From 36a6301ec84e5b4e6994790f4f27f0de146f4a29 Mon Sep 17 00:00:00 2001 From: Lee Tschetter Date: Thu, 12 Nov 2026 19:18:02 +0000 Subject: [PATCH] chore(deps): lock Go 1.27.4 for release builds (GO-2026-6859) Go 1.27.4 fixes GO-2026-6859, an HTTP/1 MaxBytesReader header race in net/http. govulncheck reports it as reachable from c1i, which is the only caller that sets go_vulnerability_scan; its release preflight fails and no release can publish while the locked toolchain is 1.27.3. Bump the four tool-lock entries to go1.27.4 (SHA256s from https://go.dev/dl/?mode=json) and the module's go directive. Update the lock table and the locked-Go gate fixtures: the newer-than-locked case now uses 1.27.5, and the single-version sanity fixture mutates 1.27.4 to 1.27.5. The ca-trust-guard x509 incident notes keep their 1.27.3 wording (they describe behaviour, not the lock). References: - https://pkg.go.dev/vuln/GO-2026-6859 Co-authored-by: c1-squire-dev[bot] --- .github/actions/ca-trust-guard/README.md | 2 +- .github/actions/locked-tools/tool-locks.txt | 8 +++---- docs/release-workflow.md | 8 +++---- go.mod | 2 +- scripts/ca-trust-guard.sh | 2 +- scripts/test-tool-integrity.py | 24 ++++++++++----------- 6 files changed, 23 insertions(+), 23 deletions(-) diff --git a/.github/actions/ca-trust-guard/README.md b/.github/actions/ca-trust-guard/README.md index 16c4f91..5ce796e 100644 --- a/.github/actions/ca-trust-guard/README.md +++ b/.github/actions/ca-trust-guard/README.md @@ -67,7 +67,7 @@ The stdlib-only `cmd/ca-trust-guard` is built using the runner-image Go toolchai with `GOTOOLCHAIN=local`, `GOPROXY=off` and `GOSUMDB=off`. **Only the bootstrap build** uses `GO111MODULE=off`: it has no dependencies and a Go 1.22+ language/API floor, so an older runner Go is not forced to satisfy the repository module's -Go 1.27.3 directive. Vet/tests retain that module/toolchain requirement. Nothing +Go 1.27.4 directive. Vet/tests retain that module/toolchain requirement. Nothing is downloaded; a missing/too-old compiler fails closed. The runner Go compiler is a residual bootstrap dependency in the same trust class as the runner agent. diff --git a/.github/actions/locked-tools/tool-locks.txt b/.github/actions/locked-tools/tool-locks.txt index 0e364da..164fb8e 100644 --- a/.github/actions/locked-tools/tool-locks.txt +++ b/.github/actions/locked-tools/tool-locks.txt @@ -10,13 +10,13 @@ gon f4c3f2be10a2ee8d50067d2c8a8828a14c83977c darwin/* source syft v1.42.3 linux/amd64 0d6be741479eddd2c8644a288990c04f3df0d609bbc1599a005532a9dff63509 https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_linux_amd64.tar.gz syft v1.42.3 darwin/arm64 d71ee7db2be0fe2e96f679fd9d69ef04274cc86c8604707797080a21070b3f32 https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_darwin_arm64.tar.gz syft v1.42.3 windows/amd64 e1b9f4945aa64c2b34970bec617623d7f803d0661b48a50b966768b363322e2d https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_windows_amd64.zip -go go1.27.3 linux/amd64 65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 https://go.dev/dl/go1.27.3.linux-amd64.tar.gz -go go1.27.3 darwin/arm64 dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2 https://go.dev/dl/go1.27.3.darwin-arm64.tar.gz -go go1.27.3 windows/amd64 f26081f438319757f8a1b46d7d0b2c5ec7583d4038e485e0aa725cfde7885fff