build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates#7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
dependabot wants to merge 2 commits into from
Closed

build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates #7

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f92cc9
feat: harden dual-ended acceleration stack
cppla Aug 22, 2026
dfbded8
build(deps): bump the hardened-quic-minor-and-patch group
dependabot[bot] Aug 22, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
29 changes: 29 additions & 0 deletions .github/dependabot.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,30 @@ updates:
- minor
- patch

- package-ecosystem: gomod
directory: /third_party/hysteria-core
schedule:
interval: weekly
day: monday
open-pull-requests-limit: 3
groups:
hardened-core-minor-and-patch:
update-types:
- minor
- patch

- package-ecosystem: gomod
directory: /third_party/quic-go
schedule:
interval: weekly
day: monday
open-pull-requests-limit: 3
groups:
hardened-quic-minor-and-patch:
update-types:
- minor
- patch

- package-ecosystem: github-actions
directory: /
schedule:
Expand All@@ -24,6 +48,11 @@ updates:
update-types:
- minor
- patch
exclude-patterns:
- github/codeql-action/*
codeql-actions:
patterns:
- github/codeql-action/*

- package-ecosystem: docker
directory: /
Expand Down
78 changes: 58 additions & 20 deletions .github/workflows/ci.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -22,21 +22,36 @@ jobs:
matrix:
go: [1.25.x, 1.27.x]
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: ${{ matrix.go }}
cache: true
- name: Verify formatting
run: make fmt-check
- name: Verify local-fork provenance
run: make fork-provenance-check
- name: Verify module files
run: make mod-check
- name: Verify third-party notices
run: make notices-check
- name: Vet
run: make vet
- name: Test with coverage
run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
- name: Test hardened Hysteria module
working-directory: third_party/hysteria-core
run: go test -shuffle=on -count=1 ./...
- name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
working-directory: third_party/quic-go
run: |
go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
- name: Test Chrome fingerprint, datagrams, and path MTU discovery
working-directory: third_party/quic-go
run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
- name: Upload coverage
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: coverage-go-${{ matrix.go }}
path: coverage.out
Expand All@@ -46,24 +61,32 @@ jobs:
name: Race detector
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: 1.27.x
cache: true
- run: make race
- name: Race-test hardened Hysteria resource limits
working-directory: third_party/hysteria-core
run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
- name: Race-test hardened QUIC admission and loss recovery
working-directory: third_party/quic-go
run: |
go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler

vulnerability-scan:
name: Reachable vulnerability scan
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: 1.27.x
cache: true
- name: Run govulncheck
run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
run: ./scripts/govulncheck.sh

build:
name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
Expand All@@ -74,19 +97,27 @@ jobs:
include:
- goos: linux
goarch: amd64
output: autocar-linux-amd64
artifact: autocar-linux-amd64
binary: autocar
archive: autocar-linux-amd64.tar.gz
- goos: linux
goarch: arm64
output: autocar-linux-arm64
artifact: autocar-linux-arm64
binary: autocar
archive: autocar-linux-arm64.tar.gz
- goos: darwin
goarch: arm64
output: autocar-darwin-arm64
artifact: autocar-darwin-arm64
binary: autocar
archive: autocar-darwin-arm64.tar.gz
- goos: windows
goarch: amd64
output: autocar-windows-amd64.exe
artifact: autocar-windows-amd64
binary: autocar.exe
archive: autocar-windows-amd64.zip
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: 1.27.x
cache: true
Expand All@@ -96,19 +127,26 @@ jobs:
GOOS: ${{ matrix.goos }}
GOARCH: ${{ matrix.goarch }}
run: |
mkdir -p dist
go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
- uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
mkdir -p dist/package
go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
if [ "${{ matrix.goos }}" = "windows" ]; then
(cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
else
tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
fi
test -s "dist/${{ matrix.archive }}"
- uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: ${{ matrix.output }}
path: dist/${{ matrix.output }}
name: ${{ matrix.artifact }}
path: dist/${{ matrix.archive }}
if-no-files-found: error

container:
name: Multi-platform container build
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- name: Build OCI image index
run: |
docker buildx create --name autocar-ci --driver docker-container --use
Expand Down
8 changes: 4 additions & 4 deletions .github/workflows/codeql.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -22,17 +22,17 @@ jobs:
name: Analyze Go
runs-on: ubuntu-24.04
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: 1.27.x
cache: true
- uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
- uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
with:
languages: go
build-mode: manual
- name: Build
run: go build -o /tmp/autocar-codeql ./cmd/autocar
- uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
- uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
with:
category: /language:go
6 changes: 3 additions & 3 deletions .github/workflows/netem.yml
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -19,8 +19,8 @@ jobs:
runs-on: ubuntu-24.04
timeout-minutes: 15
steps:
- uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
- uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
- uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
- uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
with:
go-version: 1.27.x
cache: true
Expand All@@ -32,7 +32,7 @@ jobs:
run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
- name: Publish measurements and diagnostics
if: always()
uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
with:
name: netem-results
path: artifacts/netem
Expand Down
9 changes: 7 additions & 2 deletions Dockerfile
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,9 @@ WORKDIR /src
RUN apk add --no-cache ca-certificates

COPY go.mod go.sum ./
# Local replace directives are resolved during go mod download, so make the
# audited module forks available before dependency resolution.
COPY third_party ./third_party
RUN go mod download

COPY . .
Expand All@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
FROM --platform=$TARGETPLATFORM scratch

LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
org.opencontainers.image.licenses="Apache-2.0"
org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
org.opencontainers.image.licenses="MIT"

COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /out/autocar /autocar
COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md

USER 65532:65532
EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp
Expand Down
46 changes: 38 additions & 8 deletions Makefile
View file
Open in desktop
Original file line numberDiff line numberDiff line change
Expand Up@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)

.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean

all: check build

check: fmt-check mod-check vet test
check: fmt-check fork-provenance-check mod-check notices-check vet test

fmt:
$(GO) fmt ./...

fmt-check:
@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }

fork-provenance-check:
./scripts/check-fork-provenance.sh

mod-check:
$(GO) mod tidy
git diff --exit-code -- go.mod go.sum
cd third_party/hysteria-core && $(GO) mod tidy
cd third_party/quic-go && $(GO) mod tidy
git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum

notices:
$(GO) run ./tools/notices

notices-check:
$(GO) run ./tools/notices -check

vet:
$(GO) vet ./...
cd third_party/hysteria-core && $(GO) vet ./...
cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler

test:
$(GO) test -shuffle=on -count=1 ./...
Expand All@@ -37,12 +50,29 @@ build:
mkdir -p $(dir $(BINARY))
CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar

cross-build:
cross-build: notices-check
mkdir -p dist
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
rm -rf dist/.release-stage-autocar
mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
rm -rf dist/.release-stage-autocar

release: cross-build

docker:
docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .
Expand Down
Loading
Loading
, 'i'); if (__m === '*' || __re.test(location.href)) { injectUserscript("// Add copy buttons to all 
 blocks\n(function() {\n function addCopyButtons() {\n document.querySelectorAll('pre code').forEach(function(codeBlock) {\n if (codeBlock.parentElement.hasAttribute('data-copy-added')) return;\n codeBlock.parentElement.setAttribute('data-copy-added', 'true');\n \n var btn = document.createElement('button');\n btn.textContent = 'Copy';\n btn.style.cssText = 'position:absolute;top:4px;right:4px;padding:2px 8px;font-size:11px;background:#4ecdc4;border:none;border-radius:4px;color:#1a1a2e;cursor:pointer;opacity:0.7;transition:opacity 0.2s;';\n btn.onmouseover = function() { this.style.opacity = '1'; };\n btn.onmouseout = function() { this.style.opacity = '0.7'; };\n btn.onclick = function() {\n navigator.clipboard.writeText(codeBlock.textContent).then(function() {\n btn.textContent = 'Copied!';\n setTimeout(function() { btn.textContent = 'Copy'; }, 1500);\n });\n };\n codeBlock.parentElement.style.position = 'relative';\n codeBlock.parentElement.appendChild(btn);\n });\n }\n \n addCopyButtons();\n \n // Re-run on dynamic content\n var observer = new MutationObserver(addCopyButtons);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Add Copy Buttons to Code Blocks");
}
} catch(__e) { console.warn('[Userscript:Add Copy Buttons to Code Blocks]', __e); }
})();
(function(){
try {
var __m = "github.com";
var __re = new RegExp('^' + "github\\.com" + '

