update to go1.27rc2

.github/workflows/.test.yml

@@ -30,7 +30,7 @@ on:
         required: false
 
 env:
-  GO_VERSION: "1.26"
+  GO_VERSION: "1.27rc2"
   SETUP_BUILDX_VERSION: "edge"
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
 

.github/workflows/buildkit.yml

@@ -24,7 +24,7 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  GO_VERSION: "1.26"
+  GO_VERSION: "1.27rc2"
   SETUP_BUILDX_VERSION: "edge"
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   SCOUT_VERSION: "1.20.2"

.github/workflows/frontend.yml

@@ -22,7 +22,7 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  GO_VERSION: "1.26"
+  GO_VERSION: "1.27rc2"
   SETUP_BUILDX_VERSION: "edge"
   SETUP_BUILDKIT_TAG: "moby/buildkit:latest"
   SCOUT_VERSION: "1.20.2"

.github/workflows/test-os.yml

@@ -22,7 +22,7 @@ on:
       - 'frontend/dockerfile/docs/**'
 
 env:
-  GO_VERSION: "1.26"
+  GO_VERSION: "1.27rc2"
   SETUP_BUILDX_VERSION: "edge"
   SETUP_BUILDKIT_IMAGE: "moby/buildkit:latest"
   DESTDIR: "./bin"
@@ -139,7 +139,7 @@ jobs:
         name: Set up Go
         uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: "${{ env.GO_VERSION }}"
+          go-version: "1.27.0-rc.2"
           cache: false
       -
         name: Download artifacts

.golangci.yml

@@ -91,6 +91,8 @@ linters:
     staticcheck:
       checks:
         - all
+        # Produces false positives for shared callers of platform-specific unsupported stubs.
+        - -SA4023
     testifylint:
       disable:
         - empty

Dockerfile

@@ -25,7 +25,7 @@ ARG EXPORT_BASE=alpine
 ARG ALPINE_VERSION=3.23
 ARG UBUNTU_VERSION=24.04
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG XX_VERSION=1.9.0
 ARG BUILDKIT_DEBUG
 

cache/manager_test.go

@@ -2664,9 +2664,15 @@ func mapToBlob(m map[string]string, compress bool) ([]byte, ocispecs.Descriptor,
 	if !compress {
 		return mapToBlobWithCompression(m, nil)
 	}
-	return mapToBlobWithCompression(m, func(w io.Writer) (io.WriteCloser, string, error) {
-		return gzip.NewWriter(w), ocispecs.MediaTypeImageLayerGzip, nil
-	})
+	return mapToBlobWithCompression(m, gzipBlobWriter)
+}
+
+func gzipBlobWriter(w io.Writer) (io.WriteCloser, string, error) {
+	// Go 1.27 changed compress/flate output in CL 707355 for golang/go#75532.
+	// Use BuildKit's pinned Go 1.26 encoder when calculating expected digests.
+	compressor, _ := compression.Gzip.Compress(context.Background(), compression.New(compression.Gzip))
+	wc, err := compressor(w, ocispecs.MediaTypeImageLayerGzip)
+	return wc, ocispecs.MediaTypeImageLayerGzip, err
 }
 
 func mapToBlobWithCompression(m map[string]string, compress func(io.Writer) (io.WriteCloser, string, error)) ([]byte, ocispecs.Descriptor, error) {
@@ -2718,7 +2724,11 @@ func fileToBlob(file *os.File, compress bool) ([]byte, ocispecs.Descriptor, erro
 
 	var dest io.WriteCloser = &iohelper.NopWriteCloser{Writer: buf}
 	if compress {
-		dest = gzip.NewWriter(buf)
+		var err error
+		dest, _, err = gzipBlobWriter(buf)
+		if err != nil {
+			return nil, ocispecs.Descriptor{}, err
+		}
 	}
 	tw := tar.NewWriter(io.MultiWriter(sha.Hash(), dest))
 

client/client_export_image_test.go

@@ -215,7 +215,9 @@ func testBuildExportWithForeignLayer(t *testing.T, sb integration.Sandbox) {
 
 		ctx := namespaces.WithNamespace(sb.Context(), "buildkit")
 
