Update Tinfoil proxy security runtime

[AnthonyRonning]

Summary

• upgrade the checked-in Tinfoil proxy from tinfoil-go 0.12.8 to 0.14.2 and rebuild it with patched Go 1.26.5
• preserve the existing direct attested-TLS transport and tenant-wide prompt-cache behavior explicitly, avoiding silent behavior changes from new SDK defaults
• cancel the response-start timeout context when the streamed response body closes
• replace the one-architecture Docker extraction path with a pinned Nix build that deterministically regenerates both checked-in Linux binaries

Security validation

• nix develop ./tinfoil-proxy -c go test ./...
• nix develop ./tinfoil-proxy -c go vet ./...
• nix develop ./tinfoil-proxy -c govulncheck ./... (no called or imported vulnerabilities)
• nix build ./tinfoil-proxy --no-link
• root nix develop -c just build-tinfoil-proxy
• go version -m confirms Go 1.26.5, tinfoil-go 0.14.2, x/crypto 0.53.0, x/net 0.56.0, Rekor 1.5.2, sigstore-go 1.2.1, and timestamp-authority 2.1.2 in both binaries
• two consecutive rebuilds produced identical SHA-256 values:
  • arm64: 7470dd74545e5317d708b0d0f36e58f32194bc54bfcdc2f4832b5bca6b807636
  • amd64: e9c85c686319f4eda7951b2403b95eaf672b786a1fc93b3f1ca5b703670e6157

The module-level binary heuristic still knows about the unmaintained OpenPGP package, but go list -deps confirms that package is absent from this production build graph.

---

Summary by CodeRabbit

• New Features
  • Added reproducible Linux builds for ARM64 and AMD64 using a pinned Go toolchain (no container-based build required).
  • Added build-time checks for tests, go vet, and vulnerability scanning via the same pinned environment.
• Bug Fixes
  • Improved request context cancellation consistency across errors, timeouts, and response-body closure (including verified behavior on Body.Close()).
• Documentation
  • Updated build instructions to reflect the pinned, reproducible toolchain workflow.

[coderabbitai]

Walkthrough

The Tinfoil proxy now uses a pinned Go 1.26.5 Nix toolchain, reproducible static Linux builds, refreshed dependencies, explicit client options, and response-body-driven request cancellation.

Changes

Tinfoil proxy build and runtime updates

Layer / File(s)	Summary
Pinned Go toolchain and dependencies tinfoil-proxy/flake.nix, tinfoil-proxy/go.mod	Pins Go 1.26.5, records the vendored dependency hash, adds govulncheck, and refreshes direct and indirect module versions.
Reproducible binary build workflow tinfoil-proxy/build.sh, justfile, tinfoil-proxy/README.md, tinfoil-proxy/Dockerfile	Builds static Linux arm64 and amd64 binaries through the pinned Nix environment, updates build documentation and checks, verifies artifacts, and updates the Docker builder image.
Tinfoil client initialization tinfoil-proxy/main.go	Uses NewClientWithOptions with TLS transport, an empty user cache secret, and the OpenAI API key.
Response-body cancellation tinfoil-proxy/main.go, tinfoil-proxy/main_test.go	Cancels request contexts on response errors, empty bodies, or body closure, with a test covering closure-triggered cancellation.

Estimated code review effort: 3 (Moderate) | ~25 minutes

Sequence Diagram(s)

sequenceDiagram
  participant doWithResponseStartTimeout
  participant http.Client
  participant responseWithCancelOnClose
  participant cancelOnCloseReadCloser

  doWithResponseStartTimeout->>http.Client: Execute request
  http.Client-->>doWithResponseStartTimeout: Return response and error
  doWithResponseStartTimeout->>responseWithCancelOnClose: Wrap response and cancel function
  responseWithCancelOnClose->>cancelOnCloseReadCloser: Wrap response body
  cancelOnCloseReadCloser-->>doWithResponseStartTimeout: Return response
  doWithResponseStartTimeout->>cancelOnCloseReadCloser: Close response body
  cancelOnCloseReadCloser-->>doWithResponseStartTimeout: Invoke request context cancellation

Loading

Possibly related PRs

• OpenSecretCloud/opensecret#56: Both changes modify Tinfoil client initialization in main.go.
• OpenSecretCloud/opensecret#108: Both changes update Go tooling and Tinfoil proxy dependencies.

Poem

A bunny hops through Go’s new shell,
With pinned tools and builds done well.
Close the stream, the cancel rings,
Static binaries spread their wings.
TLS shines bright—what joy to share!
🐇✨ Fresh proxy magic everywhere!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title is clearly related to the proxy security/runtime update, though it is broader than the specific code changes.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex-tinfoil-proxy-security-update-opensecret

---

_{Comment @coderabbitai help to get the list of available commands.}