Skip to content

fix: Dockerfile entrypoint #96

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
iverc merged 8 commits into from
Apr 21, 2026
Merged

fix: Dockerfile entrypoint #96

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
8 commits
Select commit Hold shift + click to select a range
6f2c96a
trigger always ci
Lodek Jan 14, 2026
dc97060
remove pipe in entrypoint
Lodek Jan 14, 2026
ec436fb
fix entrypoint
Lodek Jan 15, 2026
ac899cd
Merge branch 'dev' into fix/df-perms
Lodek Feb 11, 2026
e86ac62
Update docker-publish.yml
Lodek Mar 27, 2026
fb99ab9
Update docker-publish.yml
Lodek Mar 27, 2026
bcab643
test: improve docker tests to use testcontainers
Lodek Mar 27, 2026
a5bca5b
Merge remote-tracking branch 'origin/dev' into fix/df-perms
Lodek Mar 27, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion Makefile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -51,4 +51,4 @@ test_env_generator:

.PHONY: docker
docker:
docker image build -t ghcr.io/sourcenetwork/sourcehub:dev .
docker image build -t ghcr.io/sourcenetwork/sourcehub:dev .
4 changes: 2 additions & 2 deletions docker/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ DEFAULT_CHAIN_ID="sourcehub"
DEFAULT_MONIKER="node"
DEV_FACUET_MNEMONIC="comic very pond victory suit tube ginger antique life then core warm loyal deliver iron fashion erupt husband weekend monster sunny artist empty uphold"

if [ ! -d /sourcehub/.initialized ]; then
if [ ! -f /sourcehub/config/genesis.json ]; then
echo "Initializing SourceHub"

if [ -z "$CHAIN_ID" ]; then
Expand All @@ -19,7 +19,7 @@ if [ ! -d /sourcehub/.initialized ]; then
MONIKER=$DEFAULT_MONIKER
fi

sourcehubd init "$MONIKER" --chain-id $CHAIN_ID --default-denom="uopen" 2>/dev/null
sourcehubd init "$MONIKER" --chain-id $CHAIN_ID --default-denom="uopen"

# copy the container specific default config files,
# which overrides some settings such as listening address
Expand Down
55 changes: 37 additions & 18 deletions go.mod
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -54,13 +54,14 @@ require (
github.com/spf13/viper v1.19.0
github.com/stretchr/testify v1.11.1
github.com/tendermint/tendermint v0.35.9
github.com/testcontainers/testcontainers-go v0.41.0
golang.org/x/exp v0.0.0-20251023183803-a4bb9ffd2546
golang.org/x/tools v0.38.0
golang.org/x/tools v0.41.0
google.golang.org/genproto/googleapis/api v0.0.0-20251103181224-f26f9409b101
google.golang.org/grpc v1.76.0
Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 27, 2026 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🌐 Web query:

What is the latest version of google.golang.org/grpc and which versions fix the authorization bypass vulnerability GHSA-p77j-4mvh-x3m3?

💡 Result:

The latest version of google.golang.org/grpc is v1.79.3 (released 2026-03-17). This version fixes the authorization bypass vulnerability GHSA-p77j-4mvh-x3m3. Affected versions are those below v1.79.3; upgrade to v1.79.3 or newer.

Citations:

Upgrade google.golang.org/grpc to v1.79.3 or later to fix authorization bypass vulnerability.

The current version v1.76.0 contains GHSA-p77j-4mvh-x3m3 (CVE GO-2026-4762), a critical authorization bypass vulnerability in the :path header validation. Upgrade to v1.79.3 or newer to resolve this issue.

🧰 Tools
🪛 OSV Scanner (2.3.5)

[CRITICAL] 61-61: google.golang.org/grpc 1.76.0: Authorization bypass in gRPC-Go via missing leading slash in :path in google.golang.org/grpc

(GO-2026-4762)

[CRITICAL] 61-61: google.golang.org/grpc 1.76.0: gRPC-Go has an authorization bypass via missing leading slash in :path

(GHSA-p77j-4mvh-x3m3)

🤖 Prompt for AI Agents 
Verify each finding against the current code and only fix it if needed.

