Repository navigation
deps: build releases with Go 1.27.3 and bump x/net in socair-sigstore - #312
Merged
Merged
Conversation
Release binaries are built with the toolchain release.yml pins. rc.8's were built with go1.27.2, which lacks GO-2026-6809 (fixed in go1.27.3): crypto/x509 now refuses the intermediate certificates that are no longer trusted. Socair reaches Certificate.Verify through TLS (airlock pull, registry calls) and through PKI-certificate OMS bundles (internal/oms); socair-sigstore reaches it through its keyless verification. CI already tests on the current 1.27 release, so this changes only what ships. socair-sigstore moves golang.org/x/net from v0.60.0 to v0.62.0, clearing GO-2026-6860 and GO-2026-6866 (x/net/html, which it does not import; the OpenSSF Scorecard check flags the module version). go get also raised x/crypto, x/sync, x/sys, x/term, and x/text to the versions x/net v0.62.0 requires; vendor/ is regenerated with go mod vendor. govulncheck under go1.27.3: the main module finds none; socair-sigstore finds none called (GO-2026-5932, x/crypto/openpgp, is required but not imported, and has no tagged fix). Signed-off-by: Christopher Maher <chris@mahercode.io>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Triage of the repository's open security alerts found one fix that the shipped binaries lack, and one module version that OpenSSF Scorecard flags.
Go 1.27.3 for release builds
release.ymlpins the release toolchain. It was 1.27.2, which built rc.8 (go versionon the rc.8 binaries readsgo1.27.2).GO-2026-6809 is fixed only in 1.27.3. With the fix,
crypto/x509refuses the intermediate certificates that are no longer trusted. Socair callsCertificate.Verifyin three places:internal/oms);CI already runs tests and govulncheck on the current 1.27 release (
go-version-file: go.mod), which is why CI was green while the pinned release toolchain lagged. This changes only what ships. The release dry run on this PR rebuilds with 1.27.3 and checks the build reproduces.socair-sigstore: golang.org/x/net v0.60.0 → v0.62.0
This clears GO-2026-6860 and GO-2026-6866. Both are in
x/net/html, which socair-sigstore doesn't import (it reaches onlyx/net/idna). Scorecard's Vulnerabilities check flags the module version anyway.go getalso movedx/crypto,x/sync,x/sys,x/term, andx/textto the versions x/net v0.62.0 requires.vendor/was regenerated withgo mod vendor.Checks (local, Go 1.27.3)
x/crypto/openpgp) stays: it's required but not imported, and has no tagged fix.go test -racepass.go mod vendorreproduces the vendor tree.go mod verifypasses.Assisted-by: Claude Code (ran the alert triage and govulncheck, made the change; the maintainer's review is pending)