Repository navigation
fix(build): raise the Go floor to 1.27.3 for GO-2026-6809 (crypto/x509) - #42
Open
antoinetoussaint-byte wants to merge 1 commit into
Open
antoinetoussaint-byte wants to merge 1 commit into
antoinetoussaint-byte wants to merge 1 commit into
Conversation
Release archives were compiled by go1.27.1 (goreleaser-cross:v1.27.1-1), which carries GO-2026-6809 in crypto/x509, fixed in go1.27.3. The go directive is a floor: goreleaser-cross sets no GOTOOLCHAIN, so the image's go auto-switches up to the directive when the directive is higher. Raising go.mod to 1.27.3 is the fix that ships; moving the image pin to goreleaser-cross:v1.27.3 is the belt to that brace. No toolchain line, no GOTOOLCHAIN pin. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Do not merge — opened for review; the owner releases.
Why
Release archives of this agent are compiled by
ghcr.io/goreleaser/goreleaser-cross:v1.27.1-1, i.e. go1.27.1, which carries GO-2026-6809 (crypto/x509), fixed in go1.27.3.Go literals found (verified from source at f3cb115)
go 1.27.0go.mod:3goreleaser-cross:v1.27.1-1.github/workflows/release.ymlgo-version-file: go.mod.github/workflows/ci.yml,.github/workflows/release.yml(test job)No
golang:image, noGOTOOLCHAIN, notoolchainline, nogo-version:literal anywhere. Thetemplates/Dockerfiles (where present) build generated services, not Go.Mechanism
A
godirective is a floor. goreleaser-cross sets noGOTOOLCHAIN, so its go1.27.1 auto-switches up to the directive when the directive is higher: the shipped compiler ismax(directive, image go). Raising the directive to 1.27.3 is therefore the fix that ships on its own. The goreleaser-crossv1.27.3tag exists (checked via the GitHub tags API today), so the image pin moves too as the belt to that brace — with both in place the image already runs the floor and no download happens at release time.What changed
go.mod:go 1.27.0→go 1.27.3(go mod tidy: no other change, go.sum untouched).github/workflows/release.yml:goreleaser-cross:v1.27.1-1→goreleaser-cross:v1.27.3Local verification (host go1.27.3 darwin/arm64)
go build ./...exit 0,go vet ./...exit 0,go test ./...exit 0 (all packages ok)go build -o agent . && go version -m agentfirst line:agent: go1.27.3Classification
A fix at the place that owns the behaviour (the module floor and the release toolchain pin). Not a hack.
Deliberately not done
toolchainline in go.mod (it would pin instead of floor).GOTOOLCHAIN=go1.27.3in the workflow (a backwards selector that would have to be chased on every patch).go-version-file: go.modsteps — they already follow the floor.Not verified
ci.ymlonly; the release job is tag-triggered.🤖 Generated with Claude Code