Skip to content

Commit 351e735

Browse files
MoshbbabMoshbbab
authored
Merge branch 'cli:trunk' into trunk
2 parents 6e97c84 + 0cede16 commit 351e735

8 files changed

Lines changed: 273 additions & 783 deletions

File tree

‎.github/SECURITY.md‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -11,6 +11,8 @@ If you believe you have found a security vulnerability in GitHub CLI, you can re
1111

1212
**Please do not report security vulnerabilities through public GitHub issues, discussions, or pull requests.**
1313

14+
A dependency having a CVE does not mean `gh` has a vulnerability. We use [`govulncheck`](https://pkg.go.dev/golang.org/x/vuln/cmd/govulncheck) to determine whether vulnerable symbols are actually reachable from `gh`'s code. If you are reporting a dependency CVE, please include evidence that the issue is exploitable in `gh`: a call chain into the affected symbols or a proof of concept. Reports that only list a dependency version and CVE without demonstrating impact will be closed.
15+
1416
Thanks for helping make GitHub safe for everyone.
1517

1618
[private vulnerability reporting]: https://github.com/cli/cli/security/advisories

‎.github/workflows/codeql.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -48,7 +48,7 @@ jobs:
4848

4949
- name: Filter SARIF for third-party code
5050
if: matrix.language == 'go'
51-
uses: advanced-security/filter-sarif@f3b8118a9349d88f7b1c0c488476411145b6270d # v1.0.1
51+
uses: advanced-security/filter-sarif@2da736ff05ef065cb2894ac6892e47b5eac2c3c0 # v1.1.0.1.1
5252
with:
5353
patterns: |
5454
-third-party/**

‎docs/install_linux.md‎

Lines changed: 44 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -2,6 +2,34 @@
22

