Repository navigation
fix(security): require Go 1.27.3 - #516
Conversation
Require the patched crypto/x509 toolchain for CVE-2026-111943 and align CI and bot environments. Upgrade the linter and address compatibility findings. Signed-off-by: Vu Anh Phung <[email protected]>
![peco-review-bot[bot]](https://avatars.githubusercontent.com/in/3801177?s=60&v=4){kind=small}
There was a problem hiding this comment.
Verdict: 1 Medium · 1 Nit
The toolchain bump, the lint upgrade and the DualStack removal all look correct; I found one medium and one low issue. The *inner dereference in category_test.go quietly changes the error type being tested, and pinning CI to one exact patch drops coverage of newer toolchains.
Other findings
- ⚪ Nit — The test matrix used to float on
1.25.x/1.26.x. It is now one exact patch,1.27.3, and every other workflow is pinned the same way. Testing the go.mod floor is good. But CI will never pick up later 1.27 patches, and nothing tests a newer minor version (e.g. 1.28) that consumers will build with. Consider['1.27.3', '1.27.x'], or adding the next minor when it ships, so CI covers both the floor and a current toolchain.
Keep the constructor result as an error interface to retain its dynamic pointer type without triggering Go 1.27 printf vet. Assert pointer identity and errors.Is through wrapping. Signed-off-by: Vu Anh Phung <[email protected]>
There was a problem hiding this comment.
Verdict: 1 Low
Looks good, with one low concern. The version bump is applied consistently across go.mod, the CI workflows, the bot prompts and the docs. Removing the deprecated DualStack field and strengthening the tests for the vet findings are both fine. The only concern is that the CI matrix now tests just one exact patch.
Signed-off-by: Vu Anh Phung <[email protected]>
Signed-off-by: Vu Anh Phung <[email protected]>
There was a problem hiding this comment.
Verdict: 1 Medium
Looks good overall, with one medium concern: building osv-scanner from source may break the Security Scan on fork PRs, where the JFrog GOPROXY setup is skipped. The rest of the change looks consistent: the Go floor bump, the matrix/lint toolchain alignment, removing the deprecated DualStack field (a no-op since fast fallback is already the default), and the stronger error-chain test assertions (*requestError is a pointer, so assert.Same is valid).
| https://github.com/google/osv-scanner/releases/download/v2.3.8/osv-scanner_linux_amd64 | ||
| chmod +x /tmp/osv-scanner | ||
| # Build govulncheck with the same Go version it uses to load packages. | ||
| GOBIN=/tmp GOTOOLCHAIN=local go install github.com/google/osv-scanner/v2/cmd/[email protected] |
There was a problem hiding this comment.
🟡 Medium — The scanner used to be a downloaded release binary. It's now built with go install [email protected], which has to fetch osv-scanner and all of its module dependencies through GOPROXY. On fork PRs the Setup JFrog step is skipped on purpose, so GOPROXY falls back to the default proxy.golang.org. The protected runner group is hardened: the kernel job notes that it blocks direct crates.io access. If the Go proxy is blocked the same way, the Security Scan job will fail at install time on every fork PR. That breaks the case the comment at L47-49 says is supported.
Even if the proxy is reachable, that comment is now stale: fork PRs do download modules now. Possible fixes:
- keep the prebuilt-binary path when JFrog is unavailable, or
- update the comment to say fork-PR scans depend on public proxy access (and confirm the runner allows it).
Also a small point: the new inline comment says "Build govulncheck", but this command builds osv-scanner. govulncheck only comes in as a library dependency.
Signed-off-by: Vu Anh Phung <[email protected]>
Require Go 1.27.3 to include the crypto/x509 fix for compromised emSign certificates (CVE-2026-111943). This raises the consumer minimum from Go 1.25.0. CI tests both the exact 1.27.3 floor and the latest 1.27 patch, using
check-latest: trueto avoid stale runner caches.Upgrade golangci-lint to v2.15.0 and build it with the selected toolchain. Use the Go 1.27-compatible OSV-Scanner v2.7.0 release binary so scanner installation does not require module-proxy access on fork PRs. Fix the vet and deprecation findings exposed by the upgrade.
Validation passed:
make test(1,229 tests; two live warehouse tests skipped),CGO_ENABLED=1 go test -tags databricks_kernel ./...,make lint, workflow YAML and shell syntax checks, and OSV-Scanner v2.7.0 (zero unsuppressed vulnerabilities; CI findings parser verified).This PR was created with GitHub MCP.