From 9e570febb73072d2ac1e5c11e18932c7b5f69235 Mon Sep 17 00:00:00 2001 From: Shubham Jain Date: Thu, 22 Oct 2026 11:22:24 +0530 Subject: [PATCH] fix(keploy-ci): ship go1.27.3 in every image (eMudhra CA compromise) go1.27.3 (2026-10-19) carries the crypto/x509 security fix that blocks the eight compromised eMudhra intermediate CA keys by public key, so Go clients reject certificates chaining to them whatever the trust store says (Debian's still trusts the Sectigo cross-signed copies). keploy/keploy and keploy/enterprise now require go >= 1.27.3 and build with GOTOOLCHAIN=local, so these images must ship exactly that patch: an older image fails the build instead of downloading a compiler. - keploy-ci: GO_VERSION and both tarball SHA-256s (go.dev/dl) - keploy-ci-go-build, keploy-ci-golint: golang:1.27.3-bookworm by digest - keploy-ci-ebpf-objects: same Go; its lane stays on its pinned digest until keploy/ebpf re-pins Signed-off-by: Shubham Jain --- README.md | 4 ++-- keploy-ci-ebpf-objects/Dockerfile | 8 ++++---- keploy-ci-go-build/Dockerfile | 2 +- keploy-ci-golint/Dockerfile | 2 +- keploy-ci/Dockerfile | 6 +++--- 5 files changed, 11 insertions(+), 11 deletions(-) diff --git a/README.md b/README.md index d71482c..86e5b32 100644 --- a/README.md +++ b/README.md @@ -11,7 +11,7 @@ A Docker-in-Docker image with Go and common CI dependencies for running Keploy t **Features:** - Based on `debian:trixie-slim`, with Docker Engine 29.1 from Docker's apt repository (dockerd, docker CLI, buildx, compose, containerd) -- Go 1.27.2, the one Go patch of every image here that has Go; no C +- Go 1.27.3, the one Go patch of every image here that has Go; no C toolchain (Linux builds use `CGO_ENABLED=0`; Windows cross-compiles use `keploy-ci-go-build`) - Common CI utilities (bash, curl, git, jq, sudo, zstd, etc.); no MinIO client @@ -65,7 +65,7 @@ mirror to install it. **Contents:** Ubuntu 22.04 (by index digest), `clang-14` and `llvm-14` 1:14.0.0-1ubuntu1.1, `libbpf-dev` 1:0.5.0-1ubuntu22.04.1, `linux-libc-dev`, `libc6-dev` and their arm64 cross packages, `git`, `ca-certificates`, and Go -1.27.2 (`GOTOOLCHAIN=local`). Every package installed comes from one +1.27.3 (`GOTOOLCHAIN=local`). Every package installed comes from one snapshot.ubuntu.com snapshot and the recipe's packages are pinned with `=version`, so a rebuild resolves the same versions or fails; Go is checked against its SHA-256. amd64 only: the snapshot service does not serve diff --git a/keploy-ci-ebpf-objects/Dockerfile b/keploy-ci-ebpf-objects/Dockerfile index f170dc3..d8533d5 100644 --- a/keploy-ci-ebpf-objects/Dockerfile +++ b/keploy-ci-ebpf-objects/Dockerfile @@ -1,7 +1,7 @@ # keploy-ci-ebpf-objects: the toolchain keploy/ebpf's committed BPF objects are # built with (the recipe in its compile.sh header: Ubuntu 22.04, clang-14 and # llvm-14, libbpf-dev 0.5.0, the native and arm64 cross kernel and libc -# headers, Go 1.27.2, git), pinned, so that its objects-reproducible lane +# headers, Go 1.27.3, git), pinned, so that its objects-reproducible lane # rebuilds every committed object without apt or a Go download. # Used by: keploy/ebpf .woodpecker/objects-reproducible.yml, by digest. # @@ -31,8 +31,8 @@ # pinned the same way. FROM ubuntu@sha256:0a9887931b0e38af2e3487ed39e29436b0535c4f3f52e57745baaf79d1898956 