Repository navigation
fix: build with Go 1.26.10 for the eMudhra CA distrust - #54
Merged
Merged
Conversation
monit-reviewer
left a comment
monit-reviewer
left a comment
There was a problem hiding this comment.
Automated PR Review
Reviewed commit: 47ca57743c7a
Profile: claude-monit-reviewer - Posting as: monit-reviewer
Summary
| Reviewer | Findings |
|---|---|
| automation:ci-release | 1 |
| go:implementation-tests | 0 |
| policies:conventions | 0 |
automation:ci-release (1 finding)
Major - go.mod:5
The PR says actions/setup-go picks up this toolchain directive so CI, tests and releases build with Go 1.26.10. That holds only for jobs using
go-version-file(arch-package.yml). ci.yml (3 jobs), release.yml and test-chocolatey.yml pingo-version: '1.24'literally, so setup-go installs 1.24.x and ignores this line. These builds reach 1.26.10 only if the go 1.24 binary auto-switches via GOTOOLCHAIN=auto, which means a per-run toolchain download. The Go version is then set in two places and the release build depends on that implicit download. Fix: change those workflows togo-version-file: go.modso go.mod is the single source of truth and setup-go installs the toolchain directly. Without that, the distrust fix isn't guaranteed in release artifacts.
Reviewer Coverage
automation:ci-release— complete (broad); skipped: none; constraints: Did not run workflows or verify toolchain download behavior. Only go.mod was assigned; workflow files were read for context but not reviewed in full.go:implementation-tests— complete (broad); skipped: none; constraints: Did not confirm whether the repo has other go.mod files or a go.work; only the assigned go.mod was reviewed. Did not run a build with GOTOOLCHAIN=go1.26.10; relied on the diff and the PR's stated verification.policies:conventions— complete (broad); skipped: none; constraints: Shared cli-common docs were not available in context; review limited to repo-local files and the diff. Workflows pin go-version '1.24' rather than go-version-file; with no GOTOOLCHAIN override found in the repo, the go command auto-switches to the toolchain directive, so no finding was raised.
Inspected files (1)
go.mod
0 PR discussion threads considered. 0 summarized; 0 resolved.
Completed in 3m 57s | ~$0.86 (est.) | claude-sonnet-5-5 | cr 0.10.325
| Field | Value |
|---|---|
| Model | claude-sonnet-5-5 |
| Reviewers | automation:ci-release, go:implementation-tests, policies:conventions |
| Engine | claude_cli · claude-sonnet-5-5 |
| Reviewed by | cr · monit-reviewer |
| Duration | 3m 57s wall · 6m 55s compute |
| Cost | ~$0.86 (est.) |
| Pricing basis | baseline-2026-10-02/pricing |
| Tokens | 42 in / 6.1k out |
Per-workstream usage
orchestrator-selection— claude-sonnet-5-5- In: 6
- Out: 896
- Cache read: 44.0k
- Cache create: 36.3k
- Cost: ~$0.16 (est.)
- Duration: 54s
automation:ci-release— claude-sonnet-5-5- In: 10
- Out: 1.9k
- Cache read: 125.5k
- Cache create: 21.1k
- Cost: ~$0.13 (est.)
- Duration: 1m 41s
go:implementation-tests— claude-sonnet-5-5- In: 8
- Out: 1.0k
- Cache read: 74.2k
- Cache create: 32.5k
- Cost: ~$0.16 (est.)
- Duration: 1m 54s
policies:conventions— claude-sonnet-5-5- In: 12
- Out: 1.8k
- Cache read: 137.0k
- Cache create: 33.0k
- Cost: ~$0.18 (est.)
- Duration: 1m 47s
orchestrator-rollup— claude-sonnet-5-5- In: 6
- Out: 524
- Cache read: 96.6k
- Cache create: 51.7k
- Cost: ~$0.23 (est.)
