[trukhinyuri]

GO-2026-6809 (distrust of compromised intermediate certificates in crypto/x509), published with the Go 1.26.10 security release, turns three required checks red on every change: govulncheck, go-build-module-integrity and go-test. The CloudRING binaries reach x509.Certificate.Verify, so each check fails on go1.26.9.

Compiler. Go 1.26.10 fixes GO-2026-6809. It is now pinned in go.mod, every setup-go step, the PostgreSQL test container and the synthetic reference image (golang:1.26.10-bookworm index 23ce7133), the etcdutl build and adjudication scripts and the release component inventory, and the docs that name the release compiler follow. The rebuilt etcdutl 3.6.14 changes with the compiler, so its digest is re-pinned to 04c53c46f259a1c470a74c83d5a3a4a5d0b1e54db4d42dfaeb66ab78b3cb71cf in the worker, the three etcd-recovery schemas, the contract README and release provenance. .github/workflow-policy.json carries the new workflow digests.

Release bundle gate. The bundle job also reported GO-2026-6348, 6603, 6611, 6612 and 6617 as "source scan confirms reachable code paths ... but the binary scan did not flag it". These are not new findings. GO-2026-6809 in the bundle binaries started the source stage, which always scans the pinned etcdutl source. That scan reports the five etcdutl advisories, and the check that compares source findings with binary findings does not consult advisory_overrides. With go1.26.10 the 17 bundle binaries scan clean, the source stage does not run, and the five IDs stay under the overrides adjudicated in #177. The etcdutl gate passes with those overrides unchanged. etcd 3.6.16 now ships golang.org/x/net v0.61.0 and grpc v1.83.2, which meets the removal condition of all five overrides.

Validation with go1.26.10 on linux/arm64: go mod verify, go mod tidy -diff, go build, go vet, go test, race, the Windows build and vet, govulncheck (0 reachable), docscheck, source-safety for the tree and the commit range, actionlint and the workflow policy step all pass. The 17 release bundle binaries scan clean. Two etcdutl builds give 04c53c46…, and the main-branch script with go1.26.9 reproduces the previous pin 8cc788cf… on this host, so the digest does not depend on the build host. The etcdutl gate passes with the existing overrides.

CI on Linux amd64 covers the rest: the real offline snapshot restore with the rebuilt etcdutl, the reproducible bundle archive and its SBOM, the synthetic image build, PostgreSQL integration and the Windows suite. Moving to etcd 3.6.16, dropping the five overrides, and making the source-only check honour reviewed overrides are separate changes.

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no actionable issues were found.

Summary

Updates the build compiler to Go 1.26.10 across the module, CI, release scripts and build containers.

• CloudRING builds and checks now use Go 1.26.10.
• Recovery records now identify the Go 1.26.10 etcdutl binary.

_{Reviews (1) · Last reviewed commit: "fix(ci): build with Go 1.26.10 for the c..." · Reviewed by Greptile}