In `@go.mod` at line 61, Update the grpc dependency declaration for
google.golang.org/grpc in go.mod from v1.76.0 to v1.79.3 (or a later patched
release) to address CVE GO-2026-4762; after changing the version string for the
module entry "google.golang.org/grpc", run the module update (go get
google.golang.org/grpc@v1.79.3 or equivalent), then run go mod tidy and the
project test/build to ensure compatibility and resolve any transitive version
changes.

Copy link
Copy Markdown
Contributor

@iverc iverc Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this suggestion is valid

Copy link
Copy Markdown

@coderabbitai coderabbitai Bot Mar 29, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@iverc, confirmed. This is an Authorization Bypass (CWE-285) resulting from Improper Input Validation of the HTTP/2 :path pseudo-header — the gRPC-Go server accepted requests where :path omitted the mandatory leading slash (e.g., Service/Method instead of /Service/Method). While the server successfully routed these requests to the correct handler, authorization interceptors evaluated the raw, non-canonical path string, causing "deny" rules defined using canonical paths to fail to match, allowing requests to bypass the policy if a fallback "allow" rule was present.

The advisory has a CVSS score of 9.1 (Critical). All versions of google.golang.org/grpc below v1.79.3 are affected, and v1.79.3 is the patched release.

Here's the fix for go.mod:

-	google.golang.org/grpc v1.76.0
+	google.golang.org/grpc v1.79.3

Then run:

go get google.golang.org/grpc@v1.79.3
go mod tidy

google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1
google.golang.org/protobuf v1.36.10
gotest.tools/v3 v3.5.1
gotest.tools/v3 v3.5.2
)