- Duration: 38s
zzwong
marked this pull request as ready for review
October 21, 2026 00:48
Pin the Go toolchain to 1.26.10, which distrusts the compromised eMudhra intermediate keys (CVE-2026-111943), and read the Go version from go.mod in every setup-go step.
zzwong
force-pushed
the
zzwong/go-1.26.10-toolchain
branch
from
October 21, 2026 00:53
47ca577 to
dc765d6
Compare
monit-reviewer
approved these changes
Oct 21, 2026
monit-reviewer
left a comment
monit-reviewer
left a comment
There was a problem hiding this comment.
Automated PR Review
Reviewed commit: 911738b31faa
Profile: claude-monit-reviewer - Posting as: monit-reviewer
Summary
| Reviewer | Findings |
|---|---|
| automation:ci-release | 0 |
| go:implementation-tests | 0 |
| policies:conventions | 0 |
Reviewer Coverage
automation:ci-release— complete (constrained); inspected 4 assigned files (5 inspected across reviewers):.github/workflows/ci.yml,.github/workflows/release.yml,.github/workflows/test-chocolatey.yml,go.mod; skipped: none; constraints: Did not run workflows; the golangci-lint v2.15.0 version bump and its Go 1.27 build claim were not verified.go:implementation-tests— complete (constrained); inspected 2 assigned files (5 inspected across reviewers):go.mod,internal/cmd/searchcmd/search.go; skipped: none; constraints: Did not run a build or tests with GOTOOLCHAIN=go1.26.10; relied on the diff. Reviewed only go.mod and internal/cmd/searchcmd/search.go; workflow changes are outside this assignment.policies:conventions— complete (constrained); inspected 1 assigned file (5 inspected across reviewers):go.mod; skipped: none; constraints: Shared cli-common docs were not available in context; review limited to go.mod (the only assigned file) and repo-local workflow files read for context.
Inspected files (5)
.github/workflows/ci.yml.github/workflows/release.yml.github/workflows/test-chocolatey.ymlgo.modinternal/cmd/searchcmd/search.go
0 PR discussion threads considered. 0 summarized; 0 resolved.
Completed in 1m 13s | ~$0.91 (est.) | claude-sonnet-5-5 | cr 0.10.325
| Field | Value |
|---|---|
| Model | claude-sonnet-5-5 |
| Reviewers | automation:ci-release, go:implementation-tests, policies:conventions |
| Engine | claude_cli · claude-sonnet-5-5 |
| Reviewed by | cr · monit-reviewer |
| Duration | 1m 13s wall · 1m 53s compute |
| Cost | ~$0.91 (est.) |
| Pricing basis | baseline-2026-10-02/pricing |
| Tokens | 28 in / 3.1k out |
Per-workstream usage
automation:ci-release— claude-sonnet-5-5- In: 8
- Out: 1.0k
- Cache read: 164.9k
- Cache create: 16.2k
- Cost: ~$0.11 (est.)
- Duration: 34s
go:implementation-tests— claude-sonnet-5-5- In: 6
- Out: 763
- Cache read: 94.6k
- Cache create: 52.4k
- Cost: ~$0.24 (est.)
- Duration: 34s
policies:conventions— claude-sonnet-5-5- In: 8
- Out: 846
- Cache read: 150.4k
- Cache create: 52.2k
- Cost: ~$0.25 (est.)
- Duration: 30s
orchestrator-rollup— claude-sonnet-5-5- In: 6
- Out: 464
- Cache read: 136.0k
- Cache create: 71.2k
- Cost: ~$0.32 (est.)
- Duration: 12s
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
toolchain go1.26.10to every Go module so CI and release builds use Go 1.26.10. Go 1.26.10 and 1.27.3 add acrypto/x509distrust of the compromised eMudhra intermediate keys (CVE-2026-111943), which applies whatever root store the binary verifies against. Binaries built with earlier releases still accept certificates issued through those keys on Linux, where verification uses the system roots.actions/setup-gouses thetoolchaindirective in preference to thegodirective, so builds, tests and releases all pick it up. Thegolanguage version is unchanged.Verification
GOTOOLCHAIN=go1.26.10 go build ./...passes for every module.