Skip to content
build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates#7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dependabot
wants to merge
2
commits into

from

 Closed


build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates
#7
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
0f92cc9

feat: harden dual-ended acceleration stack


cppla Aug 22, 2026
dfbded8

build(deps): bump the hardened-quic-minor-and-patch group


dependabot[bot] Aug 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

29 changes: 29 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,30 @@ updates:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/hysteria-core
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-core-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/quic-go
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-quic-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: github-actions
 directory: /
 schedule:
Expand All@@ -24,6 +48,11 @@ updates:
 update-types:
 - minor
 - patch
 exclude-patterns:
 - github/codeql-action/*
 codeql-actions:
 patterns:
 - github/codeql-action/*

 - package-ecosystem: docker
 directory: /
Expand Down

78 changes: 58 additions & 20 deletions
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,21 +22,36 @@ jobs:
 matrix:
 go: [1.25.x, 1.27.x]
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: ${{ matrix.go }}
 cache: true
 - name: Verify formatting
 run: make fmt-check
 - name: Verify local-fork provenance
 run: make fork-provenance-check
 - name: Verify module files
 run: make mod-check
 - name: Verify third-party notices
 run: make notices-check
 - name: Vet
 run: make vet
 - name: Test with coverage
 run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
 - name: Test hardened Hysteria module
 working-directory: third_party/hysteria-core
 run: go test -shuffle=on -count=1 ./...
 - name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
 working-directory: third_party/quic-go
 run: |
 go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
 - name: Test Chrome fingerprint, datagrams, and path MTU discovery
 working-directory: third_party/quic-go
 run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
 - name: Upload coverage
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: coverage-go-${{ matrix.go }}
 path: coverage.out
Expand All@@ -46,24 +61,32 @@ jobs:
 name: Race detector
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - run: make race
 - name: Race-test hardened Hysteria resource limits
 working-directory: third_party/hysteria-core
 run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
 - name: Race-test hardened QUIC admission and loss recovery
 working-directory: third_party/quic-go
 run: |
 go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler

 vulnerability-scan:
 name: Reachable vulnerability scan
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - name: Run govulncheck
 run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
 run: ./scripts/govulncheck.sh

 build:
 name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
Expand All@@ -74,19 +97,27 @@ jobs:
 include:
 - goos: linux
 goarch: amd64
 output: autocar-linux-amd64
 artifact: autocar-linux-amd64
 binary: autocar
 archive: autocar-linux-amd64.tar.gz
 - goos: linux
 goarch: arm64
 output: autocar-linux-arm64
 artifact: autocar-linux-arm64
 binary: autocar
 archive: autocar-linux-arm64.tar.gz
 - goos: darwin
 goarch: arm64
 output: autocar-darwin-arm64
 artifact: autocar-darwin-arm64
 binary: autocar
 archive: autocar-darwin-arm64.tar.gz
 - goos: windows
 goarch: amd64
 output: autocar-windows-amd64.exe
 artifact: autocar-windows-amd64
 binary: autocar.exe
 archive: autocar-windows-amd64.zip
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -96,19 +127,26 @@ jobs:
 GOOS: ${{ matrix.goos }}
 GOARCH: ${{ matrix.goarch }}
 run: |
 mkdir -p dist
 go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 mkdir -p dist/package
 go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
 cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
 if [ "${{ matrix.goos }}" = "windows" ]; then
 (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
 else
 tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
 fi
 test -s "dist/${{ matrix.archive }}"
 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ matrix.output }}
 path: dist/${{ matrix.output }}
 name: ${{ matrix.artifact }}
 path: dist/${{ matrix.archive }}
 if-no-files-found: error

 container:
 name: Multi-platform container build
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - name: Build OCI image index
 run: |
 docker buildx create --name autocar-ci --driver docker-container --use
Expand Down

8 changes: 4 additions & 4 deletions
.github/workflows/codeql.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,17 +22,17 @@ jobs:
 name: Analyze Go
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 languages: go
 build-mode: manual
 - name: Build
 run: go build -o /tmp/autocar-codeql ./cmd/autocar
 - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 category: /language:go

6 changes: 3 additions & 3 deletions
.github/workflows/netem.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,8 +19,8 @@ jobs:
 runs-on: ubuntu-24.04
 timeout-minutes: 15
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -32,7 +32,7 @@ jobs:
 run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
 - name: Publish measurements and diagnostics
 if: always()
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: netem-results
 path: artifacts/netem
Expand Down

9 changes: 7 additions & 2 deletions
Dockerfile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,9 @@ WORKDIR /src
RUN apk add --no-cache ca-certificates

COPY go.mod go.sum ./
# Local replace directives are resolved during go mod download, so make the
# audited module forks available before dependency resolution.
COPY third_party ./third_party
RUN go mod download

COPY . .
Expand All@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
FROM --platform=$TARGETPLATFORM scratch

LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
 org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
 org.opencontainers.image.licenses="Apache-2.0"
 org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
 org.opencontainers.image.licenses="MIT"

COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /out/autocar /autocar
COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md

USER 65532:65532
EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp
Expand Down

46 changes: 38 additions & 8 deletions
Makefile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
	-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
	-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)

.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean

all: check build

check: fmt-check mod-check vet test
check: fmt-check fork-provenance-check mod-check notices-check vet test

fmt:
	$(GO) fmt ./...

fmt-check:
	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }

fork-provenance-check:
	./scripts/check-fork-provenance.sh

mod-check:
	$(GO) mod tidy
	git diff --exit-code -- go.mod go.sum
	cd third_party/hysteria-core && $(GO) mod tidy
	cd third_party/quic-go && $(GO) mod tidy
	git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum

notices:
	$(GO) run ./tools/notices

notices-check:
	$(GO) run ./tools/notices -check

vet:
	$(GO) vet ./...
	cd third_party/hysteria-core && $(GO) vet ./...
	cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler

test:
	$(GO) test -shuffle=on -count=1 ./...
Expand All@@ -37,12 +50,29 @@ build:
	mkdir -p $(dir $(BINARY))
	CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar

cross-build:
cross-build: notices-check
	mkdir -p dist
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
	rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
	rm -rf dist/.release-stage-autocar
	mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
	mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
	mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
	mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
	tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
	rm -rf dist/.release-stage-autocar

release: cross-build

docker:
	docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Force GitHub README to respect dark mode\n(function() {\n var style = document.createElement('style');\n style.textContent = '\n .markdown-body {\n color-scheme: dark light;\n }\n .markdown-body pre { background: #161b22 !important; }\n .markdown-body code { background: rgba(110, 118, 129, 0.4) !important; }\n .markdown-body table th, .markdown-body table td { border-color: #30363d !important; }\n .markdown-body img { background: #0d1117; }\n .markdown-body blockquote { border-left-color: #8b949e; }\n .markdown-body hr { border-color: #30363d; }\n ';\n document.head.appendChild(style);\n})();", "GitHub Dark Mode README Fix");
}
} catch(__e) { console.warn('[Userscript:GitHub Dark Mode README Fix]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates#7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dependabot
wants to merge
2
commits into

from

 Closed


build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates
#7
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
0f92cc9

feat: harden dual-ended acceleration stack


cppla Aug 22, 2026
dfbded8

build(deps): bump the hardened-quic-minor-and-patch group


dependabot[bot] Aug 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

29 changes: 29 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,30 @@ updates:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/hysteria-core
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-core-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/quic-go
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-quic-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: github-actions
 directory: /
 schedule:
Expand All@@ -24,6 +48,11 @@ updates:
 update-types:
 - minor
 - patch
 exclude-patterns:
 - github/codeql-action/*
 codeql-actions:
 patterns:
 - github/codeql-action/*

