summaryrefslogtreecommitdiffhomepage
path: root/go.mod
AgeCommit message (Collapse)AuthorFilesLines
2026-04-23go.mod: bump github.com/google/go-containerregistry (#19500)Andrew Lytvynov1-18/+18
This drops an indirect dependency on the old github.com/docker/docker (which was replaced with github.com/moby/moby) and fixes a couple recent CVEs. Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2026-04-15control/controlclient: enable request signatures on macOS (#19317)Jonathan Nobels1-1/+1
fixes tailscale/corp#39422 Updates tailscale/certstore for properly macOS support and builds the request signing support into macOS builds. iOS and builds that do not use cGo are omitted. Signed-off-by: Jonathan Nobels <jonathan@tailscale.com>
2026-04-13go.mod: upgrade go-git to v5.17.1Patrick O'Doherty1-2/+2
Partially resolve govulncheck warnings in OSS and corp. Updates #cleanup Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2026-04-10gokrazy: add arm64 natlab appliance image supportBrad Fitzpatrick1-0/+1
Add natlabapp.arm64 config and gokrazydeps.go for building a gokrazy natlab appliance image targeting arm64 (Apple Silicon). This is the arm64 counterpart to the existing natlabapp (amd64) used by vmtest. The arm64 image uses github.com/gokrazy/kernel.arm64 and is built with "make natlab-arm64" in the gokrazy directory. Updates #13038 Change-Id: I0e1f8e5840083a5de5954f2cf46e3babec129d96 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-04-09tstest/natlab: add TestSubnetRouterFreeBSD with FreeBSD cloud image supportBrad Fitzpatrick1-1/+1
As a warm-up to making natlab support multiple operating systems, start with an easy one (in that it's also Unixy and open source like Linux) and add FreeBSD 15.0 as a VM OS option for the vmtest integration test framework, and add TestSubnetRouterFreeBSD which tests subnet routing through a FreeBSD VM (Gokrazy → FreeBSD → Gokrazy). Key changes: - Add FreeBSD150 OSImage using the official FreeBSD 15.0 BASIC-CLOUDINIT cloud image (xz-compressed qcow2) - Add GOOS()/IsFreeBSD() methods to OSImage for cross-compilation and OS-specific behavior - Handle xz-compressed image downloads in ensureImage - Refactor compileBinaries into compileBinariesForOS to support multiple GOOS targets (linux, freebsd), with binaries registered at <goos>/<name> paths on the file server VIP - Add FreeBSD-specific cloud-init (nuageinit) user-data generation: string-form runcmd (nuageinit doesn't support YAML arrays), fetch(1) instead of curl, FreeBSD sysctl names for IP forwarding, mkdir /usr/local/bin, PATH setup for tta - Skip network-config in cidata ISO for FreeBSD (DHCP via rc.conf) Updates tailscale/tailscale#13038 Change-Id: Ibeb4f7d02659d5cd8e3a7c3a66ee7b1a92a0110d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-04-09cmd/k8s-operator: migrate to tailscale-client-go-v2 (#19010)David Bond1-2/+3
This commit modifies the kubernetes operator to use the `tailscale-client-go-v2` package instead of the internal tailscale client it was previously using. This now gives us the ability to expand out custom resources and features as they become available via the API module. The tailnet reconciler has also been modified to manage clients as tailnets are created and removed, providing each subsequent reconciler with a single `ClientProvider` that obtains a tailscale client for the respective tailnet by name, or the operator's default when presented with a blank string. Fixes: https://github.com/tailscale/corp/issues/38418 Signed-off-by: David Bond <davidsbond93@gmail.com>
2026-04-08vmtest: add VM-based integration test frameworkBrad Fitzpatrick1-0/+1
