Repository navigation
fix(launcher): build with Go 1.26.10 for eMudhra CA distrust - #2
Merged
Merged
Conversation
Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review on ArchCode
Problem
The eMudhra intermediate CA compromise (disclosed 2026-10-20, https://emudhra.we-have-a-problem.com) is fixed in the Go standard library in Go 1.26.10 / 1.27.3. The Clapper
launcher/is a shipped native binary (built byscripts/build-release.mjswithgo build, CGO off) that downloads the runtime archive over HTTPS from GitHub.launcher/go.modhas onlygo 1.24and no toolchain pin, so it is built with whatever Go the release machine has, and CI uses go 1.24.What changed
launcher/go.mod: addtoolchain go1.26.10. Thego 1.24directive is unchanged, so the language minimum and the "Go 1.24+" build prerequisite in the docs still hold; the Go command fetches go1.26.10 when the local Go is older.go-version-file: launcher/go.mod, which now selects 1.26.10. No workflow edits needed. There is no goreleaser; release builds rungo buildinlauncher/viabuild-release.mjs.Scope
Backend-only (launcher build toolchain).
Risk
Low. No source change; launcher tests pass on 1.26.10. Release machines with
GOTOOLCHAIN=localand Go older than 1.26.10 will now error instead of silently building with a vulnerable stdlib.User impact
Launchers built after this change embed a patched crypto/x509. Already-published launchers are unchanged.
Testing
go -C launcher vet ./...,go -C launcher test -race ./...,gofmt -l launcheron go1.26.10: passgo -C launcher test -race ./...plus the rest of the pnpm suite.Follow-ups
docs/releasing.md) so users get the patched binary.🤖 Generated with Claude Code