33
## Recommended _(Official)_
44

5+
> [!IMPORTANT]
6+
> Our Linux packages and repository metadata are signed with the following PGP key fingerprints:
7+
> - `2C6106201985B60E6C7AC87323F3D4EA75716059`
8+
> - `7F38BBB59D064DBCB3D84D725612B36462313325`
9+
>
10+
> You may be prompted to confirm the import of these keys during installation.
11+
>
12+
> <details><summary>Expand for SHA256/SHA512/MD5 checksums of our official keyring files.</summary>
13+
> <p>
14+
>
15+
> **For security reasons, it is strongly recommended to only rely on SHA256/SHA512 checksums. MD5 checksums below are only for legacy systems where SHA256/SHA512 tooling is not available.**
16+
>
17+
> - `https://cli.github.com/packages/githubcli-archive-keyring.gpg` (Binary):
18+
> ```
19+
> SHA256: 6084d5d7bd8e288441e0e94fc6275570895da18e6751f70f057485dc2d1a811b
20+
> SHA512: ce6b9466dbd2a90b3227e177aa9b8187bd2405b1c29f91d78de83b9699dbbe2af35efd733bf53da622e7a38c59a7bc55539d63a3deaec9ff9c2bff8af626434
21+
> MD5: 23748c0965069fb1edae1b83c17890e1
22+
> ```
23+
> - `https://cli.github.com/packages/githubcli-archive-keyring.asc` (ASCII-armored):
24+
> ```
25+
> SHA256: cec6e9ed82d3949ca5f4428cc968b41ef5e7416cb3653cdfc2a421977663bbfd
26+
> SHA512: 2ca9487d88a508a1c87f06b46ba336b11cc5f20bd83915b4c2acde49d2cffbbce76af1641bf8494c29a765f96bc1fd694ebde2954b28b80dcc76376b6f1b766d
27+
> MD5: 97100400ef48007b69e42be348cc6582
28+
> ```
29+
>
30+
> </p>
31+
> </details>
32+
533
### Debian
634
735
Debian packages are hosted on the [GitHub CLI marketing site](https://cli.github.com/) for various operating systems including:
@@ -33,6 +61,13 @@ sudo apt update
3361
sudo apt install gh
3462
```
3563

64+
> [!TIP]
65+
> To verify PGP keys before installing `gh`, you can run this and match the listed fingerprints with those at the top of this document:
66+
>
67+
> ```shell
68+
> curl -fsSL -o - https://cli.github.com/packages/githubcli-archive-keyring.gpg | gpg --show-keys
69+
> ```
70+
3671
### RPM
3772
3873
RPM packages are hosted on the [GitHub CLI marketing site](https://cli.github.com) for various operating systems including:
@@ -46,6 +81,15 @@ RPM packages are hosted on the [GitHub CLI marketing site](https://cli.github.co
4681
4782
These packages are supported by the GitHub CLI maintainers with updates powered by [GitHub CLI deployment workflow](https://github.com/cli/cli/actions/workflows/deployment.yml).
4883
84+
> [!TIP]
85+
> During installation, you may be prompted to confirm the import of PGP keys. You can verify the keys with the list of fingerprints at the top of this document.
86+
>
87+
> To verify the PGP keys before installing `gh`, you can run the following command and match the listed fingerprints with those at the top of this document:
88+
>
89+
> ```shell
90+
> curl -fsSL -o - https://cli.github.com/packages/githubcli-archive-keyring.asc | gpg --show-keys
91+
> ```
92+
4993
#### DNF5
5094
5195
> [!IMPORTANT]

‎go.mod‎

Lines changed: 46 additions & 46 deletions
Original file line numberDiff line numberDiff line change
@@ -2,8 +2,10 @@ module github.com/cli/cli/v2
22

33
go 1.26.1
44

5+
toolchain go1.26.2
6+
57
require (
6-
charm.land/bubbles/v2 v2.0.0
8+
charm.land/bubbles/v2 v2.1.0
79
charm.land/bubbletea/v2 v2.0.2
810
charm.land/huh/v2 v2.0.3
911
charm.land/lipgloss/v2 v2.0.2
@@ -27,12 +29,12 @@ require (
2729
github.com/gabriel-vasile/mimetype v1.4.13
2830
github.com/gdamore/tcell/v2 v2.13.8
2931
github.com/google/go-cmp v0.7.0
30-
github.com/google/go-containerregistry v0.21.3
32+
github.com/google/go-containerregistry v0.21.4
3133
github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510
3234
github.com/gorilla/websocket v1.5.3
33-
github.com/hashicorp/go-version v1.8.0
35+
github.com/hashicorp/go-version v1.9.0
3436
github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec
35-
github.com/in-toto/attestation v1.1.2
37+