Add tstest/natlab/vmtest, a high-level framework for running multi-VM integration tests with mixed OS types (gokrazy + Ubuntu/Debian cloud images) connected via natlab's vnet virtual network. The vmtest package provides: - Env type that orchestrates vnet, QEMU processes, and agent connections - OS image support (Gokrazy, Ubuntu2404, Debian12) with download/cache - QEMU launch per OS type (microvm for gokrazy, q35+KVM for cloud) - Cloud-init seed ISO generation with network-config for multi-NIC - Cross-compilation of test binaries for cloud VMs - Debug SSH NIC on cloud VMs for interactive debugging - Test helpers: ApproveRoutes, HTTPGet, TailscalePing, DumpStatus, WaitForPeerRoute, SSHExec TTA enhancements (cmd/tta): - Parameterize /up (accept-routes, advertise-routes, snat-subnet-routes) - Add /set, /start-webserver, /http-get endpoints - /http-get uses local.Client.UserDial for Tailscale-routed requests - Fix /ping for non-gokrazy systems TestSubnetRouter exercises a 3-VM subnet router scenario: client (gokrazy) → subnet-router (Ubuntu, dual-NIC) → backend (gokrazy) Verifies HTTP access to the backend webserver through the Tailscale subnet route. Passes in ~30 seconds. Updates tailscale/tailscale#13038 Change-Id: I165b64af241d37f5f5870e796a52502fc56146fa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-04-08misc: add install-git-hooks.go and git hook for Change-Id trackingBrad Fitzpatrick1-2/+2
Add misc/install-git-hooks.go and misc/git_hook/ to the OSS repo, adapted from the corp repo. The primary motivation is Change-Id generation in commit messages, which provides a persistent identifier for a change across cherry-picks between branches. The installer uses "git rev-parse --git-common-dir" instead of go-git to find the hooks directory, avoiding a new direct dependency while still supporting worktrees. Hooks included: - commit-msg: adds Change-Id trailer - pre-commit: blocks NOCOMMIT / DO NOT SUBMIT markers - pre-push: blocks local-directory replace directives in go.mod - post-checkout: warns when the hook binary is outdated Also update docs/commit-messages.md to reflect that Change-Id is no longer optional in the OSS repo. Updates tailscale/corp#39860 Change-Id: I09066b889118840c0ec6995cc03a9cf464740ffa Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-04-07go.toolchain.rev: update to Go 1.26.2Brad Fitzpatrick1-1/+1
Updates tailscale/corp#39799 Change-Id: I87c8dbabbbb7df750eb751fd7bfc506f57ca5796 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-04-07ssh: replace tempfork with tailscale/glidersshKristoffer Dalby1-1/+2
Brings in a newer version of Gliderlabs SSH with added socket forwarding support. Fixes #12409 Fixes #5295 Signed-off-by: Kristoffer Dalby <kristoffer@tailscale.com>
2026-03-16go.mod: bump tailscale/wireguard-goJordan Whited1-1/+1
This pulls in commits related to on-demand configuration of peers. These commits introduce new API surfaces that are currently unused. Updates tailscale/tailscale#17858 Updates tailscale/corp#35603 Signed-off-by: Jordan Whited <jordan@tailscale.com>
2026-03-12gokrazy: fix busybox breakglass support, add testBrad Fitzpatrick1-1/+1
Updates #1866 Change-Id: Ica73ae8268b08a04ae97bc570869a04180585e75 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-06go.mod: bump to Go 1.26.1Brad Fitzpatrick1-1/+1
Updates #18682 Change-Id: I855c0dfa4c61eb33123bbb7b00c1ab5506e80b09 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-05go.mod: bump staticcheck to version that supports Go 1.26Brad Fitzpatrick1-4/+4
Otherwise it gets confused on new(123) etc. Updates #18682 Change-Id: I9e2e93ea24f2b952b2396dceaf094b4db64424b0 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-04go.toolchain.branch: switch to Go 1.26Brad Fitzpatrick1-1/+1
Updates #18682 Change-Id: I1eadfab950e55d004484af880a5d8df6893e85e8 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-03-04go.mod: bump github.com/cloudflare/circl version (#18878)Andrew Lytvynov1-1/+1
Pick up a fix in https://pkg.go.dev/vuln/GO-2026-4550 Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2026-02-26go.mod: bump gvisorBrad Fitzpatrick1-2/+2
Updates #8043 Change-Id: Ia229ad4f28f2ff20e0bdecb99ca9e1bd0356ad8e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-19build(deps): bump github.com/docker/docker (#13081)dependabot[bot]1-7/+8
Bumps [github.com/docker/docker](https://github.com/docker/docker) from 26.1.4+incompatible to 26.1.5+incompatible. - [Release notes](https://github.com/docker/docker/releases) - [Commits](https://github.com/docker/docker/compare/v26.1.4...v26.1.5) --- updated-dependencies: - dependency-name: github.com/docker/docker dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19build(deps): bump github.com/go-viper/mapstructure/v2 (#16914)dependabot[bot]1-1/+1