AS go -ADD --checksum=sha256:ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 \ - https://go.dev/dl/go1.27.2.linux-amd64.tar.gz /tmp/go.tgz +ADD --checksum=sha256:65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 \ + https://go.dev/dl/go1.27.3.linux-amd64.tar.gz /tmp/go.tgz RUN tar -C /usr/local -xzf /tmp/go.tgz FROM ubuntu@sha256:0a9887931b0e38af2e3487ed39e29436b0535c4f3f52e57745baaf79d1898956 @@ -90,7 +90,7 @@ ENV PATH=/usr/local/go/bin:$PATH GOTOOLCHAIN=local # target with compile.sh's include paths, from the kernel and libbpf headers, # and strip it. RUN set -eux; \ - go version | grep -qF 'go1.27.2 linux/amd64'; \ + go version | grep -qF 'go1.27.3 linux/amd64'; \ printf '#include \n#include \n#include \n#include \nSEC("tracepoint/x") int probe(void *ctx) { return 0; }\nchar LICENSE[] SEC("license") = "GPL";\n' > /tmp/probe.c; \ clang -target bpf -O2 -g -D__x86_64__ -I/usr/include/x86_64-linux-gnu -c /tmp/probe.c -o /tmp/probe-x86.o; \ clang -target bpf -O2 -g -D__aarch64__ -I/usr/aarch64-linux-gnu/include -I/usr/include/aarch64-linux-gnu -c /tmp/probe.c -o /tmp/probe-arm64.o; \ diff --git a/keploy-ci-go-build/Dockerfile b/keploy-ci-go-build/Dockerfile index be7d351..ccd0e22 100644 --- a/keploy-ci-go-build/Dockerfile +++ b/keploy-ci-go-build/Dockerfile @@ -2,7 +2,7 @@ # Used by: go-test.yml download-and-build, prepare-and-run.yml build-and-upload-keploy # By digest: golang:1.27-bookworm floats to each new patch, and this image's Go # must be the patch every CI image ships (keploy-ci/Dockerfile's GO_VERSION). -FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 +FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 RUN set -eux; \ apt-get update; \ diff --git a/keploy-ci-golint/Dockerfile b/keploy-ci-golint/Dockerfile index a1551e3..9a93961 100644 --- a/keploy-ci-golint/Dockerfile +++ b/keploy-ci-golint/Dockerfile @@ -4,7 +4,7 @@ # Used by: golangci-lint.yml # By digest: golang:1.27-bookworm floats to each new patch, and this image's Go # must be the patch every CI image ships (keploy-ci/Dockerfile's GO_VERSION). -FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61 +FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5 # The C toolchain pieces enterprise's lint needs for its cgo, which the # typecheck runs (cgo code is type-checked from what cgo generates): diff --git a/keploy-ci/Dockerfile b/keploy-ci/Dockerfile index a46ac03..38e7a12 100644 --- a/keploy-ci/Dockerfile +++ b/keploy-ci/Dockerfile @@ -12,9 +12,9 @@ FROM debian:trixie-slim # splits, each lane rebuilding what the other cached. docker-build.yml holds # them to one. GO_SHA256_* are go.dev's SHA-256 of each release tarball # (https://go.dev/dl/?mode=json), checked before it is unpacked. -ARG GO_VERSION=1.27.2 -ARG GO_SHA256_AMD64=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 -ARG GO_SHA256_ARM64=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8 +ARG GO_VERSION=1.27.3 +ARG GO_SHA256_AMD64=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 +ARG GO_SHA256_ARM64=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49 # Keep Docker "major.minor" aligned with the latest stable release. ARG DOCKER_MAJOR_MINOR=29.1 # Provided automatically by BuildKit/buildx; fallback to dpkg when unset.