Repository navigation
Machine Driver Bundle v0.16.6
Security rebuild with official golang.org/x/net 0.62.0 and its required dependency updates, fixing CVE-2026-78661 and CVE-2026-97045. The Go 1.27.3 toolchain, Docker Machine transport/provider APIs and retired Packet boundary remain unchanged. New Packet resources remain disabled.
- Producer commit:
d5bade2722a788f54fe7f3a25af6245336a1e841 - Reviewed PR #4
- Protected-main full tests, race tests, reproducibility, scans and provenance
- Main CodeQL
- Archive SHA-256:
82747659c1c9c866ea0d4b5c8909e36f72445f97f13cdc7324c40f403e28a83d - Docker Machine SHA-256:
8c257c4eec578fd6ae0f198d8ccc5fa449aa00b8a590096489595f2d840e697c - Packet driver SHA-256:
a4146c973254d36f8b1edcd8298c55154db600e24af6226810f4ed9ec4e5fb79
Raw and effective product scans, source scans, CycloneDX SBOMs, exact OpenVEX and source-mode symbol reachability evidence are attached. The raw product report retains exactly two GO-2026-5932 findings for x/crypto 0.58.0; neither binary imports OpenPGP or has a reachable package/function trace. No other finding is exempted. Protected-main provenance was verified against the exact producer commit and workflow before publication.
The initial hash-qualification run correctly failed the old checksum locks and is not counted as a passing release gate. Its preserved bytes were independently reviewed; the subsequent branch and protected-main gates passed without relaxing any check.
This is a new signed numeric release. Existing tags and assets are not replaced. Server integration and deployment are separate operations.