Bumps [github.com/go-viper/mapstructure/v2](https://github.com/go-viper/mapstructure) from 2.0.0-alpha.1 to 2.4.0. - [Release notes](https://github.com/go-viper/mapstructure/releases) - [Changelog](https://github.com/go-viper/mapstructure/blob/main/CHANGELOG.md) - [Commits](https://github.com/go-viper/mapstructure/compare/v2.0.0-alpha.1...v2.4.0) --- updated-dependencies: - dependency-name: github.com/go-viper/mapstructure/v2 dependency-version: 2.4.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19build(deps): bump github.com/go-git/go-git/v5 from 5.13.1 to 5.16.5 (#18667)dependabot[bot]1-4/+4
Bumps [github.com/go-git/go-git/v5](https://github.com/go-git/go-git) from 5.13.1 to 5.16.5. - [Release notes](https://github.com/go-git/go-git/releases) - [Commits](https://github.com/go-git/go-git/compare/v5.13.1...v5.16.5) --- updated-dependencies: - dependency-name: github.com/go-git/go-git/v5 dependency-version: 5.16.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Signed-off-by: Andrew Lytvynov <awly@tailscale.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2026-02-19go.mod: bump filippo.io/edwards25519 (#18765)Andrew Lytvynov1-1/+1
Pick up a fix for CVE-2026-26958. Fixes #18756 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2026-02-16cmd/cigocacher: remove Windows-specific disk code moved upstream (#18697)Brad Fitzpatrick1-2/+2
Updates tailscale/corp#10808 Updates bradfitz/go-tool-cache#27 Change-Id: I27a2af63d882d916998933521f17e410692255ca Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com> Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2026-02-13gokrazy: use monorepo for gokrazy appliance builds (monogok)Brad Fitzpatrick1-1/+19
This switches our gokrazy builds to use a new variant of cmd/gok called opinionated about using monorepos: https://github.com/bradfitz/monogok And with that, we can get rid of all the go.mod files and builddir forests under gokrazy/**. Updates #13038 Updates gokrazy/gokrazy#361 Change-Id: I9f18fbe59b8792286abc1e563d686ea9472c622d Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2026-02-09go.mod: update bart dep to v0.26.1 (#18659)Amal Bansode1-1/+1
bart has gained a bunch of purported performance and usability improvements since the current version we are using (0.18.0, from 1y ago) Updates tailscale/corp#36982 Signed-off-by: Amal Bansode <amal@tailscale.com>
2026-02-06go.toolchain.{rev,next.rev}: update to Go 1.25.7 / Go 1.26rc3 (#18633)Andrew Lytvynov1-1/+1
Updates #18629 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2026-01-26ipn/ipnlocal/netmapcache: add a package to split and cache network maps (#18497)M. J. Fromberger1-0/+1
This commit is based on part of #17925, reworked as a separate package. Add a package that can store and load netmap.NetworkMap values in persistent storage, using a basic columnar representation. This commit includes a default storage interface based on plain files, but the interface can be implemented with more structured storage if we want to later. The tests are set up to require that all the fields of the NetworkMap are handled, except those explicitly designated as not-cached, and check that a fully-populated value can round-trip correctly through the cache. Adding or removing fields, either in the NetworkMap or in the cached representation, will trigger either build failures (e.g., for type mismatch) or test failures (e.g., for representation changes or missing fields). This isn't quite as nice as automatically updating the representation, which I also prototyped, but is much simpler to maintain and less code. This commit does not yet hook up the cache to the backend, that will be a subsequent change. Updates #12639 Change-Id: Icb48639e1d61f2aec59904ecd172c73e05ba7bf9 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2026-01-23go.toolchain.rev: update to Go 1.25.6 (#18507)Andrew Lytvynov1-1/+1
Updates #18506 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2026-01-14cmd,feature: add identity token auto generation for workload identity (#18373)Danni Popova1-8/+8