 - package-ecosystem: docker
 directory: /
Expand Down

78 changes: 58 additions & 20 deletions
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,21 +22,36 @@ jobs:
 matrix:
 go: [1.25.x, 1.27.x]
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: ${{ matrix.go }}
 cache: true
 - name: Verify formatting
 run: make fmt-check
 - name: Verify local-fork provenance
 run: make fork-provenance-check
 - name: Verify module files
 run: make mod-check
 - name: Verify third-party notices
 run: make notices-check
 - name: Vet
 run: make vet
 - name: Test with coverage
 run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
 - name: Test hardened Hysteria module
 working-directory: third_party/hysteria-core
 run: go test -shuffle=on -count=1 ./...
 - name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
 working-directory: third_party/quic-go
 run: |
 go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
 - name: Test Chrome fingerprint, datagrams, and path MTU discovery
 working-directory: third_party/quic-go
 run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
 - name: Upload coverage
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: coverage-go-${{ matrix.go }}
 path: coverage.out
Expand All@@ -46,24 +61,32 @@ jobs:
 name: Race detector
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - run: make race
 - name: Race-test hardened Hysteria resource limits
 working-directory: third_party/hysteria-core
 run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
 - name: Race-test hardened QUIC admission and loss recovery
 working-directory: third_party/quic-go
 run: |
 go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler

 vulnerability-scan:
 name: Reachable vulnerability scan
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - name: Run govulncheck
 run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
 run: ./scripts/govulncheck.sh

 build:
 name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
Expand All@@ -74,19 +97,27 @@ jobs:
 include:
 - goos: linux
 goarch: amd64
 output: autocar-linux-amd64
 artifact: autocar-linux-amd64
 binary: autocar
 archive: autocar-linux-amd64.tar.gz
 - goos: linux
 goarch: arm64
 output: autocar-linux-arm64
 artifact: autocar-linux-arm64
 binary: autocar
 archive: autocar-linux-arm64.tar.gz
 - goos: darwin
 goarch: arm64
 output: autocar-darwin-arm64
 artifact: autocar-darwin-arm64
 binary: autocar
 archive: autocar-darwin-arm64.tar.gz
 - goos: windows
 goarch: amd64
 output: autocar-windows-amd64.exe
 artifact: autocar-windows-amd64
 binary: autocar.exe
 archive: autocar-windows-amd64.zip
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -96,19 +127,26 @@ jobs:
 GOOS: ${{ matrix.goos }}
 GOARCH: ${{ matrix.goarch }}
 run: |
 mkdir -p dist
 go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 mkdir -p dist/package
 go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
 cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
 if [ "${{ matrix.goos }}" = "windows" ]; then
 (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
 else
 tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
 fi
 test -s "dist/${{ matrix.archive }}"
 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ matrix.output }}
 path: dist/${{ matrix.output }}
 name: ${{ matrix.artifact }}
 path: dist/${{ matrix.archive }}
 if-no-files-found: error

 container:
 name: Multi-platform container build
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - name: Build OCI image index
 run: |
 docker buildx create --name autocar-ci --driver docker-container --use
Expand Down

8 changes: 4 additions & 4 deletions
.github/workflows/codeql.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,17 +22,17 @@ jobs:
 name: Analyze Go
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 languages: go
 build-mode: manual
 - name: Build
 run: go build -o /tmp/autocar-codeql ./cmd/autocar
 - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 category: /language:go

6 changes: 3 additions & 3 deletions
.github/workflows/netem.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,8 +19,8 @@ jobs:
 runs-on: ubuntu-24.04
 timeout-minutes: 15
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -32,7 +32,7 @@ jobs:
 run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
 - name: Publish measurements and diagnostics
 if: always()
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: netem-results
 path: artifacts/netem
Expand Down

9 changes: 7 additions & 2 deletions
Dockerfile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,9 @@ WORKDIR /src
RUN apk add --no-cache ca-certificates

COPY go.mod go.sum ./
# Local replace directives are resolved during go mod download, so make the
# audited module forks available before dependency resolution.
COPY third_party ./third_party
RUN go mod download

COPY . .
Expand All@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
FROM --platform=$TARGETPLATFORM scratch

LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
 org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
 org.opencontainers.image.licenses="Apache-2.0"
 org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
 org.opencontainers.image.licenses="MIT"

COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /out/autocar /autocar
COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md

USER 65532:65532
EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp
Expand Down

46 changes: 38 additions & 8 deletions
Makefile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
	-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
	-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)

.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean

all: check build

check: fmt-check mod-check vet test
check: fmt-check fork-provenance-check mod-check notices-check vet test

fmt:
	$(GO) fmt ./...

fmt-check:
	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }

fork-provenance-check:
	./scripts/check-fork-provenance.sh

mod-check:
	$(GO) mod tidy
	git diff --exit-code -- go.mod go.sum
	cd third_party/hysteria-core && $(GO) mod tidy
	cd third_party/quic-go && $(GO) mod tidy
	git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum

notices:
	$(GO) run ./tools/notices

notices-check:
	$(GO) run ./tools/notices -check

vet:
	$(GO) vet ./...
	cd third_party/hysteria-core && $(GO) vet ./...
	cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler

test:
	$(GO) test -shuffle=on -count=1 ./...
Expand All@@ -37,12 +50,29 @@ build:
	mkdir -p $(dir $(BINARY))
	CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar

cross-build:
cross-build: notices-check
	mkdir -p dist
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
	rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
	rm -rf dist/.release-stage-autocar
	mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
	mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
	mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
	mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
	tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
	rm -rf dist/.release-stage-autocar

release: cross-build

docker:
	docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Highlight search terms from Google/DuckDuckGo/Bing referrer\n(function() {\n var ref = document.referrer;\n var terms = [];\n \n if (ref.includes('google.com') || ref.includes('duckduckgo.com') || ref.includes('bing.com')) {\n var url = new URL(ref);\n var q = url.searchParams.get('q') || url.searchParams.get('p');\n if (q) {\n terms = q.split(/\\s+/).filter(function(t) { return t.length > 2; });\n }\n }\n \n if (terms.length === 0) return;\n \n var style = document.createElement('style');\n style.textContent = '.userscript-highlight { background: #fbbf24; color: #1a1a2e; padding: 1px 3px; border-radius: 2px; }';\n document.head.appendChild(style);\n \n function highlight(node) {\n if (node.nodeType === 3) { // text node\n var text = node.textContent;\n var found = false;\n terms.forEach(function(term) {\n var regex = new RegExp('(' + term.replace(/[.*+?^${}()|[\\]\\\\]/g, '\\\\') + ')', 'gi');\n if (regex.test(text)) {\n found = true;\n var frag = document.createDocumentFragment();\n var parts = text.split(regex);\n parts.forEach(function(part, i) {\n if (i % 2 === 0) {\n frag.appendChild(document.createTextNode(part));\n } else {\n var span = document.createElement('span');\n span.className = 'userscript-highlight';\n span.textContent = part;\n frag.appendChild(span);\n }\n });\n node.parentNode.replaceChild(frag, node);\n }\n });\n } else if (node.nodeType === 1 && node.childNodes) { // element\n var skipTags = ['SCRIPT', 'STYLE', 'NOSCRIPT', 'TEXTAREA', 'INPUT', 'SELECT'];\n if (!skipTags.includes(node.tagName)) {\n Array.from(node.childNodes).forEach(highlight);\n }\n }\n }\n \n highlight(document.body);\n \n // Re-highlight on dynamic content\n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1 || node.nodeType === 3) highlight(node);\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Highlight Search Terms");
}
} catch(__e) { console.warn('[Userscript:Highlight Search Terms]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates#7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dependabot
wants to merge
2
commits into

from

 Closed


build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates
#7
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
0f92cc9

feat: harden dual-ended acceleration stack


cppla Aug 22, 2026
dfbded8

build(deps): bump the hardened-quic-minor-and-patch group


dependabot[bot] Aug 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

29 changes: 29 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,30 @@ updates:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/hysteria-core
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-core-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/quic-go
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-quic-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: github-actions
 directory: /
 schedule:
Expand All@@ -24,6 +48,11 @@ updates:
 update-types:
 - minor
 - patch
 exclude-patterns:
 - github/codeql-action/*
 codeql-actions:
 patterns:
 - github/codeql-action/*