-		resolver := docker.NewResolver(docker.ResolverOptions{PlainHTTP: true})
+		resolver := docker.NewResolver(docker.ResolverOptions{
+			Hosts: docker.ConfigureDefaultRegistries(docker.WithPlainHTTP(docker.MatchAllHosts)),
+		})
 		name, desc, err := resolver.Resolve(ctx, target)
 		require.NoError(t, err)
 
@@ -262,7 +264,9 @@ func testBuildExportWithForeignLayer(t *testing.T, sb integration.Sandbox) {
 
 		ctx := namespaces.WithNamespace(sb.Context(), "buildkit")
 
-		resolver := docker.NewResolver(docker.ResolverOptions{PlainHTTP: true})
+		resolver := docker.NewResolver(docker.ResolverOptions{
+			Hosts: docker.ConfigureDefaultRegistries(docker.WithPlainHTTP(docker.MatchAllHosts)),
+		})
 		name, desc, err := resolver.Resolve(ctx, target)
 		require.NoError(t, err)
 

client/policy_test.go

@@ -696,12 +696,12 @@ func testSourceMetaPolicySession(t *testing.T, sb integration.Sandbox) {
 			source: func() (*opspb.SourceOp, sourceresolver.Opt) {
 				p := platforms.DefaultSpec()
 				return &opspb.SourceOp{
-						Identifier: "docker-image://docker.io/library/alpine:latest",
-					}, sourceresolver.Opt{
-						ImageOpt: &sourceresolver.ResolveImageOpt{
-							Platform: &p,
-						},
-					}
+					Identifier: "docker-image://docker.io/library/alpine:latest",
+				}, sourceresolver.Opt{
+					ImageOpt: &sourceresolver.ResolveImageOpt{
+						Platform: &p,
+					},
+				}
 			},
 			callbacks: []policysession.PolicyCallback{
 				func(ctx context.Context, req *policysession.CheckPolicyRequest) (*policysession.DecisionResponse, *pb.ResolveSourceMetaRequest, error) {

examples/buildkit0/buildkit.go

@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.26-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.27rc2-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").

examples/buildkit1/buildkit.go

@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.26-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.27rc2-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").

examples/buildkit2/buildkit.go

@@ -33,7 +33,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.26-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.27rc2-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").

examples/buildkit3/buildkit.go

@@ -34,7 +34,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.26-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.27rc2-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").

examples/buildkit4/buildkit.go

@@ -37,7 +37,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.26-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.27rc2-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").

examples/nested-llb/main.go

@@ -32,7 +32,7 @@ func main() {
 }
 
 func goBuildBase() llb.State {
-	goAlpine := llb.Image("docker.io/library/golang:1.26-alpine")
+	goAlpine := llb.Image("docker.io/library/golang:1.27rc2-alpine")
 	return goAlpine.
 		AddEnv("PATH", "/usr/local/go/bin:"+system.DefaultPathEnvUnix).
 		AddEnv("GOPATH", "/go").

frontend/dockerfile/cmd/dockerfile-frontend/Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.9.0
 

frontend/gateway/gateway.go

@@ -327,12 +327,12 @@ func metadataMount(def *opspb.Definition) (*executor.Mount, func(), error) {
 	}
 
 	return &executor.Mount{
-			Src:      &bind{dir},
-			Dest:     "/run/config/buildkit/metadata",
-			Readonly: true,
-		}, func() {
-			os.RemoveAll(dir)
-		}, nil
+		Src:      &bind{dir},
+		Dest:     "/run/config/buildkit/metadata",
+		Readonly: true,
+	}, func() {
+		os.RemoveAll(dir)
+	}, nil
 }
 