Adds the ability to detect what provider the client is running on and tries fetch the ID token to use with Workload Identity. Updates https://github.com/tailscale/corp/issues/33316 Signed-off-by: Danni Popova <danni@tailscale.com>
2026-01-09go.mod: bump github.com/containerd/containerd@v1.7.29 (#18374)Patrick O'Doherty1-23/+25
Updates #cleanup Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2026-01-08net/portmapper, go.mod: unfork our goupnp dependencyAndrew Dunham1-1/+1
Updates #7436 Signed-off-by: Andrew Dunham <andrew@tailscale.com>
2026-01-08go.mod: bump mkctr dep (#18365)Tom Proctor1-1/+1
Brings in tailscale/mkctr#29. Updates tailscale/corp#32085 Change-Id: I90160ed1cdc47118ac8fd0712d63a7b590e739d3 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2026-01-08cmd/k8s-operator/e2e,go.mod: remove client v2 dependencyTom Proctor1-1/+0
It's not worth adding the v2 client just for these e2e tests. Remove that dependency for now to keep a clear separation, but we should revive the v2 client version if we ever decide to take that dependency for the tailscale/tailscale repo as a whole. Updates tailscale/corp#32085 Change-Id: Ic51ce233d5f14ce2d25f31a6c4bb9cf545057dd0 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2026-01-08cmd/k8s-operator/e2e: run self-contained e2e tests with devcontrol (#17415)Tom Proctor1-36/+82
* cmd/k8s-operator/e2e: run self-contained e2e tests with devcontrol Adds orchestration for more of the e2e testing setup requirements to make it easier to run them in CI, but also run them locally in a way that's consistent with CI. Requires running devcontrol, but otherwise supports creating all the scaffolding required to exercise the operator and proxies. Updates tailscale/corp#32085 Change-Id: Ia7bff38af3801fd141ad17452aa5a68b7e724ca6 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com> * cmd/k8s-operator/e2e: being more specific on tmp dir cleanup Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> --------- Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com> Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk> Co-authored-by: chaosinthecrd <tom@tmlabs.co.uk>
2025-12-03go.toolchain.rev: update to Go 1.25.5 (#18123)Andrew Lytvynov1-1/+1
Updates #18122 Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-12-03go.mod: bump the version of setecAlex Chan1-3/+2
Updates https://github.com/tailscale/corp/issues/34813 Change-Id: I926f1bad5bf143d82ddb36f51f70deb24fa11e71 Signed-off-by: Alex Chan <alexc@tailscale.com>
2025-11-26derp/derpserver: add a unique sender cardinality estimateJames Tucker1-0/+2
Adds an observation point that may identify potentially abusive traffic patterns at outlier values. Updates tailscale/corp#24681 Signed-off-by: James Tucker <james@tailscale.com>
2025-11-24cmd/cigocacher,go.mod: add cigocacher cmdTom Proctor1-7/+8
Adds cmd/cigocacher as the client to cigocached for Go caching over HTTP. The HTTP cache is best-effort only, and builds will fall back to disk-only cache if it's not available, much like regular builds. Not yet used in CI; that will follow in another PR once we have runners available in this repo with the right network setup for reaching cigocached. Updates tailscale/corp#10808 Change-Id: I13ae1a12450eb2a05bd9843f358474243989e967 Signed-off-by: Tom Proctor <tomhjp@users.noreply.github.com>
2025-11-20go.mod: bump golang.org/x/crypto (#18011)Andrew Lytvynov1-1/+1
Pick up fixes for https://pkg.go.dev/vuln/GO-2025-4134 Updates #cleanup Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-11-17go.mod: bump golang.org/x/crypto (#17907)Andrew Lytvynov1-9/+12
Pick up a fix for https://pkg.go.dev/vuln/GO-2025-4116 (even though we're not affected). Updates #cleanup Change-Id: I9f2571b17c1f14db58ece8a5a34785805217d9dd Signed-off-by: Andrew Lytvynov <awly@tailscale.com>
2025-11-16ipn/ipnlocal: add PROXY protocol support to Funnel/ServeAndrew Dunham1-0/+1
This adds the --proxy-protocol flag to 'tailscale serve' and 'tailscale funnel', which tells the Tailscale client to prepend a PROXY protocol[1] header when making connections to the proxied-to backend. I've verified that this works with our existing funnel servers without additional work, since they pass along source address information via PeerAPI already. Updates #7747 [1]: https://www.haproxy.org/download/1.8/doc/proxy-protocol.txt Change-Id: I647c24d319375c1b33e995555a541b7615d2d203 Signed-off-by: Andrew Dunham <andrew@du.nham.ca>