require (
Expand Down Expand Up @@ -88,6 +89,7 @@ require (
connectrpc.com/connect v1.18.1 // indirect
connectrpc.com/otelconnect v0.8.0 // indirect
cosmossdk.io/collections v0.4.0 // indirect
dario.cat/mergo v1.0.2 // indirect
filippo.io/edwards25519 v1.1.0 // indirect
github.com/4meepo/tagalign v1.3.4 // indirect
github.com/99designs/go-keychain v0.0.0-20191008050251-8e49817e8af4 // indirect
Expand Down Expand Up @@ -133,12 +135,13 @@ require (
github.com/butuzov/ireturn v0.3.0 // indirect
github.com/butuzov/mirror v1.2.0 // indirect
github.com/bytedance/gopkg v0.1.3 // indirect
github.com/bytedance/sonic v1.14.1 // indirect
github.com/bytedance/sonic/loader v0.3.0 // indirect
github.com/bytedance/sonic v1.15.0 // indirect
github.com/bytedance/sonic/loader v0.5.0 // indirect
github.com/catenacyber/perfsprint v0.7.1 // indirect
github.com/ccojocar/zxcvbn-go v1.0.2 // indirect
github.com/cenkalti/backoff v2.2.1+incompatible // indirect
github.com/cenkalti/backoff/v4 v4.3.0 // indirect
github.com/cenkalti/backoff/v5 v5.0.3 // indirect
github.com/cespare/xxhash/v2 v2.3.0 // indirect
github.com/charithe/durationcheck v0.0.10 // indirect
github.com/chavacava/garif v0.1.0 // indirect
Expand All @@ -157,13 +160,16 @@ require (
github.com/cometbft/cometbft-db v0.14.1 // indirect
github.com/containerd/errdefs v1.0.0 // indirect
github.com/containerd/errdefs/pkg v0.3.0 // indirect
github.com/containerd/log v0.1.0 // indirect
github.com/containerd/platforms v0.2.1 // indirect
github.com/containerd/stargz-snapshotter/estargz v0.17.0 // indirect
github.com/cosmos/btcutil v1.0.5 // indirect
github.com/cosmos/go-bip39 v1.0.0 // indirect
github.com/cosmos/gogogateway v1.2.0 // indirect
github.com/cosmos/iavl v1.2.4 // indirect
github.com/cosmos/ics23/go v0.11.0 // indirect
github.com/cosmos/ledger-cosmos-go v0.14.0 // indirect
github.com/cpuguy83/dockercfg v0.3.2 // indirect
github.com/cpuguy83/go-md2man/v2 v2.0.7 // indirect
github.com/creachadair/atomicfile v0.3.3 // indirect
github.com/creachadair/tomledit v0.0.26 // indirect
Expand All @@ -177,12 +183,13 @@ require (
github.com/distribution/reference v0.6.0 // indirect
github.com/docker/cli v28.4.0+incompatible // indirect
github.com/docker/distribution v2.8.3+incompatible // indirect
github.com/docker/docker v28.4.0+incompatible // indirect
github.com/docker/docker v28.5.2+incompatible // indirect
github.com/docker/docker-credential-helpers v0.9.3 // indirect
github.com/docker/go-connections v0.6.0 // indirect
github.com/docker/go-units v0.5.0 // indirect
github.com/dustin/go-humanize v1.0.1 // indirect
github.com/dvsekhvalnov/jose2go v1.7.0 // indirect
github.com/ebitengine/purego v0.10.0 // indirect
github.com/emicklei/dot v1.6.2 // indirect
github.com/ethereum/go-ethereum v1.16.8 // indirect
github.com/ettle/strcase v0.2.0 // indirect
Expand All @@ -203,6 +210,7 @@ require (
github.com/go-logfmt/logfmt v0.6.0 // indirect
github.com/go-logr/logr v1.4.3 // indirect
github.com/go-logr/stdr v1.2.2 // indirect
github.com/go-ole/go-ole v1.3.0 // indirect
github.com/go-playground/locales v0.14.1 // indirect
github.com/go-playground/universal-translator v0.18.1 // indirect
github.com/go-playground/validator/v10 v10.28.0 // indirect
Expand Down Expand Up @@ -284,7 +292,7 @@ require (
github.com/kilic/bls12-381 v0.1.1-0.20210503002446-7b7597926c69 // indirect
github.com/kisielk/errcheck v1.7.0 // indirect
github.com/kkHAIKE/contextcheck v1.1.5 // indirect
github.com/klauspost/compress v1.18.1 // indirect
github.com/klauspost/compress v1.18.2 // indirect
github.com/klauspost/cpuid/v2 v2.3.0 // indirect
github.com/klauspost/pgzip v1.2.6 // indirect
github.com/kr/pretty v0.3.1 // indirect
Expand All @@ -305,8 +313,9 @@ require (
github.com/lib/pq v1.10.9 // indirect
github.com/linxGnu/grocksdb v1.10.3 // indirect
github.com/lufeee/execinquery v1.2.1 // indirect
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
github.com/macabu/inamedparam v0.1.3 // indirect
github.com/magiconair/properties v1.8.7 // indirect
github.com/magiconair/properties v1.8.10 // indirect