 - package-ecosystem: docker
 directory: /
Expand Down

78 changes: 58 additions & 20 deletions
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,21 +22,36 @@ jobs:
 matrix:
 go: [1.25.x, 1.27.x]
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: ${{ matrix.go }}
 cache: true
 - name: Verify formatting
 run: make fmt-check
 - name: Verify local-fork provenance
 run: make fork-provenance-check
 - name: Verify module files
 run: make mod-check
 - name: Verify third-party notices
 run: make notices-check
 - name: Vet
 run: make vet
 - name: Test with coverage
 run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
 - name: Test hardened Hysteria module
 working-directory: third_party/hysteria-core
 run: go test -shuffle=on -count=1 ./...
 - name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
 working-directory: third_party/quic-go
 run: |
 go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
 - name: Test Chrome fingerprint, datagrams, and path MTU discovery
 working-directory: third_party/quic-go
 run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
 - name: Upload coverage
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: coverage-go-${{ matrix.go }}
 path: coverage.out
Expand All@@ -46,24 +61,32 @@ jobs:
 name: Race detector
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - run: make race
 - name: Race-test hardened Hysteria resource limits
 working-directory: third_party/hysteria-core
 run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
 - name: Race-test hardened QUIC admission and loss recovery
 working-directory: third_party/quic-go
 run: |
 go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler

 vulnerability-scan:
 name: Reachable vulnerability scan
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - name: Run govulncheck
 run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
 run: ./scripts/govulncheck.sh

 build:
 name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
Expand All@@ -74,19 +97,27 @@ jobs:
 include:
 - goos: linux
 goarch: amd64
 output: autocar-linux-amd64
 artifact: autocar-linux-amd64
 binary: autocar
 archive: autocar-linux-amd64.tar.gz
 - goos: linux
 goarch: arm64
 output: autocar-linux-arm64
 artifact: autocar-linux-arm64
 binary: autocar
 archive: autocar-linux-arm64.tar.gz
 - goos: darwin
 goarch: arm64
 output: autocar-darwin-arm64
 artifact: autocar-darwin-arm64
 binary: autocar
 archive: autocar-darwin-arm64.tar.gz
 - goos: windows
 goarch: amd64
 output: autocar-windows-amd64.exe
 artifact: autocar-windows-amd64
 binary: autocar.exe
 archive: autocar-windows-amd64.zip
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -96,19 +127,26 @@ jobs:
 GOOS: ${{ matrix.goos }}
 GOARCH: ${{ matrix.goarch }}
 run: |
 mkdir -p dist
 go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 mkdir -p dist/package
 go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
 cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
 if [ "${{ matrix.goos }}" = "windows" ]; then
 (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
 else
 tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
 fi
 test -s "dist/${{ matrix.archive }}"
 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ matrix.output }}
 path: dist/${{ matrix.output }}
 name: ${{ matrix.artifact }}
 path: dist/${{ matrix.archive }}
 if-no-files-found: error

 container:
 name: Multi-platform container build
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - name: Build OCI image index
 run: |
 docker buildx create --name autocar-ci --driver docker-container --use
Expand Down

8 changes: 4 additions & 4 deletions
.github/workflows/codeql.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,17 +22,17 @@ jobs:
 name: Analyze Go
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 languages: go
 build-mode: manual
 - name: Build
 run: go build -o /tmp/autocar-codeql ./cmd/autocar
 - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 category: /language:go

6 changes: 3 additions & 3 deletions
.github/workflows/netem.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,8 +19,8 @@ jobs:
 runs-on: ubuntu-24.04
 timeout-minutes: 15
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -32,7 +32,7 @@ jobs:
 run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
 - name: Publish measurements and diagnostics
 if: always()
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: netem-results
 path: artifacts/netem
Expand Down

9 changes: 7 additions & 2 deletions
Dockerfile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,9 @@ WORKDIR /src
RUN apk add --no-cache ca-certificates

COPY go.mod go.sum ./
# Local replace directives are resolved during go mod download, so make the
# audited module forks available before dependency resolution.
COPY third_party ./third_party
RUN go mod download

COPY . .
Expand All@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
FROM --platform=$TARGETPLATFORM scratch

LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
 org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
 org.opencontainers.image.licenses="Apache-2.0"
 org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
 org.opencontainers.image.licenses="MIT"

COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /out/autocar /autocar
COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md

USER 65532:65532
EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp
Expand Down

46 changes: 38 additions & 8 deletions
Makefile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
	-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
	-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)

.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean

all: check build

check: fmt-check mod-check vet test
check: fmt-check fork-provenance-check mod-check notices-check vet test

fmt:
	$(GO) fmt ./...

fmt-check:
	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }

fork-provenance-check:
	./scripts/check-fork-provenance.sh

mod-check:
	$(GO) mod tidy
	git diff --exit-code -- go.mod go.sum
	cd third_party/hysteria-core && $(GO) mod tidy
	cd third_party/quic-go && $(GO) mod tidy
	git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum

notices:
	$(GO) run ./tools/notices

notices-check:
	$(GO) run ./tools/notices -check

vet:
	$(GO) vet ./...
	cd third_party/hysteria-core && $(GO) vet ./...
	cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler

test:
	$(GO) test -shuffle=on -count=1 ./...
Expand All@@ -37,12 +50,29 @@ build:
	mkdir -p $(dir $(BINARY))
	CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar

cross-build:
cross-build: notices-check
	mkdir -p dist
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
	rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
	rm -rf dist/.release-stage-autocar
	mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
	mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
	mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
	mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
	tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
	rm -rf dist/.release-stage-autocar

release: cross-build

docker:
	docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Strip utm_, fbclid, gclid, etc. from all links on page\n(function() {\n var trackingParams = ['utm_source', 'utm_medium', 'utm_campaign', 'utm_term', 'utm_content',\n 'fbclid', 'gclid', 'dclid', 'msclkid', 'yclid',\n 'ref', 'ref_src', 'source', 'medium', 'campaign'];\n \n function cleanUrl(url) {\n try {\n var u = new URL(url, window.location.origin);\n var changed = false;\n trackingParams.forEach(function(p) {\n if (u.searchParams.has(p)) {\n u.searchParams.delete(p);\n changed = true;\n }\n });\n return changed ? u.toString() : url;\n } catch (e) {\n return url;\n }\n }\n \n function cleanLinks() {\n document.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n \n cleanLinks();\n \n var observer = new MutationObserver(function(mutations) {\n mutations.forEach(function(m) {\n m.addedNodes.forEach(function(node) {\n if (node.nodeType === 1) {\n if (node.tagName === 'A') cleanLinks();\n node.querySelectorAll('a[href]').forEach(function(a) {\n var clean = cleanUrl(a.href);\n if (clean !== a.href) a.href = clean;\n });\n }\n });\n });\n });\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "Remove Tracking Parameters from Links");
}
} catch(__e) { console.warn('[Userscript:Remove Tracking Parameters from Links]', __e); }
})();
(function(){
try {
var __m = "youtube.com";
var __re = new RegExp('^' + "youtube\\.com" + '

Skip to content
build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates#7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dependabot
wants to merge
2
commits into

from

 Closed


build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates
#7
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
0f92cc9

feat: harden dual-ended acceleration stack


cppla Aug 22, 2026
dfbded8

build(deps): bump the hardened-quic-minor-and-patch group


dependabot[bot] Aug 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

29 changes: 29 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,30 @@ updates:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/hysteria-core
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-core-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/quic-go
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-quic-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: github-actions
 directory: /
 schedule:
Expand All@@ -24,6 +48,11 @@ updates:
 update-types:
 - minor
 - patch
 exclude-patterns:
 - github/codeql-action/*
 codeql-actions:
 patterns:
 - github/codeql-action/*

 - package-ecosystem: docker
 directory: /
Expand Down

78 changes: 58 additions & 20 deletions
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,21 +22,36 @@ jobs:
 matrix:
 go: [1.25.x, 1.27.x]
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: ${{ matrix.go }}
 cache: true
 - name: Verify formatting
 run: make fmt-check
 - name: Verify local-fork provenance
 run: make fork-provenance-check
 - name: Verify module files
 run: make mod-check
 - name: Verify third-party notices
 run: make notices-check
 - name: Vet
 run: make vet
 - name: Test with coverage
 run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
 - name: Test hardened Hysteria module
 working-directory: third_party/hysteria-core
 run: go test -shuffle=on -count=1 ./...
 - name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
 working-directory: third_party/quic-go
 run: |
 go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
 - name: Test Chrome fingerprint, datagrams, and path MTU discovery
 working-directory: third_party/quic-go
 run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
 - name: Upload coverage
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: coverage-go-${{ matrix.go }}
 path: coverage.out
Expand All@@ -46,24 +61,32 @@ jobs:
 name: Race detector
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - run: make race
 - name: Race-test hardened Hysteria resource limits
 working-directory: third_party/hysteria-core
 run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
 - name: Race-test hardened QUIC admission and loss recovery
 working-directory: third_party/quic-go
 run: |
 go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler

 vulnerability-scan:
 name: Reachable vulnerability scan
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - name: Run govulncheck
 run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
 run: ./scripts/govulncheck.sh

 build:
 name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
Expand All@@ -74,19 +97,27 @@ jobs:
 include:
 - goos: linux
 goarch: amd64
 output: autocar-linux-amd64
 artifact: autocar-linux-amd64
 binary: autocar
 archive: autocar-linux-amd64.tar.gz
 - goos: linux
 goarch: arm64
 output: autocar-linux-arm64
 artifact: autocar-linux-arm64
 binary: autocar
 archive: autocar-linux-arm64.tar.gz
 - goos: darwin
 goarch: arm64
 output: autocar-darwin-arm64
 artifact: autocar-darwin-arm64
 binary: autocar
 archive: autocar-darwin-arm64.tar.gz
 - goos: windows
 goarch: amd64
 output: autocar-windows-amd64.exe
 artifact: autocar-windows-amd64
 binary: autocar.exe
 archive: autocar-windows-amd64.zip
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -96,19 +127,26 @@ jobs:
 GOOS: ${{ matrix.goos }}
 GOARCH: ${{ matrix.goarch }}
 run: |
 mkdir -p dist
 go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 mkdir -p dist/package
 go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
 cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
 if [ "${{ matrix.goos }}" = "windows" ]; then
 (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
 else
 tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
 fi
 test -s "dist/${{ matrix.archive }}"
 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ matrix.output }}
 path: dist/${{ matrix.output }}
 name: ${{ matrix.artifact }}
 path: dist/${{ matrix.archive }}
 if-no-files-found: error

 container:
 name: Multi-platform container build
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - name: Build OCI image index
 run: |
 docker buildx create --name autocar-ci --driver docker-container --use
Expand Down

