jcoffey-dev
b7f99b49f2
GHSA-2v4p-qf9q-27wj is a panic in gRPC-Go's xDS routing interceptor: a request arriving with neither `:authority` nor `Host` indexes an empty slice, the per-RPC goroutine does not recover, and the process dies. High, and nine alerts, because nine go.mod files pin the same version -- eight directly, terraform indirectly. Nothing here was reachable. The interceptor is installed by `xds.NewGRPCServer`, which this repo never calls: the one production server is `grpc.NewServer(grpc.Creds(...))` in ingest/internal/grpcserver and the only other is a plain one in a searchclient test. That is also why security-scan has been green throughout -- govulncheck reports on reachability and found nothing on 1.83.1, while Dependabot reports on version ranges and found nine. Both were right. Taken anyway: it is a patch release, and the next advisory in this dependency may well land somewhere we do reach. `go mod tidy` carried the indirect requirements grpc 1.83.2 asks for -- x/net, x/text, x/sys and friends. No CI job builds or tests Go here, so all nine modules were built locally and api, ingest and enterprise tested with -count=1, since a cached pass would not have exercised the new version. The dependabot.yml is the other half. There was no config, so nothing opened a PR against any of this. Go majors stay out of the group, being import path changes rather than bumps.
proto
Shared .proto contracts. Source of truth for the agent↔ingest gRPC
service; each language generates its own bindings from these files rather
than sharing generated code across languages.
sentry/logs/v1/logs.proto—LogIngest.PushBatch, the data-plane RPC an agent calls to ship log records.sentry/agent/v1/agent_control.proto—AgentControl.CheckIn, the control-plane RPC an agent calls (on its own heartbeat ticker, same push-not-pull posture) to report its config and fetch any remote override -- see /docs/agent-management-design.md. Same mTLS connection/listener asLogIngest, a second service on it rather than a second protocol.
Go bindings
Go is the one language here with pre-generated, checked-in bindings
(sentry/logs/v1/logs.pb.go, logs_grpc.pb.go), living in this directory
as its own module (github.com/cairnobs/cairnobs/proto) that /ingest and
/api depend on via a local replace directive in their go.mod. Rust
(/agent) instead generates its bindings at build time via tonic-build
(see agent/cairnobs-agent/build.rs) — no checked-in Rust output.
To regenerate the Go bindings after changing either .proto file:
go install google.golang.org/protobuf/cmd/protoc-gen-go@latest
go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@latest
cd proto
protoc --go_out=. --go_opt=paths=source_relative \
--go-grpc_out=. --go-grpc_opt=paths=source_relative \
sentry/logs/v1/logs.proto sentry/agent/v1/agent_control.proto
go build ./...