Repository navigation
Build with Go 1.27.3 so the x509 denylist is in the binary - #329
Merged
Merged
Conversation
GO-2026-6809 (CVE-2026-111943) landed in crypto/x509 on 21 October and is fixed in go1.27.3. The scheduled security scan has failed on main every day since: #319. govulncheck reports it as a finding rather than a called vulnerability, because the affected symbol is Certificate.Verify and nothing here calls it directly - it is reached through the TLS stack when connecting to Postgres or an object store over TLS. That is a real path, and the denylist is the whole of the fix: there is nothing to change in this code, only the standard library to move. The toolchain directive, the seven workflow GO_VERSION values and the Dockerfile pin move together because check-toolchains.sh requires it, and because a release that builds the binary on one Go and the image on another cannot keep its reproducibility promise. Worth recording that the comment above the go directive is wrong about this. It says CI "resolves the newest patch of a release line so that standard library fixes arrive without anyone editing a file". It does not - GO_VERSION is an exact pin that check-toolchains.sh holds equal to this directive, which is why a stdlib fix published on the 21st was still unapplied on the 25th. The comment is left for a separate change, since correcting it is a decision about whether to keep pinning rather than a typo. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Signed-off-by: Serraniel <mail@serraniel.dev>
Serraniel
force-pushed
the
fix/go-1-27-3
branch
from
October 25, 2026 20:07
f84d3ff to
1fa7353
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #319.
What was failing
The scheduled security scan has failed on
mainevery day since 23 October:GO-2026-6809 (CVE-2026-111943) was published on 21 October and is fixed in go1.27.3. This project builds with 1.27.2.
It is reported as a finding rather than a called vulnerability: the affected symbol is
Certificate.Verify, which nothing here calls directly. It is reached through the TLS stack when the server connects to PostgreSQL or an object store over TLS, whichDockerfileinstallsca-certificatesfor. The denylist is the entire fix, so there is nothing to change in this code — only the standard library to move.What changed
Nine files, one version:
go.mod— thetoolchaindirectiveGO_VERSIONDockerfile—golang:1.27.3-alpine, digest re-pinned tosha256:b8c9b82a…They move together because
check-toolchains.shrequires it, and because a release that builds the binary on one Go and the image on another cannot keep its reproducibility promise.Verification
scripts/check-toolchains.shtoolchains: Go 1.27.3 and Node 26 everywhere.go build ./...go vet ./...go test ./...govulncheck ./...on 1.27.3No vulnerabilities found.The one remaining entry is GO-2026-5932,
golang.org/x/crypto/openpgpbeing unmaintained. It isFixed in: N/A, uncalled, and pre-existing onmain— unrelated to this change.One thing this surfaced, deliberately left alone
The comment above the
godirective says continuous integration "resolves the newest patch of a release line so that standard library fixes arrive without anyone editing a file."It does not.
GO_VERSIONis an exact pin thatcheck-toolchains.shholds equal to thetoolchaindirective, which is why a standard library fix published on the 21st was still unapplied on the 25th and had to be noticed by a human reading a red scan.Correcting that comment is a decision about whether to keep pinning at all — Dependabot does not offer Go toolchain patches, so today nothing proposes them — rather than a typo to fix in passing. Filed separately rather than folded in here.
🤖 Generated with Claude Code