8 changes: 4 additions & 4 deletions
.github/workflows/codeql.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,17 +22,17 @@ jobs:
 name: Analyze Go
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 languages: go
 build-mode: manual
 - name: Build
 run: go build -o /tmp/autocar-codeql ./cmd/autocar
 - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 category: /language:go

6 changes: 3 additions & 3 deletions
.github/workflows/netem.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,8 +19,8 @@ jobs:
 runs-on: ubuntu-24.04
 timeout-minutes: 15
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -32,7 +32,7 @@ jobs:
 run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
 - name: Publish measurements and diagnostics
 if: always()
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: netem-results
 path: artifacts/netem
Expand Down

9 changes: 7 additions & 2 deletions
Dockerfile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,9 @@ WORKDIR /src
RUN apk add --no-cache ca-certificates

COPY go.mod go.sum ./
# Local replace directives are resolved during go mod download, so make the
# audited module forks available before dependency resolution.
COPY third_party ./third_party
RUN go mod download

COPY . .
Expand All@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
FROM --platform=$TARGETPLATFORM scratch

LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
 org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
 org.opencontainers.image.licenses="Apache-2.0"
 org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
 org.opencontainers.image.licenses="MIT"

COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /out/autocar /autocar
COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md

USER 65532:65532
EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp
Expand Down

46 changes: 38 additions & 8 deletions
Makefile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
	-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
	-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)

.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean

all: check build

check: fmt-check mod-check vet test
check: fmt-check fork-provenance-check mod-check notices-check vet test

fmt:
	$(GO) fmt ./...

fmt-check:
	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }

fork-provenance-check:
	./scripts/check-fork-provenance.sh

mod-check:
	$(GO) mod tidy
	git diff --exit-code -- go.mod go.sum
	cd third_party/hysteria-core && $(GO) mod tidy
	cd third_party/quic-go && $(GO) mod tidy
	git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum

notices:
	$(GO) run ./tools/notices

notices-check:
	$(GO) run ./tools/notices -check

vet:
	$(GO) vet ./...
	cd third_party/hysteria-core && $(GO) vet ./...
	cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler

test:
	$(GO) test -shuffle=on -count=1 ./...
Expand All@@ -37,12 +50,29 @@ build:
	mkdir -p $(dir $(BINARY))
	CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar

cross-build:
cross-build: notices-check
	mkdir -p dist
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
	rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
	rm -rf dist/.release-stage-autocar
	mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
	mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
	mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
	mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
	tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
	rm -rf dist/.release-stage-autocar

release: cross-build

docker:
	docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Auto-enable theater mode on YouTube\n(function() {\n function tryTheater() {\n var btn = document.querySelector('button[aria-label=\"Theater mode\"], ytd-player #player button[title=\"Theater mode\"]');\n if (btn && !btn.classList.contains('activated')) {\n btn.click();\n }\n }\n \n // Try immediately\n tryTheater();\n \n // Try after navigation (SPA)\n var lastUrl = location.href;\n setInterval(function() {\n if (location.href !== lastUrl) {\n lastUrl = location.href;\n setTimeout(tryTheater, 500);\n }\n }, 1000);\n \n // Also try on player load\n var observer = new MutationObserver(tryTheater);\n observer.observe(document.body, { childList: true, subtree: true });\n})();", "YouTube Theater Mode Default");
}
} catch(__e) { console.warn('[Userscript:YouTube Theater Mode Default]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates#7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dependabot
wants to merge
2
commits into

from

 Closed


build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates
#7
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
0f92cc9

feat: harden dual-ended acceleration stack


cppla Aug 22, 2026
dfbded8

build(deps): bump the hardened-quic-minor-and-patch group


dependabot[bot] Aug 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

29 changes: 29 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,30 @@ updates:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/hysteria-core
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-core-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/quic-go
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-quic-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: github-actions
 directory: /
 schedule:
Expand All@@ -24,6 +48,11 @@ updates:
 update-types:
 - minor
 - patch
 exclude-patterns:
 - github/codeql-action/*
 codeql-actions:
 patterns:
 - github/codeql-action/*

 - package-ecosystem: docker
 directory: /
Expand Down

78 changes: 58 additions & 20 deletions
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,21 +22,36 @@ jobs:
 matrix:
 go: [1.25.x, 1.27.x]
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: ${{ matrix.go }}
 cache: true
 - name: Verify formatting
 run: make fmt-check
 - name: Verify local-fork provenance
 run: make fork-provenance-check
 - name: Verify module files
 run: make mod-check
 - name: Verify third-party notices
 run: make notices-check
 - name: Vet
 run: make vet
 - name: Test with coverage
 run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
 - name: Test hardened Hysteria module
 working-directory: third_party/hysteria-core
 run: go test -shuffle=on -count=1 ./...
 - name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
 working-directory: third_party/quic-go
 run: |
 go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
 - name: Test Chrome fingerprint, datagrams, and path MTU discovery
 working-directory: third_party/quic-go
 run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
 - name: Upload coverage
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: coverage-go-${{ matrix.go }}
 path: coverage.out
Expand All@@ -46,24 +61,32 @@ jobs:
 name: Race detector
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - run: make race
 - name: Race-test hardened Hysteria resource limits
 working-directory: third_party/hysteria-core
 run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
 - name: Race-test hardened QUIC admission and loss recovery
 working-directory: third_party/quic-go
 run: |
 go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler

 vulnerability-scan:
 name: Reachable vulnerability scan
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - name: Run govulncheck
 run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
 run: ./scripts/govulncheck.sh

 build:
 name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
Expand All@@ -74,19 +97,27 @@ jobs:
 include:
 - goos: linux
 goarch: amd64
 output: autocar-linux-amd64
 artifact: autocar-linux-amd64
 binary: autocar
 archive: autocar-linux-amd64.tar.gz
 - goos: linux
 goarch: arm64
 output: autocar-linux-arm64
 artifact: autocar-linux-arm64
 binary: autocar
 archive: autocar-linux-arm64.tar.gz
 - goos: darwin
 goarch: arm64
 output: autocar-darwin-arm64
 artifact: autocar-darwin-arm64
 binary: autocar
 archive: autocar-darwin-arm64.tar.gz
 - goos: windows
 goarch: amd64
 output: autocar-windows-amd64.exe
 artifact: autocar-windows-amd64
 binary: autocar.exe
 archive: autocar-windows-amd64.zip
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -96,19 +127,26 @@ jobs:
 GOOS: ${{ matrix.goos }}
 GOARCH: ${{ matrix.goarch }}
 run: |
 mkdir -p dist
 go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 mkdir -p dist/package
 go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
 cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
 if [ "${{ matrix.goos }}" = "windows" ]; then
 (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
 else
 tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
 fi
 test -s "dist/${{ matrix.archive }}"
 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ matrix.output }}
 path: dist/${{ matrix.output }}
 name: ${{ matrix.artifact }}
 path: dist/${{ matrix.archive }}
 if-no-files-found: error

 container:
 name: Multi-platform container build
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - name: Build OCI image index
 run: |
 docker buildx create --name autocar-ci --driver docker-container --use
Expand Down

8 changes: 4 additions & 4 deletions
.github/workflows/codeql.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,17 +22,17 @@ jobs:
 name: Analyze Go
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 languages: go
 build-mode: manual
 - name: Build
 run: go build -o /tmp/autocar-codeql ./cmd/autocar
 - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 category: /language:go

