fix(keploy-ci): ship go1.27.3 in every image (eMudhra CA compromise)

README.md

@@ -11,7 +11,7 @@ A Docker-in-Docker image with Go and common CI dependencies for running Keploy t
 **Features:**
 - Based on `debian:trixie-slim`, with Docker Engine 29.1 from Docker's apt
   repository (dockerd, docker CLI, buildx, compose, containerd)
-- Go 1.27.2, the one Go patch of every image here that has Go; no C
+- Go 1.27.3, the one Go patch of every image here that has Go; no C
   toolchain (Linux builds use `CGO_ENABLED=0`; Windows cross-compiles use
   `keploy-ci-go-build`)
 - Common CI utilities (bash, curl, git, jq, sudo, zstd, etc.); no MinIO client
@@ -65,7 +65,7 @@ mirror to install it.
 **Contents:** Ubuntu 22.04 (by index digest), `clang-14` and `llvm-14`
 1:14.0.0-1ubuntu1.1, `libbpf-dev` 1:0.5.0-1ubuntu22.04.1, `linux-libc-dev`,
 `libc6-dev` and their arm64 cross packages, `git`, `ca-certificates`, and Go
-1.27.2 (`GOTOOLCHAIN=local`). Every package installed comes from one
+1.27.3 (`GOTOOLCHAIN=local`). Every package installed comes from one
 snapshot.ubuntu.com snapshot and the recipe's packages are pinned with
 `=version`, so a rebuild resolves the same versions or fails; Go is checked
 against its SHA-256. amd64 only: the snapshot service does not serve

keploy-ci-ebpf-objects/Dockerfile

@@ -1,7 +1,7 @@
 # keploy-ci-ebpf-objects: the toolchain keploy/ebpf's committed BPF objects are
 # built with (the recipe in its compile.sh header: Ubuntu 22.04, clang-14 and
 # llvm-14, libbpf-dev 0.5.0, the native and arm64 cross kernel and libc
-# headers, Go 1.27.2, git), pinned, so that its objects-reproducible lane
+# headers, Go 1.27.3, git), pinned, so that its objects-reproducible lane
 # rebuilds every committed object without apt or a Go download.
 # Used by: keploy/ebpf .woodpecker/objects-reproducible.yml, by digest.
 #
@@ -31,8 +31,8 @@
 # pinned the same way.
 FROM ubuntu@sha256:0a9887931b0e38af2e3487ed39e29436b0535c4f3f52e57745baaf79d1898956 AS go
 
-ADD --checksum=sha256:ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5 \
-    https://go.dev/dl/go1.27.2.linux-amd64.tar.gz /tmp/go.tgz
+ADD --checksum=sha256:65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40 \
+    https://go.dev/dl/go1.27.3.linux-amd64.tar.gz /tmp/go.tgz
 RUN tar -C /usr/local -xzf /tmp/go.tgz
 
 FROM ubuntu@sha256:0a9887931b0e38af2e3487ed39e29436b0535c4f3f52e57745baaf79d1898956
@@ -90,7 +90,7 @@ ENV PATH=/usr/local/go/bin:$PATH GOTOOLCHAIN=local
 # target with compile.sh's include paths, from the kernel and libbpf headers,
 # and strip it.
 RUN set -eux; \
-    go version | grep -qF 'go1.27.2 linux/amd64'; \
+    go version | grep -qF 'go1.27.3 linux/amd64'; \
     printf '#include <linux/bpf.h>\n#include <linux/types.h>\n#include <asm/types.h>\n#include <bpf/bpf_helpers.h>\nSEC("tracepoint/x") int probe(void *ctx) { return 0; }\nchar LICENSE[] SEC("license") = "GPL";\n' > /tmp/probe.c; \
     clang -target bpf -O2 -g -D__x86_64__ -I/usr/include/x86_64-linux-gnu -c /tmp/probe.c -o /tmp/probe-x86.o; \
     clang -target bpf -O2 -g -D__aarch64__ -I/usr/aarch64-linux-gnu/include -I/usr/include/aarch64-linux-gnu -c /tmp/probe.c -o /tmp/probe-arm64.o; \

keploy-ci-go-build/Dockerfile

@@ -2,7 +2,7 @@
 # Used by: go-test.yml download-and-build, prepare-and-run.yml build-and-upload-keploy
 # By digest: golang:1.27-bookworm floats to each new patch, and this image's Go
 # must be the patch every CI image ships (keploy-ci/Dockerfile's GO_VERSION).
-FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61
+FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
 
 RUN set -eux; \
     apt-get update; \

keploy-ci-golint/Dockerfile

@@ -4,7 +4,7 @@
 # Used by: golangci-lint.yml
 # By digest: golang:1.27-bookworm floats to each new patch, and this image's Go
 # must be the patch every CI image ships (keploy-ci/Dockerfile's GO_VERSION).
-FROM golang:1.27.2-bookworm@sha256:5cf287a799e6b94384bad13d16b14904c531f51ba65792237e122ce42b392f61
+FROM golang:1.27.3-bookworm@sha256:972b4110ba0f47539a975c31e52c64765e1ff19f2d74469ae4a595c6676e80a5
 
 # The C toolchain pieces enterprise's lint needs for its cgo, which the
 # typecheck runs (cgo code is type-checked from what cgo generates):

keploy-ci/Dockerfile

@@ -12,9 +12,9 @@ FROM debian:trixie-slim
 # splits, each lane rebuilding what the other cached. docker-build.yml holds
 # them to one. GO_SHA256_* are go.dev's SHA-256 of each release tarball
 # (https://go.dev/dl/?mode=json), checked before it is unpacked.
-ARG GO_VERSION=1.27.2
-ARG GO_SHA256_AMD64=ecbadb99091a3f46e31f5f934b068b1864eafa7995211b39eaddf76996045fe5
-ARG GO_SHA256_ARM64=94f3e30b8e374bc285e7dadc11e0865726b9bc6e85b841ccceaabc0214c6b7c8
+ARG GO_VERSION=1.27.3
+ARG GO_SHA256_AMD64=65efbc80fdc1fa2cd2631cad5b481777a68e8725f34e89f50fc6ac714e379b40
+ARG GO_SHA256_ARM64=a06e99309dbcbdca1a8ccd2282c3ee146e55930886e26b4f1193269587165f49
 # Keep Docker "major.minor" aligned with the latest stable release.
 ARG DOCKER_MAJOR_MINOR=29.1
 # Provided automatically by BuildKit/buildx; fallback to dpkg when unset.