 type bind struct {

go.mod

@@ -31,7 +31,7 @@ require (
 	github.com/containerd/nydus-snapshotter v0.15.15
 	github.com/containerd/platforms v1.0.0-rc.4
 	github.com/containerd/stargz-snapshotter v0.18.2
-	github.com/containerd/stargz-snapshotter/estargz v0.18.2
+	github.com/containerd/stargz-snapshotter/estargz v0.18.3-0.20260607065519-4daea594a1da
 	github.com/containerd/typeurl/v2 v2.3.0
 	github.com/containernetworking/plugins v1.9.1
 	github.com/coreos/go-systemd/v22 v22.7.0

go.sum

@@ -163,8 +163,8 @@ github.com/containerd/plugin v1.1.0 h1:O+7lczNJVMy8rz0YNx3xGB8tTf5qY4i5abF041Ew1
 github.com/containerd/plugin v1.1.0/go.mod h1:qBTum+A8lJ6lO44A19Eo7y1OlcLj4OWFH1DA/vnHmcc=
 github.com/containerd/stargz-snapshotter v0.18.2 h1:Ev/sxfQUjwzJQ9eqy3XzttcQ3osMIqkQgMYlcET+10M=
 github.com/containerd/stargz-snapshotter v0.18.2/go.mod h1:iS0a4lgCFjGbdBJNrm1jwvaMFGGnQ6PZ5Sd09i060h8=
-github.com/containerd/stargz-snapshotter/estargz v0.18.2 h1:yXkZFYIzz3eoLwlTUZKz2iQ4MrckBxJjkmD16ynUTrw=
-github.com/containerd/stargz-snapshotter/estargz v0.18.2/go.mod h1:XyVU5tcJ3PRpkA9XS2T5us6Eg35yM0214Y+wvrZTBrY=
+github.com/containerd/stargz-snapshotter/estargz v0.18.3-0.20260607065519-4daea594a1da h1:r8f4sAf5mAeHWsO1VYjKHSwmj1yHpa69+JGDZvF/C68=
+github.com/containerd/stargz-snapshotter/estargz v0.18.3-0.20260607065519-4daea594a1da/go.mod h1:Ri93bhwN/gKJeEuEpFle/31ij7qC8La07W4ZFJQPIlM=
 github.com/containerd/ttrpc v1.2.9 h1:ha0ak962T0s3CA/RoZ6S6xiWZQF24GrBaEpiGX1uihg=
 github.com/containerd/ttrpc v1.2.9/go.mod h1:jjtQRwXm4DL3KsHKW8vDiUOV6wO0hi6IPhmJhxU7aEs=
 github.com/containerd/typeurl/v2 v2.3.0 h1:HZHPhRWo5XMy3QGQoPrUzbW/2ckwjfweHmOwlkIrPAQ=

hack/dockerfiles/archutil.Dockerfile

@@ -1,7 +1,7 @@
 # syntax=docker/dockerfile-upstream:master
 # check=error=true
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG ALPINE_VERSION=3.23
 ARG DEBIAN_VERSION=trixie
 

hack/dockerfiles/docs-dockerfile.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG ALPINE_VERSION=3.23
 
 FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest

hack/dockerfiles/docs.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG ALPINE_VERSION=3.23
 
 FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS golatest

hack/dockerfiles/generated-files.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG DEBIAN_VERSION=trixie
 ARG PROTOC_VERSION=3.14.0
 ARG PROTOC_GOOGLEAPIS_VERSION=2af421884dd468d565137215c946ebe4e245ae26

hack/dockerfiles/govulncheck.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile:1
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG GOVULNCHECK_VERSION=v1.3.0
 ARG FORMAT="text"
 