github.com/in-toto/attestation v1.2.0
3638
github.com/joho/godotenv v1.5.1
3739
github.com/kballard/go-shellquote v0.0.0-20180428030007-95032a82bc51
3840
github.com/klauspost/compress v1.18.5
@@ -44,20 +46,20 @@ require (
4446
github.com/opentracing/opentracing-go v1.2.0
4547
github.com/rivo/tview v0.42.0
4648
github.com/shurcooL/githubv4 v0.0.0-20240727222349-48295856cce7
47-
github.com/sigstore/protobuf-specs v0.5.0
49+
github.com/sigstore/protobuf-specs v0.5.1
4850
github.com/sigstore/sigstore-go v1.1.4
4951
github.com/spf13/cobra v1.10.2
5052
github.com/spf13/pflag v1.0.10
5153
github.com/stretchr/testify v1.11.1
5254
github.com/theupdateframework/go-tuf/v2 v2.4.1
5355
github.com/vmihailenco/msgpack/v5 v5.4.1
54-
github.com/yuin/goldmark v1.7.16
56+
github.com/yuin/goldmark v1.8.2
5557
github.com/zalando/go-keyring v0.2.8
56-
golang.org/x/crypto v0.49.0
58+
golang.org/x/crypto v0.50.0
5759
golang.org/x/sync v0.20.0
58-
golang.org/x/term v0.41.0
59-
golang.org/x/text v0.35.0
60-
google.golang.org/grpc v1.79.3
60+
golang.org/x/term v0.42.0
61+
golang.org/x/text v0.36.0
62+
google.golang.org/grpc v1.80.0
6163
google.golang.org/protobuf v1.36.11
6264
gopkg.in/h2non/gock.v1 v1.1.2
6365
gopkg.in/yaml.v3 v3.0.1
@@ -95,36 +97,35 @@ require (
9597
github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
9698
github.com/digitorus/pkcs7 v0.0.0-20230818184609-3a137a874352 // indirect
9799
github.com/dlclark/regexp2 v1.11.5 // indirect
98-
github.com/docker/cli v29.3.0+incompatible // indirect
99-
github.com/docker/distribution v2.8.3+incompatible // indirect
100+
github.com/docker/cli v29.3.1+incompatible // indirect
100101
github.com/docker/docker-credential-helpers v0.9.3 // indirect
101102
github.com/dustin/go-humanize v1.0.1 // indirect
102103
github.com/fatih/color v1.18.0 // indirect
103104
github.com/gdamore/encoding v1.0.1 // indirect
104105
github.com/go-logr/logr v1.4.3 // indirect
105106
github.com/go-logr/stdr v1.2.2 // indirect
106-
github.com/go-openapi/analysis v0.24.1 // indirect
107-
github.com/go-openapi/errors v0.22.6 // indirect
108-
github.com/go-openapi/jsonpointer v0.22.4 // indirect
109-
github.com/go-openapi/jsonreference v0.21.4 // indirect
110-
github.com/go-openapi/loads v0.23.2 // indirect
111-
github.com/go-openapi/runtime v0.29.2 // indirect
112-
github.com/go-openapi/spec v0.22.3 // indirect
113-
github.com/go-openapi/strfmt v0.25.0 // indirect
114-
github.com/go-openapi/swag v0.25.4 // indirect
115-
github.com/go-openapi/swag/cmdutils v0.25.4 // indirect
116-
github.com/go-openapi/swag/conv v0.25.4 // indirect
117-
github.com/go-openapi/swag/fileutils v0.25.4 // indirect
118-
github.com/go-openapi/swag/jsonname v0.25.4 // indirect
119-
github.com/go-openapi/swag/jsonutils v0.25.4 // indirect
120-
github.com/go-openapi/swag/loading v0.25.4 // indirect
121-
github.com/go-openapi/swag/mangling v0.25.4 // indirect
122-
github.com/go-openapi/swag/netutils v0.25.4 // indirect
123-
github.com/go-openapi/swag/stringutils v0.25.4 // indirect
124-
github.com/go-openapi/swag/typeutils v0.25.4 // indirect
125-
github.com/go-openapi/swag/yamlutils v0.25.4 // indirect
126-
github.com/go-openapi/validate v0.25.1 // indirect
127-
github.com/go-viper/mapstructure/v2 v2.4.0 // indirect
107+
github.com/go-openapi/analysis v0.24.3 // indirect
108+
github.com/go-openapi/errors v0.22.7 // indirect
109+
github.com/go-openapi/jsonpointer v0.22.5 // indirect
110+
github.com/go-openapi/jsonreference v0.21.5 // indirect
111+
github.com/go-openapi/loads v0.23.3 // indirect
112+
github.com/go-openapi/runtime v0.29.3 // indirect
113+
github.com/go-openapi/spec v0.22.4 // indirect
114+
github.com/go-openapi/strfmt v0.26.1 // indirect
115+
github.com/go-openapi/swag v0.25.5 // indirect
116+
github.com/go-openapi/swag/cmdutils v0.25.5 // indirect
117+
github.com/go-openapi/swag/conv v0.25.5 // indirect
118+
