps/platform:clusters/fondue/matrix/matrix-botfather-{deployment,externalsecret,pvc}.yaml`, under the `matrix` ArgoCD application. The deployment pins `forge.oddie.app/jlxq0/matrix-botfather:v0.1.2` and the running `imageID` matches that tag's `Descriptor.digest` exactly: sha256:a7db828366eee48ae8e0b4dc4d5f338b6589b90a3b2ef10763047ad39a2ed8d5 README.md still reads `Status: implemented (Rust), pre-deployment.` That is wrong and has been for at least 41 days. ## The advisories v0.1.2 was built 2026-06-16 from `Cargo.lock` with `h2 0.4.15` and `quinn-proto 0.11.14`. Both are now advisories: - RUSTSEC-2026-0258, `h2` unbounded empty DATA frames, published 2026-08-17, fixed in >=0.4.16 - RUSTSEC-2026-0185, remote memory exhaustion in `quinn-proto` from unbounded out-of-order stream reassembly, **severity 7.5 high**, published 2026-06-22, fixed in >=0.11.15 Both are transitive and both are already fixed on `main` by 1a9576a (`cargo update -p h2 -p quinn-proto` -> h2 0.4.19, quinn-proto 0.11.17). Nothing has shipped them: the newest release tag is v0.1.2 and there are no release objects. Whether the bot's own traffic can reach either code path is not established here. `quinn` arrives through `reqwest`, `h2` through both `reqwest` and `hyper`/`axum`, and the pod does bind `BOTFATHER_BIND_ADDR`. ## What shipping it looks like `clusters/fondue/matrix` matches no path-specific rule in `platform/renovate.json`, so it falls through to BASELINE with `automerge: true`. A `v0.1.3` tag therefore bumps and deploys with nobody performing a merge. Same shape as `caldav-mcp`. So: cut v0.1.3 off `main` (`794a25b`) and it reaches the cluster unattended, or pin the image by digest first if that is not wanted. ## Also Update README.md so it stops saying pre-deployment.

jlxq0 referenced this issue 2026-08-27 03:16:12 +00:00

docs: drop the stale README status line; record the refspec and mirror pitfalls #4

jlxq0 commented 2026-08-27 03:37:47 +00:00

Author

Owner

Copy link

Shipped. v0.1.3 is running in production.

image published        03:24:42Z
Renovate PR platform#607  03:31Z, automerged 03:32:40Z (BASELINE automerge, no human step)
pod adopted digest     03:35:19Z

v0.1.3 Descriptor.digest   sha256:3994ca8a3541cd80e747a96864e8a0e041c0d9ca9773c5ce2278ec9f6bedefaf
pod imageID                sha256:3994ca8a3541cd80e747a96864e8a0e041c0d9ca9773c5ce2278ec9f6bedefaf

docker manifest inspect -v returns an object rather than an array here (single manifest, linux/amd64), so Descriptor.digest is the right field for this image. Old pod terminated; matrix-botfather-c7897bc78-6dk6j is 1/1, 0 restarts, started 03:35:04Z.

Liveness is end-to-end rather than probe-only: sent list in the DM at 03:36:35Z, the bot received the megolm key, decrypted the m.room.message, and sent an encrypted reply $fYp1UyFsDwQwHahLVJpTpF4kQb940m6eiRYjjAWS7dE 0.8 s later.

README status line deleted rather than updated (#4, merged). Both advisories are closed in the running image.

Shipped. v0.1.3 is running in production. image published 03:24:42Z Renovate PR platform#607 03:31Z, automerged 03:32:40Z (BASELINE automerge, no human step) pod adopted digest 03:35:19Z v0.1.3 Descriptor.digest sha256:3994ca8a3541cd80e747a96864e8a0e041c0d9ca9773c5ce2278ec9f6bedefaf pod imageID sha256:3994ca8a3541cd80e747a96864e8a0e041c0d9ca9773c5ce2278ec9f6bedefaf `docker manifest inspect -v` returns an object rather than an array here (single manifest, linux/amd64), so `Descriptor.digest` is the right field for this image. Old pod terminated; `matrix-botfather-c7897bc78-6dk6j` is 1/1, 0 restarts, started 03:35:04Z. Liveness is end-to-end rather than probe-only: sent `list` in the DM at 03:36:35Z, the bot received the megolm key, decrypted the `m.room.message`, and sent an encrypted reply `$fYp1UyFsDwQwHahLVJpTpF4kQb940m6eiRYjjAWS7dE` 0.8 s later. README status line deleted rather than updated (#4, merged). Both advisories are closed in the running image.

jlxq0 closed this issue 2026-08-27 03:37:47 +00:00

jlxq0 referenced this issue 2026-08-28 01:28:56 +00:00

Possible: mint a per-bot credential for cross-signing, if matrix-mcp#139 finds UIA needs a password #5

Sign in to join this conversation.

No Branch/Tag specified

Branches Tags

main

v0.1.3

v0.1.2

v0.1.1

v0.1.0

Labels

Clear labels   

waiting-on-julian

Blocked on Julian. The ask is in the issue.

No labels

waiting-on-julian

Milestone

Clear milestone

No items

No milestone

Projects

Clear projects

No items

No project

Assignees

Clear assignees

No assignees

1 participant

Notifications

Subscribe

Due date

The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference

jlxq0/matrix-botfather#3

No description provided.