6 changes: 3 additions & 3 deletions
.github/workflows/netem.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,8 +19,8 @@ jobs:
 runs-on: ubuntu-24.04
 timeout-minutes: 15
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -32,7 +32,7 @@ jobs:
 run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
 - name: Publish measurements and diagnostics
 if: always()
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: netem-results
 path: artifacts/netem
Expand Down

9 changes: 7 additions & 2 deletions
Dockerfile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,9 @@ WORKDIR /src
RUN apk add --no-cache ca-certificates

COPY go.mod go.sum ./
# Local replace directives are resolved during go mod download, so make the
# audited module forks available before dependency resolution.
COPY third_party ./third_party
RUN go mod download

COPY . .
Expand All@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
FROM --platform=$TARGETPLATFORM scratch

LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
 org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
 org.opencontainers.image.licenses="Apache-2.0"
 org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
 org.opencontainers.image.licenses="MIT"

COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /out/autocar /autocar
COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md

USER 65532:65532
EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp
Expand Down

46 changes: 38 additions & 8 deletions
Makefile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
	-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
	-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)

.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean

all: check build

check: fmt-check mod-check vet test
check: fmt-check fork-provenance-check mod-check notices-check vet test

fmt:
	$(GO) fmt ./...

fmt-check:
	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }

fork-provenance-check:
	./scripts/check-fork-provenance.sh

mod-check:
	$(GO) mod tidy
	git diff --exit-code -- go.mod go.sum
	cd third_party/hysteria-core && $(GO) mod tidy
	cd third_party/quic-go && $(GO) mod tidy
	git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum

notices:
	$(GO) run ./tools/notices

notices-check:
	$(GO) run ./tools/notices -check

vet:
	$(GO) vet ./...
	cd third_party/hysteria-core && $(GO) vet ./...
	cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler

test:
	$(GO) test -shuffle=on -count=1 ./...
Expand All@@ -37,12 +50,29 @@ build:
	mkdir -p $(dir $(BINARY))
	CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar

cross-build:
cross-build: notices-check
	mkdir -p dist
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
	rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
	rm -rf dist/.release-stage-autocar
	mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
	mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
	mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
	mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
	tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
	rm -rf dist/.release-stage-autocar

release: cross-build

docker:
	docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Remove or un-stick sticky/fixed headers that block content\n(function() {\n function unstick() {\n document.querySelectorAll('header, nav, [role=\"banner\"], .header, .navbar, .sticky, .fixed-top, [style*=\"position: fixed\"], [style*=\"position:sticky\"]').forEach(function(el) {\n if (el.style.position === 'fixed' || el.style.position === 'sticky' || \n getComputedStyle(el).position === 'fixed' || getComputedStyle(el).position === 'sticky') {\n el.style.position = 'static';\n el.style.top = 'auto';\n el.style.zIndex = 'auto';\n }\n });\n }\n \n unstick();\n \n var observer = new MutationObserver(unstick);\n observer.observe(document.body, { childList: true, subtree: true, attributes: true, attributeFilter: ['style', 'class'] });\n})();", "Kill Sticky Headers");
}
} catch(__e) { console.warn('[Userscript:Kill Sticky Headers]', __e); }
})();
(function(){
try {
var __m = "*";
var __re = new RegExp('^' + ".*" + '

Skip to content
build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates#7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dependabot
wants to merge
2
commits into

from

 Closed


build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates
#7
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
0f92cc9

feat: harden dual-ended acceleration stack


cppla Aug 22, 2026
dfbded8

build(deps): bump the hardened-quic-minor-and-patch group


dependabot[bot] Aug 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

29 changes: 29 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,30 @@ updates:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/hysteria-core
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-core-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/quic-go
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-quic-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: github-actions
 directory: /
 schedule:
Expand All@@ -24,6 +48,11 @@ updates:
 update-types:
 - minor
 - patch
 exclude-patterns:
 - github/codeql-action/*
 codeql-actions:
 patterns:
 - github/codeql-action/*

 - package-ecosystem: docker
 directory: /
Expand Down

78 changes: 58 additions & 20 deletions
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,21 +22,36 @@ jobs:
 matrix:
 go: [1.25.x, 1.27.x]
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: ${{ matrix.go }}
 cache: true
 - name: Verify formatting
 run: make fmt-check
 - name: Verify local-fork provenance
 run: make fork-provenance-check
 - name: Verify module files
 run: make mod-check
 - name: Verify third-party notices
 run: make notices-check
 - name: Vet
 run: make vet
 - name: Test with coverage
 run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
 - name: Test hardened Hysteria module
 working-directory: third_party/hysteria-core
 run: go test -shuffle=on -count=1 ./...
 - name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
 working-directory: third_party/quic-go
 run: |
 go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
 - name: Test Chrome fingerprint, datagrams, and path MTU discovery
 working-directory: third_party/quic-go
 run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
 - name: Upload coverage
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: coverage-go-${{ matrix.go }}
 path: coverage.out
Expand All@@ -46,24 +61,32 @@ jobs:
 name: Race detector
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - run: make race
 - name: Race-test hardened Hysteria resource limits
 working-directory: third_party/hysteria-core
 run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
 - name: Race-test hardened QUIC admission and loss recovery
 working-directory: third_party/quic-go
 run: |
 go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler

 vulnerability-scan:
 name: Reachable vulnerability scan
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - name: Run govulncheck
 run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
 run: ./scripts/govulncheck.sh

 build:
 name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
Expand All@@ -74,19 +97,27 @@ jobs:
 include:
 - goos: linux
 goarch: amd64
 output: autocar-linux-amd64
 artifact: autocar-linux-amd64
 binary: autocar
 archive: autocar-linux-amd64.tar.gz
 - goos: linux
 goarch: arm64
 output: autocar-linux-arm64
 artifact: autocar-linux-arm64
 binary: autocar
 archive: autocar-linux-arm64.tar.gz
 - goos: darwin
 goarch: arm64
 output: autocar-darwin-arm64
 artifact: autocar-darwin-arm64
 binary: autocar
 archive: autocar-darwin-arm64.tar.gz
 - goos: windows
 goarch: amd64
 output: autocar-windows-amd64.exe
 artifact: autocar-windows-amd64
 binary: autocar.exe
 archive: autocar-windows-amd64.zip
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -96,19 +127,26 @@ jobs:
 GOOS: ${{ matrix.goos }}
 GOARCH: ${{ matrix.goarch }}
 run: |
 mkdir -p dist
 go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 mkdir -p dist/package
 go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
 cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
 if [ "${{ matrix.goos }}" = "windows" ]; then
 (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
 else
 tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
 fi
 test -s "dist/${{ matrix.archive }}"
 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ matrix.output }}
 path: dist/${{ matrix.output }}
 name: ${{ matrix.artifact }}
 path: dist/${{ matrix.archive }}
 if-no-files-found: error

 container:
 name: Multi-platform container build
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - name: Build OCI image index
 run: |
 docker buildx create --name autocar-ci --driver docker-container --use
Expand Down

8 changes: 4 additions & 4 deletions
.github/workflows/codeql.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,17 +22,17 @@ jobs:
 name: Analyze Go
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 languages: go
 build-mode: manual
 - name: Build
 run: go build -o /tmp/autocar-codeql ./cmd/autocar
 - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 category: /language:go

6 changes: 3 additions & 3 deletions
.github/workflows/netem.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,8 +19,8 @@ jobs:
 runs-on: ubuntu-24.04
 timeout-minutes: 15
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -32,7 +32,7 @@ jobs:
 run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
 - name: Publish measurements and diagnostics
 if: always()
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: netem-results
 path: artifacts/netem
Expand Down

9 changes: 7 additions & 2 deletions
Dockerfile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,9 @@ WORKDIR /src
RUN apk add --no-cache ca-certificates

COPY go.mod go.sum ./
# Local replace directives are resolved during go mod download, so make the
# audited module forks available before dependency resolution.
COPY third_party ./third_party
RUN go mod download

COPY . .
Expand All@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
FROM --platform=$TARGETPLATFORM scratch

LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
 org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
 org.opencontainers.image.licenses="Apache-2.0"
 org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
 org.opencontainers.image.licenses="MIT"

COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /out/autocar /autocar
COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md

USER 65532:65532
EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp
Expand Down

46 changes: 38 additions & 8 deletions
Makefile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
	-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
	-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)