hack/dockerfiles/lint.Dockerfile

@@ -1,10 +1,11 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG ALPINE_VERSION=3.23
 ARG XX_VERSION=1.9.0
 ARG PROTOLINT_VERSION=0.56.4
 ARG GOLANGCI_LINT_VERSION=v2.12.2
+ARG STATICCHECK_VERSION=v0.8.0-rc.1
 ARG GOLANGCI_FROM_SOURCE=false
 ARG GOPLS_VERSION=v0.38.0
 # GOPLS_ANALYZERS defines gopls analyzers to be run. disabled by default: deprecated simplifyrange unusedfunc unusedvariable
@@ -18,7 +19,9 @@ FROM --platform=$BUILDPLATFORM tonistiigi/xx:${XX_VERSION} AS xx
 FROM golang-base AS golangci-build
 WORKDIR /src
 ARG GOLANGCI_LINT_VERSION
+ARG STATICCHECK_VERSION
 ADD https://github.com/golangci/golangci-lint.git#${GOLANGCI_LINT_VERSION} .
+RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/ go get honnef.co/go/tools@${STATICCHECK_VERSION}
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/ go mod download
 RUN --mount=type=cache,target=/go/pkg/mod --mount=type=cache,target=/root/.cache/ mkdir -p out && go build -o /out/golangci-lint ./cmd/golangci-lint
 

hack/dockerfiles/vendor.Dockerfile

@@ -1,6 +1,6 @@
 # syntax=docker/dockerfile-upstream:master
 
-ARG GO_VERSION=1.26
+ARG GO_VERSION=1.27rc2
 ARG ALPINE_VERSION=3.23
 
 FROM golang:${GO_VERSION}-alpine${ALPINE_VERSION} AS base

solver/llbsolver/ops/exec_binfmt.go

@@ -71,12 +71,12 @@ func (m *staticEmulatorMount) Mount() ([]mount.Mount, func() error, error) {
 
 	ret = true
 	return []mount.Mount{{
-			Type:    "bind",
-			Source:  filepath.Join(tmpdir, qemuMountName),
-			Options: []string{"ro", "bind"},
-		}}, func() error {
-			return os.RemoveAll(tmpdir)
-		}, nil
+		Type:    "bind",
+		Source:  filepath.Join(tmpdir, qemuMountName),
+		Options: []string{"ro", "bind"},
+	}}, func() error {
+		return os.RemoveAll(tmpdir)
+	}, nil
 }
 
 func (m *staticEmulatorMount) IdentityMapping() *user.IdentityMapping {

util/archutil/generate.go

@@ -4,13 +4,15 @@ package main
 
 import (
 	"bytes"
-	"compress/gzip"
+	"context"
 	"flag"
 	"html/template"
 	"io"
 	"os"
 	"path/filepath"
 
+	"github.com/moby/buildkit/util/compression"
+	"github.com/moby/buildkit/util/compression/go126flate"
 	"github.com/pkg/errors"
 )
 
@@ -32,7 +34,12 @@ func main() {
 		defer f.Close()
 		buf := &bytes.Buffer{}
 
-		gz, err := gzip.NewWriterLevel(newHexStringWriter(buf), gzip.BestCompression)
+		// Go 1.27 changed compress/flate output in CL 707355 for
+		// golang/go#75532. Use BuildKit's Go 1.26-compatible gzip writer so
+		// the checked-in archutil binaries do not depend on the Go toolchain.
+		compressor, _ := compression.Gzip.Compress(context.Background(),
+			compression.New(compression.Gzip).SetLevel(go126flate.BestCompression))
+		gz, err := compressor(newHexStringWriter(buf), "")
 		if err != nil {
 			panic(err)
 		}

util/compression/go126flate/LICENSE

@@ -0,0 +1,27 @@
+Copyright 2009 The Go Authors.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are
+met:
+
+   * Redistributions of source code must retain the above copyright
+notice, this list of conditions and the following disclaimer.
+   * Redistributions in binary form must reproduce the above
+copyright notice, this list of conditions and the following disclaimer
+in the documentation and/or other materials provided with the
+distribution.
+   * Neither the name of Google LLC nor the names of its
+contributors may be used to endorse or promote products derived from
+this software without specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.