Google Git Google Git
Sign in
cos/third_party/google-guest-agent/refs/heads/cos/release-R133
commit
ed783ba8d935b1e9f652ba88d6ead00a4dd97f73
[log]
author
Miri Amarilio <mirilio@google.com>
Mon Oct 19 00:02:58 2026 +0000
committer
Miri Amarilio <mirilio@google.com>
Mon Oct 19 10:23:50 2026 -0700
tree
8f3805bbd0dda336099918839a26179658bd358f
parent
5d338a2513c4b3845fe0e8ac1991a6db75c619e2 [diff] 
google-guest-agent: upgrade golang.org/x/crypto to v0.52.0 to fix CVE-2026-39832, CVE-2026-39834, CVE-2026-39830 (+1 more)

Upgrade golang.org/x/crypto dependency to v0.52.0 and re-vendor Go dependencies via `go mod vendor` to resolve CVE-2026-39832, CVE-2026-39834, CVE-2026-39830, CVE-2026-42508 in app-admin/google-guest-agent.

Provenance:
- CVE-2026-39832: Go module golang.org/x/crypto fixed in v0.52.0, fix commit go.dev/cl/778640 (https://github.com/advisories/GHSA-f5wc-c3c7-36mc)
- CVE-2026-39834: Go module golang.org/x/crypto fixed in v0.52.0, fix commit go.dev/cl/781663 (https://github.com/advisories/GHSA-rm3j-f69w-wqmq)
- CVE-2026-39830: Go module golang.org/x/crypto fixed in v0.52.0, fix commit go.dev/cl/781640 (https://github.com/advisories/GHSA-vgwf-h737-ff37)
- CVE-2026-42508: Go module golang.org/x/crypto fixed in v0.52.0, fix commit go.dev/cl/781220 (https://github.com/advisories/GHSA-5cgq-3rg8-m6cv)

Build adjustments:
- go get golang.org/x/crypto@v0.52.0
- go mod tidy && go mod vendor && go mod verify

BUG=b/575146495
BUG=b/575145224
BUG=b/575144371
BUG=b/575143394
TEST=go mod verify; go test -mod=vendor ./...; CGO_ENABLED=0 go build -mod=vendor ./...
RELEASE_NOTE=Fixed CVE-2026-39832, CVE-2026-39834, CVE-2026-39830, CVE-2026-42508 in google-guest-agent.

cos-patch: security-high
Change-Id: I73d269f3363cd8a8bb0536dca2db70bc6fe5f947
Reviewed-on: https://cos-review.googlesource.com/c/third_party/google-guest-agent/+/227486
SLSA-Policy-Verified: SLSA Policy Verification Service <devtools-gerritcodereview-exitgate@google.com>
Tested-by: Cusky Presubmit Bot <presubmit@cos-infra-prod.iam.gserviceaccount.com>
Reviewed-by: Chenglong Tang <chenglongtang@google.com>
171 files changed
tree: 8f3805bbd0dda336099918839a26179658bd358f
  1. build/
  2. cmd/
  3. internal/
  4. vendor/
  5. CONTRIBUTING.md
  6. go.mod
  7. go.sum
  8. LICENSE
  9. Makefile
  10. README.md
  11. version
README.md

TODO: Add link to external documentation whenever it is ready.

Guest Agent for Google Compute Engine.

This repository contains the source code and packaging artifacts for the Google guest agent. These components are installed on Windows and Linux GCE VMs in order to enable GCE platform features.

Building Guest Agent

In the codebase there's a GNU Make based build system with targets to build and test the guest agent.

In order to build both the guest-agent and core_plugins, run

make

To build only one or the other, run the respective make target:

make build cmd/google_guest_agent/google_guest_agent

make build cmd/core_plugin/core_plugin

To run all the go tests, run:

make test

For more targets and info about the build system run:

make help