https://go.dev/dl/go1.27.3.windows-amd64.zip +go go1.27.4 linux/amd64 7226736c2339719cda28fbf3a54d71aa63bcefe376e98cef00034268dab24840 https://go.dev/dl/go1.27.4.linux-amd64.tar.gz +go go1.27.4 darwin/arm64 91a44a2b8a716600ad94a4f143e156116620db8828086a6e3602291be9bd0bb4 https://go.dev/dl/go1.27.4.darwin-arm64.tar.gz +go go1.27.4 windows/amd64 178ab98950ac69ab25069307dc6ade79f3816e414cce95b4da166a115cde1e7e https://go.dev/dl/go1.27.4.windows-amd64.zip # Node checksums: https://nodejs.org/dist/v26.12.1/SHASUMS256.txt node v26.12.1 linux/amd64 0fd1eb7770598f52a21995edf6ed35fc690400fa437c2386af329519e9143132 https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-x64.tar.gz node v26.12.1 darwin/arm64 1901d539912c02afa10d1cc126943a8855a7eedebe830119463470db5e6c59e8 https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-arm64.tar.gz # Minisign macOS ZIP uses the upstream release URL and SHA256 below. minisign 0.12 darwin/arm64 89000b19535765f9cffc65a65d64a820f433ef6db8020667f7570e06bf6aac63 https://github.com/jedisct1/minisign/releases/download/0.12/minisign-0.12-macos.zip node v26.12.1 windows/amd64 b3efd5c70cba3308ed46e7e699a9b8aac075bbc6b027fcb39c84c31acc25e2b4 https://nodejs.org/dist/v26.12.1/node-v26.12.1-win-x64.zip -go go1.27.3 linux/arm64 a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49 https://go.dev/dl/go1.27.3.linux-arm64.tar.gz +go go1.27.4 linux/arm64 3392582988a273a87ab5043ee1b2c9c17a2c3c00580bf9326c47a2e0aaaeac92 https://go.dev/dl/go1.27.4.linux-arm64.tar.gz diff --git a/docs/release-workflow.md b/docs/release-workflow.md index ed15f5a..297b2b7 100644 --- a/docs/release-workflow.md +++ b/docs/release-workflow.md @@ -356,10 +356,10 @@ wrappers under `scripts/` are not supported. | syft v1.42.3 | linux/amd64 | `0d6be741479eddd2c8644a288990c04f3df0d609bbc1599a005532a9dff63509` | [Linux archive](https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_linux_amd64.tar.gz) | | syft v1.42.3 | darwin/arm64 | `d71ee7db2be0fe2e96f679fd9d69ef04274cc86c8604707797080a21070b3f32` | [Darwin archive](https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_darwin_arm64.tar.gz) | | syft v1.42.3 | windows/amd64 | `e1b9f4945aa64c2b34970bec617623d7f803d0661b48a50b966768b363322e2d` | [Windows archive](https://github.com/anchore/syft/releases/download/v1.42.3/syft_1.42.3_windows_amd64.zip) | -| go go1.27.3 | linux/amd64 | `65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40` | [Linux toolchain](https://go.dev/dl/go1.27.3.linux-amd64.tar.gz) | -| go go1.27.3 | linux/arm64 | `a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49` | [Linux arm64 toolchain](https://go.dev/dl/go1.27.3.linux-arm64.tar.gz) | -| go go1.27.3 | darwin/arm64 | `dd3908cf20959d798c1e06ebe5b72213f0505ce01373b40ce3110975a6cd99c2` | [Darwin toolchain](https://go.dev/dl/go1.27.3.darwin-arm64.tar.gz) | -| go go1.27.3 | windows/amd64 | `f26081f438319757f8a1b46d7d0b2c5ec7583d4038e485e0aa725cfde7885fff` | [Windows toolchain](https://go.dev/dl/go1.27.3.windows-amd64.zip) | +| go go1.27.4 | linux/amd64 | `7226736c2339719cda28fbf3a54d71aa63bcefe376e98cef00034268dab24840` | [Linux toolchain](https://go.dev/dl/go1.27.4.linux-amd64.tar.gz) | +| go go1.27.4 | linux/arm64 | `3392582988a273a87ab5043ee1b2c9c17a2c3c00580bf9326c47a2e0aaaeac92` | [Linux arm64 toolchain](https://go.dev/dl/go1.27.4.linux-arm64.tar.gz) | +| go