2025-10-30util/eventbus: allow logging of slow subscribers (#17705)M. J. Fromberger1-1/+1
Add options to the eventbus.Bus to plumb in a logger. Route that logger in to the subscriber machinery, and trigger a log message to it when a subscriber fails to respond to its delivered events for 5s or more. The log message includes the package, filename, and line number of the call site that created the subscription. Add tests that verify this works. Updates #17680 Change-Id: I0546516476b1e13e6a9cf79f19db2fe55e56c698 Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-10-30logtail: avoid racing eventbus subscriptions with shutdown (#17695)M. J. Fromberger1-1/+2
In #17639 we moved the subscription into NewLogger to ensure we would not race subscribing with shutdown of the eventbus client. Doing so fixed that problem, but exposed another: As we were only servicing events occasionally when waiting for the network to come up, we could leave the eventbus to stall in cases where a number of network deltas arrived later and weren't processed. To address that, let's separate the concerns: As before, we'll Subscribe early to avoid conflicts with shutdown; but instead of using the subscriber directly to determine readiness, we'll keep track of the last-known network state in a selectable condition that the subscriber updates for us. When we want to wait, we'll wait on that condition (or until our context ends), ensuring all the events get processed in a timely manner. Updates #17638 Updates #15160 Change-Id: I28339a372be4ab24be46e2834a218874c33a0d2d Signed-off-by: M. J. Fromberger <fromberger@tailscale.com>
2025-10-17go.toolchain.rev: update to Go 1.25.3Brad Fitzpatrick1-1/+1
Updates tailscale/go#140 Updates tailscale/go#142 Updates tailscale/go#138 Change-Id: Id25b6fa4e31eee243fec17667f14cdc48243c59e Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-10-08go.toolchain.rev: bump Go to 1.25.2Brad Fitzpatrick1-1/+1
Updates tailscale/go#135 Change-Id: I89cfb49b998b2fd0264f8d5f4a61af839cd06626 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-10-08cmd/tsrecorder: adds sending api level logging to tsrecorder (#16960)Tom Meadows1-0/+2
Updates #17141 Signed-off-by: chaosinthecrd <tom@tmlabs.co.uk>
2025-10-01Makefile, cmd/*/depaware.txt: split out vendor packages explicitlyBrad Fitzpatrick1-1/+1
depaware was merging golang.org/x/foo and std's vendor/golang.org/x/foo packages (which could both be in the binary!), leading to confusing output, especially when I was working on eliminating duplicate packages imported under different names. This makes the depaware output longer and grosser, but doesn't hide reality from us. Updates #17305 Change-Id: I21cc3418014e127f6c1a81caf4e84213ce84ab57 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-09-08go.toolchain.rev: bump to Go 1.25.1Brad Fitzpatrick1-1/+1
Updates #17064 Change-Id: Ibbca837e0921fe9f82fc931dde8bb51b017e4e48 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-08-29go.mod: bump github.com/ulikunitz/xz for security warningBrad Fitzpatrick1-1/+1
Doesn't look to affect us, but pacifies security scanners. See https://github.com/ulikunitz/xz/commit/88ddf1d0d98d688db65de034f48960b2760d2ae2 It's for decoding. We only use this package for encoding (via github.com/google/rpmpack / github.com/goreleaser/nfpm/v2). Updates #8043 Change-Id: I87631aa5048f9514bb83baf1424f6abb34329c46 Signed-off-by: Brad Fitzpatrick <bradfitz@tailscale.com>
2025-08-26go.toolchain.branch: bump to go1.25 (#16954)Patrick O'Doherty1-1/+1
go.toolchain.rev: bump go1.25 version flake.nix: bump Go to 1.25 Updates #16330 Signed-off-by: Patrick O'Doherty <patrick@tailscale.com>
2025-08-25client/systray: go back to using upstream library (#16938)Claus Lensbøl1-1/+1
We had a fix in a local branch, but upstream has merged it now. Updates #1708 Signed-off-by: Claus Lensbøl <claus@tailscale.com>
Copyright © 2025 - 2026 Wayne Cole. WTFPL. Attribution appreciated. No warranty. Not liable for bodily damages.