From f5779774fc1ead904237281931c240814090e49a Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Ois=C3=ADn=20Kyne?= <oisin@obol.tech>
Date: Tue, 20 Oct 2026 21:40:01 +0000
Subject: [PATCH] *: bump Go to 1.27.3 and distrust emSign/AAA roots in the
 image

Go 1.27.3 includes the crypto/x509 fix for CVE-2026-111943. Set toolchain
go1.27.3 and bump the builder, promrated and CodeQL images. Distrust emSign
ECC Root CA - G3 and AAA Certificate Services in the runtime image's system
store until Debian's ca-certificates drops them everywhere.

category: bug
ticket: none
---
 .github/workflows/codeql-analysis.yml | 2 +-
 Dockerfile                            | 7 ++++++-
 go.mod                                | 2 ++
 testutil/promrated/Dockerfile         | 2 +-
 4 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml
index 46b7fbf38..6c20581ce 100644
--- a/.github/workflows/codeql-analysis.yml
+++ b/.github/workflows/codeql-analysis.yml
@@ -21,7 +21,7 @@ on:
     - cron: "18 19 * * 6"
 
 env:
-  GOLANG_VERSION: "1.27"
+  GOLANG_VERSION: "1.27.3"
 
 jobs:
   analyze:
diff --git a/Dockerfile b/Dockerfile
index 2b1c39091..b2c1a028a 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -1,5 +1,5 @@
 # Container for building Go binary.
-FROM golang:1.27.2-trixie AS builder
+FROM golang:1.27.3-trixie AS builder
 # Install dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends build-essential git
 
@@ -24,6 +24,11 @@ RUN echo "Built charon version=$(./charon version)"
 FROM debian:trixie-slim
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates fio wget \
   && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+# Distrust the emSign ECC Root CA - G3 and AAA Certificate Services roots in the
+# system store (used by wget and other non-Go tools in the image) until Debian's
+# ca-certificates drops them. Remove once the base image ships the update.
+RUN sed -i -E 's#^(mozilla/(emSign_ECC_Root_CA_-_G3|Comodo_AAA_Services_root)\.crt)$#!\1#' /etc/ca-certificates.conf \
+  && update-ca-certificates --fresh
 ARG GITHUB_SHA=local
 ENV GITHUB_SHA=${GITHUB_SHA}
 
diff --git a/go.mod b/go.mod
index 03674087f..36768c274 100644
--- a/go.mod
+++ b/go.mod
@@ -2,6 +2,8 @@ module github.com/obolnetwork/charon
 
 go 1.27
 
+toolchain go1.27.3
+
 require (
 	github.com/OffchainLabs/go-bitfield v0.0.0-20251031151322-f427d04d8506
 	github.com/attestantio/go-builder-client v0.8.0
diff --git a/testutil/promrated/Dockerfile b/testutil/promrated/Dockerfile
index 267a7f3b3..361867069 100644
--- a/testutil/promrated/Dockerfile
+++ b/testutil/promrated/Dockerfile
@@ -1,4 +1,4 @@
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 
 # Install dependencies
 RUN apk add --no-cache build-base git