[antoinetoussaint-byte]

What

The published binary is built by Go 1.27.2 and carries GO-2026-6809 (crypto/x509, fixed in go1.27.3). This moves every Go pin to 1.27.3 and removes the two pins that selected a toolchain backwards, so go.mod is the one source.

Measured

Before, on the published artefact ghcr.io/codefly-dev/service-warehouse:0.0.3, binary /service-warehouse:

/service-warehouse: go1.27.2

govulncheck -mode=binary: GO-2026-6809 reported as called (Found in crypto/x509@go1.27.2, Fixed in crypto/x509@go1.27.3).

After, on docker build --platform linux/arm64 of this branch (250c044), binary /service-warehouse extracted from the image:

/tmp/claude-501/wh-bin: go1.27.3

govulncheck -mode=binary: No vulnerabilities found. (exit 0). GO-2026-6809 is absent.

go test ./... on the branch: exit 0, every package ok. go mod tidy: no change.

Change

• go.mod: go 1.27.3. A go directive is a floor.
• Dockerfile: FROM golang:1.27.3-trixie@sha256:c124b9ad… (the image-index digest from docker buildx imagetools inspect, -trixie kept for the glibc parity the file's comment explains). ENV GOTOOLCHAIN=go1.27.2 is deleted: the official image sets GOTOOLCHAIN=local, which together with the go.mod floor makes the build exactly 1.27.3.
• .github/workflows/ci.yml: the GOTOOLCHAIN: go1.27.2 env is deleted; each go-version: "1.27.2" becomes go-version-file: go.mod.
• README.md, AGENTS.md, the agent-ci.yml comment: they described the old pins (a literal CI version, a fixed GOTOOLCHAIN) as current rules; they now describe the pins as they are. Nothing else in the repo names 1.27.2.

Classification

A fix at the place that owns the behaviour: the toolchain the image and CI build with is chosen by these pins and nowhere else. Not a hack: no gate is weakened, no finding is suppressed, no version is pinned around.

Reuse

go-version-file: go.mod is the pattern release.yml already uses (lines 40 and 112); ci.yml now matches it instead of carrying a second, literal copy of the version.

Deliberately not done: no toolchain line in go.mod, and no GOTOOLCHAIN=go1.27.3 pin forward in the Dockerfile or CI. An explicit GOTOOLCHAIN=goX.Y.Z is a backwards selector that re-introduces this exact exposure on the next bump; the floor plus the image's GOTOOLCHAIN=local already makes the version exact.

Not verified

• Only linux/arm64 was built and measured locally (OrbStack). linux/amd64 is built by publish-gateway-image.yml from the same index digest; release.yml inventories and tags the already-published locked image; CI's image-sbom job scans both its local single-platform build and the published multi-architecture image recorded in gateway-image.json. That lock still points at the old release; it does not qualify a new patched multi-platform build. The release workflow also inventories the final locked image on both architectures.
• codefly agent ci was not run locally.
• The -trixie base image's glibc version was not re-checked against distroless/cc-debian13; both still name Debian 13.

🤖 Generated with Claude Code

Fresh independent review at 250c044 found no merge-blocking source/design defect. Build, vet, race tests, real runtime E2E and image SBOM tests passed locally. Both measured local gateway and agent binaries report Go 1.27.3. The gateway binary vulnerability scan passes. The agent scan excludes GO-2026-6809 but reports pre-existing broadly scoped Docker advisories GO-2026-4883 and GO-2026-4887; this is not a claim that the agent has a clean vulnerability scan. Review also identified stale AGENTS wording about manual-only agent CI; it is corrected to match the existing pull-request trigger.

The gateway lock remains the old published image until the reviewed source lands and the existing publisher produces a new digest. Merge is not publication; new multi-platform binary proof and the release will be recorded after that sequence completes.