.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean

all: check build

check: fmt-check mod-check vet test
check: fmt-check fork-provenance-check mod-check notices-check vet test

fmt:
	$(GO) fmt ./...

fmt-check:
	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }

fork-provenance-check:
	./scripts/check-fork-provenance.sh

mod-check:
	$(GO) mod tidy
	git diff --exit-code -- go.mod go.sum
	cd third_party/hysteria-core && $(GO) mod tidy
	cd third_party/quic-go && $(GO) mod tidy
	git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum

notices:
	$(GO) run ./tools/notices

notices-check:
	$(GO) run ./tools/notices -check

vet:
	$(GO) vet ./...
	cd third_party/hysteria-core && $(GO) vet ./...
	cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler

test:
	$(GO) test -shuffle=on -count=1 ./...
Expand All@@ -37,12 +50,29 @@ build:
	mkdir -p $(dir $(BINARY))
	CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar

cross-build:
cross-build: notices-check
	mkdir -p dist
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
	rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
	rm -rf dist/.release-stage-autocar
	mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
	mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
	mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
	mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
	tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
	rm -rf dist/.release-stage-autocar

release: cross-build

docker:
	docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .
Expand Down
Loading
Loading

, 'i');
if (__m === '*' || __re.test(location.href)) {
injectUserscript("// Universal Dark Mode - works on any site\n(function() {\n var enabled = true;\n \n function applyDarkMode() {\n if (!enabled) return;\n \n // Create style element if it doesn't exist\n var style = document.getElementById('universal-dark-mode-style');\n if (!style) {\n style = document.createElement('style');\n style.id = 'universal-dark-mode-style';\n document.head.appendChild(style);\n }\n \n // Dark mode CSS - inverts colors but preserves images/video\n style.textContent = '\n /* Invert everything except media */\n html {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #1a1a2e !important;\n }\n \n /* Restore images, videos, iframes, canvas */\n img, video, iframe, canvas, svg, picture, [style*=\"background-image\"] {\n filter: invert(1) hue-rotate(180deg) !important;\n }\n \n /* Preserve specific elements that should not be inverted */\n .no-dark-mode, .no-dark-mode *,\n [data-theme=\"light\"], [data-theme=\"light\"],\n .ace_editor, .ace_editor *,\n .CodeMirror, .CodeMirror *,\n .monaco-editor, .monaco-editor *,\n .markdown-body pre, .markdown-body pre *,\n .highlight, .highlight *,\n pre code, pre code * {\n filter: none !important;\n }\n \n /* Fix common UI elements */\n .modal, .popup, .dropdown-menu, .tooltip, .popover {\n filter: invert(1) hue-rotate(180deg) !important;\n background: #2d2d44 !important;\n border-color: #444 !important;\n }\n \n /* Scrollbars */\n ::-webkit-scrollbar { background: #1a1a2e !important; }\n ::-webkit-scrollbar-thumb { background: #444 !important; }\n ::-webkit-scrollbar-thumb:hover { background: #555 !important; }\n \n /* Selection */\n ::selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ::-moz-selection { background: #4ecdc4 !important; color: #1a1a2e !important; }\n ';\n }\n \n function removeDarkMode() {\n var style = document.getElementById('universal-dark-mode-style');\n if (style) style.remove();\n }\n \n // Toggle with Alt+Shift+D\n document.addEventListener('keydown', function(e) {\n if (e.altKey && e.shiftKey && e.key === 'D') {\n e.preventDefault();\n enabled = !enabled;\n if (enabled) {\n applyDarkMode();\n console.log('[Universal Dark Mode] Enabled');\n } else {\n removeDarkMode();\n console.log('[Universal Dark Mode] Disabled');\n }\n }\n });\n \n // Apply on load\n applyDarkMode();\n \n // Re-apply on dynamic content\n var observer = new MutationObserver(function(mutations) {\n if (enabled && !document.getElementById('universal-dark-mode-style')) {\n applyDarkMode();\n }\n });\n observer.observe(document.head, { childList: true });\n \n console.log('[Universal Dark Mode] Loaded - Press Alt+Shift+D to toggle');\n})();", "Universal Dark Mode");
}
} catch(__e) { console.warn('[Userscript:Universal Dark Mode]', __e); }
})();
})();

Skip to content
build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates#7

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

 Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and
privacy statement. We’ll occasionally send you account related emails.

Already on GitHub?
Sign in
to your account

 Closed

dependabot
wants to merge
2
commits into

from

 Closed


build(deps): bump the hardened-quic-minor-and-patch group in /third_party/quic-go with 4 updates
#7
Show file tree
Hide file tree
 Changes from all commits
Commits

Show all changes


2 commits


Select commit
Hold shift + click to select a range
0f92cc9

feat: harden dual-ended acceleration stack


cppla Aug 22, 2026
dfbded8

build(deps): bump the hardened-quic-minor-and-patch group


dependabot[bot] Aug 22, 2026

File filter

Filter by extension
Filter by extension
Conversations

Failed to load comments. 
Loading
Jump to

The table of contents is too big for display.

 Diff view

 Diff view

  •  
  •  
  •  

29 changes: 29 additions & 0 deletions
.github/dependabot.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -13,6 +13,30 @@ updates:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/hysteria-core
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-core-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: gomod
 directory: /third_party/quic-go
 schedule:
 interval: weekly
 day: monday
 open-pull-requests-limit: 3
 groups:
 hardened-quic-minor-and-patch:
 update-types:
 - minor
 - patch

 - package-ecosystem: github-actions
 directory: /
 schedule:
Expand All@@ -24,6 +48,11 @@ updates:
 update-types:
 - minor
 - patch
 exclude-patterns:
 - github/codeql-action/*
 codeql-actions:
 patterns:
 - github/codeql-action/*

 - package-ecosystem: docker
 directory: /
Expand Down

78 changes: 58 additions & 20 deletions
.github/workflows/ci.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,21 +22,36 @@ jobs:
 matrix:
 go: [1.25.x, 1.27.x]
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: ${{ matrix.go }}
 cache: true
 - name: Verify formatting
 run: make fmt-check
 - name: Verify local-fork provenance
 run: make fork-provenance-check
 - name: Verify module files
 run: make mod-check
 - name: Verify third-party notices
 run: make notices-check
 - name: Vet
 run: make vet
 - name: Test with coverage
 run: go test -shuffle=on -count=1 -covermode=atomic -coverprofile=coverage.out ./...
 - name: Test hardened Hysteria module
 working-directory: third_party/hysteria-core
 run: go test -shuffle=on -count=1 ./...
 - name: Test hardened QUIC core, HTTP/3, and RFC 9002 recovery
 working-directory: third_party/quic-go
 run: |
 go test -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -shuffle=on -count=1 ./http3 ./internal/ackhandler
 - name: Test Chrome fingerprint, datagrams, and path MTU discovery
 working-directory: third_party/quic-go
 run: go test -shuffle=on -count=1 ./integrationtests/self -run '^(TestChromeParrot|TestDatagram(Negotiation|SizeLimit)|TestPathMTUDiscovery)'
 - name: Upload coverage
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: coverage-go-${{ matrix.go }}
 path: coverage.out
Expand All@@ -46,24 +61,32 @@ jobs:
 name: Race detector
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - run: make race
 - name: Race-test hardened Hysteria resource limits
 working-directory: third_party/hysteria-core
 run: go test -race -shuffle=on -count=1 ./client ./server ./internal/frag ./internal/protocol ./internal/congestion/...
 - name: Race-test hardened QUIC admission and loss recovery
 working-directory: third_party/quic-go
 run: |
 go test -race -shuffle=on -count=1 . -run '^TestServerCancelsConnContextWhenConnectionIDGenerationFails$'
 go test -race -shuffle=on -count=1 ./http3 ./internal/ackhandler

 vulnerability-scan:
 name: Reachable vulnerability scan
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - name: Run govulncheck
 run: go run golang.org/x/vuln/cmd/govulncheck@v1.7.0 ./...
 run: ./scripts/govulncheck.sh