github.com/manifoldco/promptui v0.9.0 // indirect
github.com/maratori/testableexamples v1.0.0 // indirect
github.com/maratori/testpackage v1.1.1 // indirect
Expand All @@ -320,6 +329,11 @@ require (
github.com/mitchellh/go-testing-interface v1.14.1 // indirect
github.com/mitchellh/mapstructure v1.5.0 // indirect
github.com/moby/docker-image-spec v1.3.1 // indirect
github.com/moby/go-archive v0.2.0 // indirect
github.com/moby/patternmatcher v0.6.0 // indirect
github.com/moby/sys/sequential v0.6.0 // indirect
github.com/moby/sys/user v0.4.0 // indirect
github.com/moby/sys/userns v0.1.0 // indirect
github.com/moby/term v0.5.2 // indirect
github.com/moricho/tparallel v0.3.1 // indirect
github.com/morikuni/aec v1.0.0 // indirect
Expand Down Expand Up @@ -350,6 +364,7 @@ require (
github.com/pkg/errors v0.9.1 // indirect
github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
github.com/polyfloyd/go-errorlint v1.5.2 // indirect
github.com/power-devops/perfstat v0.0.0-20240221224432-82ca36839d55 // indirect
github.com/pquerna/cachecontrol v0.2.0 // indirect
github.com/prometheus/client_golang v1.23.2 // indirect
github.com/prometheus/client_model v0.6.2 // indirect
Expand Down Expand Up @@ -381,6 +396,7 @@ require (
github.com/segmentio/asm v1.2.1 // indirect
github.com/segmentio/encoding v0.5.3 // indirect
github.com/shazow/go-diff v0.0.0-20160112020656-b6b7b6733b8c // indirect
github.com/shirou/gopsutil/v4 v4.26.2 // indirect
github.com/sirupsen/logrus v1.9.3 // indirect
github.com/sivchari/containedctx v1.0.3 // indirect
github.com/sivchari/tenv v1.7.1 // indirect
Expand All @@ -404,6 +420,8 @@ require (
github.com/tidwall/btree v1.7.0 // indirect
github.com/timakin/bodyclose v0.0.0-20230421092635-574207250966 // indirect
github.com/timonwong/loggercheck v0.9.4 // indirect
github.com/tklauser/go-sysconf v0.3.16 // indirect
github.com/tklauser/numcpus v0.11.0 // indirect
github.com/tomarrell/wrapcheck/v2 v2.8.3 // indirect
github.com/tommy-muehle/go-mnd/v2 v2.5.1 // indirect
github.com/twitchyliquid64/golang-asm v0.15.1 // indirect
Expand All @@ -416,6 +434,7 @@ require (
github.com/yagipy/maintidx v1.0.0 // indirect
github.com/yeya24/promlinter v0.3.0 // indirect
github.com/ykadowak/zerologlint v0.1.5 // indirect
github.com/yusufpapurcu/wmi v1.2.4 // indirect
github.com/zondax/hid v0.9.2 // indirect
github.com/zondax/ledger-go v0.14.3 // indirect
gitlab.com/bosi/decorder v0.4.2 // indirect
Expand All @@ -430,25 +449,25 @@ require (
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.49.0 // indirect
go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.63.0 // indirect
go.opentelemetry.io/otel v1.38.0 // indirect
go.opentelemetry.io/otel/metric v1.38.0 // indirect
go.opentelemetry.io/otel/trace v1.38.0 // indirect
go.opentelemetry.io/otel v1.41.0 // indirect
go.opentelemetry.io/otel/metric v1.41.0 // indirect
go.opentelemetry.io/otel/trace v1.41.0 // indirect
go.uber.org/automaxprocs v1.5.3 // indirect
go.uber.org/multierr v1.11.0 // indirect
go.uber.org/zap v1.27.0 // indirect
go.yaml.in/yaml/v2 v2.4.3 // indirect
go.yaml.in/yaml/v3 v3.0.4 // indirect
golang.org/x/arch v0.21.0 // indirect
golang.org/x/crypto v0.45.0 // indirect
golang.org/x/crypto v0.48.0 // indirect
golang.org/x/exp/typeparams v0.0.0-20240314144324-c7f7c6466f7f // indirect
golang.org/x/mod v0.29.0 // indirect
golang.org/x/net v0.47.0 // indirect
golang.org/x/mod v0.32.0 // indirect
golang.org/x/net v0.49.0 // indirect
golang.org/x/oauth2 v0.32.0 // indirect
golang.org/x/sync v0.18.0 // indirect
golang.org/x/sys v0.38.0 // indirect
golang.org/x/telemetry v0.0.0-20251008203120-078029d740a8 // indirect
golang.org/x/term v0.37.0 // indirect
golang.org/x/text v0.31.0 // indirect
golang.org/x/sync v0.19.0 // indirect
golang.org/x/sys v0.41.0 // indirect
golang.org/x/telemetry v0.0.0-20260109210033-bd525da824e2 // indirect
golang.org/x/term v0.40.0 // indirect
golang.org/x/text v0.34.0 // indirect
golang.org/x/time v0.12.0 // indirect
google.golang.org/api v0.186.0 // indirect
google.golang.org/genproto v0.0.0-20240701130421-f6361c86f094 // indirect
Expand Down
Loading
Loading