From 1488fde0f5ab7d6238585fba7029ead88f4056d5 Mon Sep 17 00:00:00 2001 From: Valen Torassa Date: Mon, 26 Oct 2026 09:56:13 -0300 Subject: [PATCH] Build with Go 1.27.3 for GO-2026-6809 Go 1.27.2's crypto/x509 still trusted a set of compromised intermediate certificates. govulncheck found the server reaching x509.Certificate.Verify through the Redis client. Bump the toolchain and the Docker build image to 1.27.3 and note it in the changelog. --- CHANGELOG.md | 10 ++++++++++ Dockerfile | 2 +- go.mod | 2 +- 3 files changed, 12 insertions(+), 2 deletions(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index c977323..d5ae5a3 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -2,6 +2,16 @@ Notable changes to VT-SecretShare. Versions follow [Semantic Versioning](https://semver.org/). +## Unreleased + +### Security + +- Build with Go 1.27.3. Go 1.27.2's `crypto/x509` still trusted a set of + compromised intermediate certificates + ([GO-2026-6809](https://pkg.go.dev/vuln/GO-2026-6809)); govulncheck found the + server reaching `x509.Certificate.Verify`. The Docker image builds with + `golang:1.27.3-alpine` too. + ## 1.0.0 - 2026-10-20 First tagged release. It covers everything built since June 2026, the same code diff --git a/Dockerfile b/Dockerfile index 0a71903..7f08f6f 100644 --- a/Dockerfile +++ b/Dockerfile @@ -1,5 +1,5 @@ # Build (works the same under `docker build` and `podman build`). -FROM golang:1.27.2-alpine AS build +FROM golang:1.27.3-alpine AS build WORKDIR /src COPY go.mod go.sum* ./ RUN go mod download diff --git a/go.mod b/go.mod index 383f141..8d5f786 100644 --- a/go.mod +++ b/go.mod @@ -2,7 +2,7 @@ module github.com/ValentinTorassa/VT-SecretShare go 1.27.0 -toolchain go1.27.2 +toolchain go1.27.3 require github.com/redis/go-redis/v9 v9.23.0