go1.27.4 | darwin/arm64 | `91a44a2b8a716600ad94a4f143e156116620db8828086a6e3602291be9bd0bb4` | [Darwin toolchain](https://go.dev/dl/go1.27.4.darwin-arm64.tar.gz) | +| go go1.27.4 | windows/amd64 | `178ab98950ac69ab25069307dc6ade79f3816e414cce95b4da166a115cde1e7e` | [Windows toolchain](https://go.dev/dl/go1.27.4.windows-amd64.zip) | | node v26.12.1 | linux/amd64 | `0fd1eb7770598f52a21995edf6ed35fc690400fa437c2386af329519e9143132` | [Linux package](https://nodejs.org/dist/v26.12.1/node-v26.12.1-linux-x64.tar.gz) | | node v26.12.1 | darwin/arm64 | `1901d539912c02afa10d1cc126943a8855a7eedebe830119463470db5e6c59e8` | [Darwin package](https://nodejs.org/dist/v26.12.1/node-v26.12.1-darwin-arm64.tar.gz) | | node v26.12.1 | windows/amd64 | `b3efd5c70cba3308ed46e7e699a9b8aac075bbc6b027fcb39c84c31acc25e2b4` | [Windows package](https://nodejs.org/dist/v26.12.1/node-v26.12.1-win-x64.zip) | diff --git a/go.mod b/go.mod index 21fb9d0..9616f75 100644 --- a/go.mod +++ b/go.mod @@ -1,5 +1,5 @@ module github.com/ConductorOne/github-workflows -go 1.27.3 +go 1.27.4 require google.golang.org/protobuf v1.36.5 diff --git a/scripts/ca-trust-guard.sh b/scripts/ca-trust-guard.sh index e12fe58..80f0b4f 100755 --- a/scripts/ca-trust-guard.sh +++ b/scripts/ca-trust-guard.sh @@ -3,7 +3,7 @@ # delegate observations/decisions to Go and OS mutations to their own scripts. # Only this bootstrap build is module-off for runner-Go compatibility (Go 1.22+ # language/API floor, stdlib only, still local/offline). Vet/tests retain the -# repository module and its Go 1.27.3 toolchain requirement. +# repository module and its Go 1.27.4 toolchain requirement. set -euo pipefail root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd) fixtures="$root/.github/actions/ca-trust-guard/fixtures" diff --git a/scripts/test-tool-integrity.py b/scripts/test-tool-integrity.py index f25dc7d..4b63897 100755 --- a/scripts/test-tool-integrity.py +++ b/scripts/test-tool-integrity.py @@ -226,7 +226,7 @@ def test_node_stale_url_and_duplicate_locks_fail_before_network(self) -> None: self.run_script("install-tool.sh", "node", self.root / "dest", ok=False) self.assertFalse(self.calls.exists()) - def go_contract(self, version: str = "go1.27.3", lock: Path | None = None) -> None: + def go_contract(self, version: str = "go1.27.4", lock: Path | None = None) -> None: lock = lock or self.lock self.env.update(EXPECTED_GO_VERSION=version, LOCK_PATH=str(lock.resolve()), EXPECTED_LOCK_SHA256=hashlib.sha256(lock.read_bytes()).hexdigest()) @@ -235,7 +235,7 @@ def mock_go_gate(self) -> None: self.executable("go", r''' printf 'go %s\n' "$*" >> "$CALLS" case "$1" in - version) echo "go version ${TEST_GO_VERSION:-go1.27.3} linux/arm64" ;; + version) echo "go version ${TEST_GO_VERSION:-go1.27.4} linux/arm64" ;; list) [ "$2" = -m ] && [ "$GOTOOLCHAIN" = local ] && [ "$GOWORK" = off ] [ "$GOPROXY" = off ] && [ "$GOSUMDB" = off ] @@ -254,27 +254,27 @@ def test_go_version_and_module_gates(self) -> None: self.go_contract() self.mock_go_gate() self.run_script("verify-locked-go.sh", "version") - self.env["TEST_GO_VERSION"] = "go1.27.4" + self.env["TEST_GO_VERSION"] = "go1.27.5" self.run_script("verify-locked-go.sh", "version", ok=False) self.env.pop("TEST_GO_VERSION") self.calls.unlink() module = self.root / "go.mod" - for