*: bump Go to 1.27.3 and distrust roots in the image

.github/workflows/codeql-analysis.yml

@@ -21,7 +21,7 @@ on:
     - cron: "18 19 * * 6"
 
 env:
-  GOLANG_VERSION: "1.27"
+  GOLANG_VERSION: "1.27.3"
 
 jobs:
   analyze:

Dockerfile

@@ -1,5 +1,5 @@
 # Container for building Go binary.
-FROM golang:1.27.2-trixie AS builder
+FROM golang:1.27.3-trixie AS builder
 # Install dependencies
 RUN apt-get update && apt-get install -y --no-install-recommends build-essential git
 
@@ -22,8 +22,13 @@
 
 # Copy final binary into light stage.
 FROM debian:trixie-slim
 RUN apt-get update && apt-get install -y --no-install-recommends ca-certificates fio wget \
   && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+# Distrust the emSign ECC Root CA - G3 and AAA Certificate Services roots in the
+# system store (used by wget and other non-Go tools in the image) until Debian's
+# ca-certificates drops them. Remove once the base image ships the update.
+RUN sed -i -E 's#^(mozilla/(emSign_ECC_Root_CA_-_G3|Comodo_AAA_Services_root)\.crt)$#!\1#' /etc/ca-certificates.conf \
+  && update-ca-certificates --fresh
 ARG GITHUB_SHA=local
 ENV GITHUB_SHA=${GITHUB_SHA}
 

go.mod

@@ -2,6 +2,8 @@ module github.com/obolnetwork/charon
 
 go 1.27
 
+toolchain go1.27.3
+
 require (
 	github.com/OffchainLabs/go-bitfield v0.0.0-20251031151322-f427d04d8506
 	github.com/attestantio/go-builder-client v0.8.0

testutil/promrated/Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.27.2-alpine AS builder
+FROM golang:1.27.3-alpine AS builder
 
 # Install dependencies
 RUN apk add --no-cache build-base git