GO-2026-5709: Crossplane: Signature verification TOCTOU allows installing unverified package content via mutable tag in github.com/crossplane/crossplane

The highest tagged major version is v2.

version

package

v1.20.12 Latest Latest Go to latest Published: Aug 21, 2026 License: Apache-2.0 Imports: 12 Imported by: 0

Details

Valid go.mod file
Redistributable license
Tagged version
Stable version
Learn more about best practices

Repository

github.com/crossplane/crossplane

Links

Documentation ¶

Overview ¶

Package version contains version cmd

Index ¶

func FetchCrossplaneVersion(ctx context.Context) (string, error)
type Cmd
- func (c *Cmd) Run(k *kong.Context) error

Constants ¶

This section is empty.

Variables ¶

This section is empty.

Functions ¶

func FetchCrossplaneVersion ¶

func FetchCrossplaneVersion(ctx context.Context) (string, error)

FetchCrossplaneVersion initializes a Kubernetes client and fetches and returns the version of the Crossplane deployment. If the version does not have a leading 'v', it prepends it.

Types ¶

type Cmd ¶

type Cmd struct {
	Client bool `env:"" help:"If true, shows client version only (no server required)."`
}

Cmd represents the version command.

func (*Cmd) Run ¶

func (c *Cmd) Run(k *kong.Context) error

Run runs the version command.

Source Files ¶

View all Source files

?	: This menu
/	: Search site
f or F	: Jump to
y or Y	: Canonical URL