version in ("1.13", "1.27", "1.27.3"): + for version in ("1.13", "1.27", "1.27.3", "1.27.4"): module.write_text(f"module example.com/fixture\n\ngo {version}\n") self.run_script("verify-locked-go.sh", "module", module) - module.write_bytes(b"module example.com/fixture\r\n\r\ngo 1.27.3\r\n") + module.write_bytes(b"module example.com/fixture\r\n\r\ngo 1.27.4\r\n") self.run_script("verify-locked-go.sh", "module", module) - self.assertEqual(self.calls.read_text().count("go list -m"), 4) + self.assertEqual(self.calls.read_text().count("go list -m"), 5) self.calls.unlink() - module.write_bytes(b"module example.com/fixture\r\n\r\ngo 1.27.4\r\n") + module.write_bytes(b"module example.com/fixture\r\n\r\ngo 1.27.5\r\n") result = self.run_script("verify-locked-go.sh", "module", module, ok=False) - self.assertIn(f"::error title=locked-tools::{module} requires Go 1.27.4, newer than locked go1.27.3", result.stderr) - for directive in ("go 1.27.4", "go 1.28", "go 2.0", "go 1.28rc1", "", "go 1.27\ngo 1.26"): + self.assertIn(f"::error title=locked-tools::{module} requires Go 1.27.5, newer than locked go1.27.4", result.stderr) + for directive in ("go 1.27.5", "go 1.28", "go 2.0", "go 1.28rc1", "", "go 1.27\ngo 1.26"): module.write_text(f"module example.com/fixture\n\n{directive}\n") self.run_script("verify-locked-go.sh", "module", module, ok=False) self.assertFalse(self.calls.exists(), "invalid directives must fail before invoking Go") module.write_text("module fixture\ngo 1.27.3\n") - self.env["TEST_GO_VERSION"] = "go1.27.4" + self.env["TEST_GO_VERSION"] = "go1.27.5" self.run_script("verify-locked-go.sh", "module", module, ok=False) self.assertNotIn("go list", self.calls.read_text()) self.env.pop("TEST_GO_VERSION") @@ -375,7 +375,7 @@ def test_gon_source_gates_and_build(self) -> None: self.run_script("gon-source.sh", "ref") self.assertEqual(self.output_file.read_text(), f"ref={commit}\n") self.env.update(GOFLAGS="-mod=readonly", GOPROXY="https://proxy.golang.org", GOSUMDB="sum.golang.org") - self.executable("go", 'echo "go $*" >> "$CALLS"\ncase "$1" in version) echo "go version go1.27.3 linux/arm64";; list) awk \'$1 == "go" { print $2 }\' go.mod;; build) [[ "$PWD" == */cmd/gon ]]; [ "$1 $2 $3" = "build -trimpath -o" ]; printf fixture > "$4";; *) exit 99;; esac\n') + self.executable("go", 'echo "go $*" >> "$CALLS"\ncase "$1" in version) echo "go version go1.27.4 linux/arm64";; list) awk \'$1 == "go" { print $2 }\' go.mod;; build) [[ "$PWD" == */cmd/gon ]]; [ "$1 $2 $3" = "build -trimpath -o" ]; printf fixture > "$4";; *) exit 99;; esac\n') module = self.repo / "go.mod" module.write_text("module fixture\ngo 1.13\n") (self.repo / "cmd/gon").mkdir(parents=True) @@ -465,7 +465,7 @@ def test_action_go_outputs_feed_environment_gate(self) -> None: def test_action_prepare_owns_single_go_version_sanity(self) -> None: self.fixture_download("go", "linux/amd64") self.env.update(LOCKED_TOOLS="go", LOCKS_INPUT="", ACTION_DIR=str(self.action_dir)) - self.lock.write_text(self.lock.read_text().replace("go go1.27.3 darwin/arm64", "go go1.27.4 darwin/arm64")) + self.lock.write_text(self.lock.read_text().replace("go go1.27.4 darwin/arm64", "go go1.27.5 darwin/arm64")) self.run_script("locked-tools.sh", "prepare", ok=False) self.assertFalse(self.calls.exists()) self.assertFalse(self.path_file.exists())