 build:
 name: Build ${{ matrix.goos }}/${{ matrix.goarch }}
Expand All@@ -74,19 +97,27 @@ jobs:
 include:
 - goos: linux
 goarch: amd64
 output: autocar-linux-amd64
 artifact: autocar-linux-amd64
 binary: autocar
 archive: autocar-linux-amd64.tar.gz
 - goos: linux
 goarch: arm64
 output: autocar-linux-arm64
 artifact: autocar-linux-arm64
 binary: autocar
 archive: autocar-linux-arm64.tar.gz
 - goos: darwin
 goarch: arm64
 output: autocar-darwin-arm64
 artifact: autocar-darwin-arm64
 binary: autocar
 archive: autocar-darwin-arm64.tar.gz
 - goos: windows
 goarch: amd64
 output: autocar-windows-amd64.exe
 artifact: autocar-windows-amd64
 binary: autocar.exe
 archive: autocar-windows-amd64.zip
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -96,19 +127,26 @@ jobs:
 GOOS: ${{ matrix.goos }}
 GOARCH: ${{ matrix.goarch }}
 run: |
 mkdir -p dist
 go build -trimpath -o "dist/${{ matrix.output }}" ./cmd/autocar
 - uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 mkdir -p dist/package
 go build -trimpath -o "dist/package/${{ matrix.binary }}" ./cmd/autocar
 cp LICENSE THIRD_PARTY_NOTICES.md dist/package/
 if [ "${{ matrix.goos }}" = "windows" ]; then
 (cd dist/package && zip -q -X "../${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md)
 else
 tar -C dist/package -czf "dist/${{ matrix.archive }}" "${{ matrix.binary }}" LICENSE THIRD_PARTY_NOTICES.md
 fi
 test -s "dist/${{ matrix.archive }}"
 - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: ${{ matrix.output }}
 path: dist/${{ matrix.output }}
 name: ${{ matrix.artifact }}
 path: dist/${{ matrix.archive }}
 if-no-files-found: error

 container:
 name: Multi-platform container build
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - name: Build OCI image index
 run: |
 docker buildx create --name autocar-ci --driver docker-container --use
Expand Down

8 changes: 4 additions & 4 deletions
.github/workflows/codeql.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -22,17 +22,17 @@ jobs:
 name: Analyze Go
 runs-on: ubuntu-24.04
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
 - uses: github/codeql-action/init@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/init@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 languages: go
 build-mode: manual
 - name: Build
 run: go build -o /tmp/autocar-codeql ./cmd/autocar
 - uses: github/codeql-action/analyze@42947a340483f03ba47bb1a039b2c519aab3df85 # v3
 - uses: github/codeql-action/analyze@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
 with:
 category: /language:go

6 changes: 3 additions & 3 deletions
.github/workflows/netem.yml

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -19,8 +19,8 @@ jobs:
 runs-on: ubuntu-24.04
 timeout-minutes: 15
 steps:
 - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
 - uses: actions/setup-go@40f1582b2485089dde7abd97c1529aa768e1baff # v5
 - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
 - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
 with:
 go-version: 1.27.x
 cache: true
Expand All@@ -32,7 +32,7 @@ jobs:
 run: sudo env AUTOCAR_ARTIFACT_DIR="$PWD/artifacts/netem" ./scripts/netem-integration.sh "$PWD/bin/autocar"
 - name: Publish measurements and diagnostics
 if: always()
 uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
 uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
 with:
 name: netem-results
 path: artifacts/netem
Expand Down

9 changes: 7 additions & 2 deletions
Dockerfile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -12,6 +12,9 @@ WORKDIR /src
RUN apk add --no-cache ca-certificates

COPY go.mod go.sum ./
# Local replace directives are resolved during go mod download, so make the
# audited module forks available before dependency resolution.
COPY third_party ./third_party
RUN go mod download

COPY . .
Expand All@@ -23,11 +26,13 @@ RUN CGO_ENABLED=0 GOOS="${TARGETOS}" GOARCH="${TARGETARCH}" \
FROM --platform=$TARGETPLATFORM scratch

LABEL org.opencontainers.image.source="https://github.com/cppla/autocar" \
 org.opencontainers.image.description="Authenticated dual-ended QUIC/TLS TCP proxy" \
 org.opencontainers.image.licenses="Apache-2.0"
 org.opencontainers.image.description="Secure dual-ended QUIC/TLS TCP and UDP accelerator" \
 org.opencontainers.image.licenses="MIT"

COPY --from=build /etc/ssl/certs/ca-certificates.crt /etc/ssl/certs/ca-certificates.crt
COPY --from=build --chown=65532:65532 /out/autocar /autocar
COPY --from=build /src/LICENSE /licenses/autocar-LICENSE
COPY --from=build /src/THIRD_PARTY_NOTICES.md /licenses/THIRD_PARTY_NOTICES.md

USER 65532:65532
EXPOSE 8443/tcp 8443/udp 1080/tcp 8080/tcp
Expand Down

46 changes: 38 additions & 8 deletions
Makefile

View file


Open in desktop

Original file line numberDiff line numberDiff line change
Expand Up@@ -8,24 +8,37 @@ LDFLAGS := -s -w \
	-X github.com/cppla/autocar/internal/version.Commit=$(COMMIT) \
	-X github.com/cppla/autocar/internal/version.Date=$(BUILD_DATE)

.PHONY: all check fmt fmt-check mod-check vet test race build cross-build docker integration-netem clean
.PHONY: all check fmt fmt-check fork-provenance-check mod-check notices notices-check vet test race build cross-build release docker integration-netem clean

all: check build

check: fmt-check mod-check vet test
check: fmt-check fork-provenance-check mod-check notices-check vet test

fmt:
	$(GO) fmt ./...

fmt-check:
	@test -z "$$(gofmt -l .)" || { gofmt -l .; echo "Go files need formatting" >&2; exit 1; }

fork-provenance-check:
	./scripts/check-fork-provenance.sh

mod-check:
	$(GO) mod tidy
	git diff --exit-code -- go.mod go.sum
	cd third_party/hysteria-core && $(GO) mod tidy
	cd third_party/quic-go && $(GO) mod tidy
	git diff --exit-code -- go.mod go.sum third_party/hysteria-core/go.mod third_party/hysteria-core/go.sum third_party/quic-go/go.mod third_party/quic-go/go.sum

notices:
	$(GO) run ./tools/notices

notices-check:
	$(GO) run ./tools/notices -check

vet:
	$(GO) vet ./...
	cd third_party/hysteria-core && $(GO) vet ./...
	cd third_party/quic-go && $(GO) vet . ./http3 ./internal/ackhandler

test:
	$(GO) test -shuffle=on -count=1 ./...
Expand All@@ -37,12 +50,29 @@ build:
	mkdir -p $(dir $(BINARY))
	CGO_ENABLED=0 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o $(BINARY) ./cmd/autocar

cross-build:
cross-build: notices-check
	mkdir -p dist
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-amd64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-linux-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-darwin-arm64 ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/autocar-windows-amd64.exe ./cmd/autocar
	rm -f dist/autocar-linux-amd64 dist/autocar-linux-arm64 dist/autocar-darwin-arm64 dist/autocar-windows-amd64.exe
	rm -rf dist/.release-stage-autocar
	mkdir -p dist/.release-stage-autocar/autocar-linux-amd64
	mkdir -p dist/.release-stage-autocar/autocar-linux-arm64
	mkdir -p dist/.release-stage-autocar/autocar-darwin-arm64
	mkdir -p dist/.release-stage-autocar/autocar-windows-amd64
	CGO_ENABLED=0 GOOS=linux GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-amd64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=linux GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-linux-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=darwin GOARCH=arm64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-darwin-arm64/autocar ./cmd/autocar
	CGO_ENABLED=0 GOOS=windows GOARCH=amd64 $(GO) build -trimpath -ldflags "$(LDFLAGS)" -o dist/.release-stage-autocar/autocar-windows-amd64/autocar.exe ./cmd/autocar
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-amd64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-linux-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-darwin-arm64/
	cp LICENSE THIRD_PARTY_NOTICES.md dist/.release-stage-autocar/autocar-windows-amd64/
	tar -C dist/.release-stage-autocar/autocar-linux-amd64 -czf dist/autocar-linux-amd64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-linux-arm64 -czf dist/autocar-linux-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	tar -C dist/.release-stage-autocar/autocar-darwin-arm64 -czf dist/autocar-darwin-arm64.tar.gz autocar LICENSE THIRD_PARTY_NOTICES.md
	cd dist/.release-stage-autocar/autocar-windows-amd64 && zip -q -X ../../autocar-windows-amd64.zip autocar.exe LICENSE THIRD_PARTY_NOTICES.md
	rm -rf dist/.release-stage-autocar

release: cross-build

docker:
	docker build --build-arg VERSION="$(VERSION)" --build-arg COMMIT="$(COMMIT)" --build-arg BUILD_DATE="$(BUILD_DATE)" -t autocar:local .
Expand Down
Loading
Loading