github.com/go-openapi/swag/fileutils v0.25.5 // indirect
119+
github.com/go-openapi/swag/jsonname v0.25.5 // indirect
120+
github.com/go-openapi/swag/jsonutils v0.25.5 // indirect
121+
github.com/go-openapi/swag/loading v0.25.5 // indirect
122+
github.com/go-openapi/swag/mangling v0.25.5 // indirect
123+
github.com/go-openapi/swag/netutils v0.25.5 // indirect
124+
github.com/go-openapi/swag/stringutils v0.25.5 // indirect
125+
github.com/go-openapi/swag/typeutils v0.25.5 // indirect
126+
github.com/go-openapi/swag/yamlutils v0.25.5 // indirect
127+
github.com/go-openapi/validate v0.25.2 // indirect
128+
github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
128129
github.com/godbus/dbus/v5 v5.2.2 // indirect
129130
github.com/google/certificate-transparency-go v1.3.2 // indirect
130131
github.com/google/uuid v1.6.0 // indirect
@@ -139,7 +140,7 @@ require (
139140
github.com/itchyny/timefmt-go v0.1.6 // indirect
140141
github.com/jedisct1/go-minisign v0.0.0-20241212093149-d2f9f49435c7 // indirect
141142
github.com/lucasb-eyer/go-colorful v1.3.0 // indirect
142-
github.com/mattn/go-runewidth v0.0.20 // indirect
143+
github.com/mattn/go-runewidth v0.0.21 // indirect
143144
github.com/microcosm-cc/bluemonday v1.0.27 // indirect
144145
github.com/mitchellh/copystructure v1.2.0 // indirect
145146
github.com/mitchellh/go-homedir v1.1.0 // indirect
@@ -148,7 +149,7 @@ require (
148149
github.com/muesli/cancelreader v0.2.2 // indirect
149150
github.com/muesli/reflow v0.3.0 // indirect
150151
github.com/muesli/termenv v0.16.0 // indirect
151-
github.com/oklog/ulid v1.3.1 // indirect
152+
github.com/oklog/ulid/v2 v2.1.1 // indirect
152153
github.com/opencontainers/go-digest v1.0.0 // indirect
153154
github.com/opencontainers/image-spec v1.1.1 // indirect
154155
github.com/pkg/errors v0.9.1 // indirect
@@ -162,8 +163,8 @@ require (
162163
github.com/shurcooL/graphql v0.0.0-20230722043721-ed46e5a46466 // indirect
163164
github.com/sigstore/rekor v1.5.0 // indirect
164165
github.com/sigstore/rekor-tiles/v2 v2.0.1 // indirect
165-
github.com/sigstore/sigstore v1.10.4 // indirect
166-
github.com/sigstore/timestamp-authority/v2 v2.0.3 // indirect
166+
github.com/sigstore/sigstore v1.10.5 // indirect
167+
github.com/sigstore/timestamp-authority/v2 v2.0.6 // indirect
167168
github.com/sirupsen/logrus v1.9.4 // indirect
168169
github.com/spf13/cast v1.10.0 // indirect
169170
github.com/stretchr/objx v0.5.2 // indirect
@@ -174,17 +175,16 @@ require (
174175
github.com/vmihailenco/tagparser/v2 v2.0.0 // indirect
175176
github.com/xo/terminfo v0.0.0-20220910002029-abceb7e1c41e // indirect
176177
github.com/yuin/goldmark-emoji v1.0.6 // indirect
177-
go.mongodb.org/mongo-driver v1.17.6 // indirect
178178
go.opentelemetry.io/auto/sdk v1.2.1 // indirect
179-
go.opentelemetry.io/otel v1.39.0 // indirect
180-
go.opentelemetry.io/otel/metric v1.39.0 // indirect
181-
go.opentelemetry.io/otel/trace v1.39.0 // indirect
179+
go.opentelemetry.io/otel v1.42.0 // indirect
180+
go.opentelemetry.io/otel/metric v1.42.0 // indirect
181+
go.opentelemetry.io/otel/trace v1.42.0 // indirect
182182
go.yaml.in/yaml/v3 v3.0.4 // indirect
183183
golang.org/x/mod v0.34.0 // indirect
184-
golang.org/x/net v0.52.0 // indirect
185-
golang.org/x/sys v0.42.0 // indirect
184+
golang.org/x/net v0.53.0 // indirect
185+
golang.org/x/sys v0.43.0 // indirect
186186
golang.org/x/tools v0.43.0 // indirect
187-
google.golang.org/genproto/googleapis/api v0.0.0-20251202230838-ff82c1b0f217 // indirect
188-
google.golang.org/genproto/googleapis/rpc v0.0.0-20251222181119-0a764e51fe1b // indirect
187+
google.golang.org/genproto/googleapis/api v0.0.0-20260316180232-0b37fe3546d5 // indirect
188+
google.golang.org/genproto/googleapis/rpc v0.0.0-20260316180232-0b37fe3546d5 // indirect
189189
gotest.tools/v3 v3.5.2 // indirect
190190
)

0 commit comments

Comments
 (0)