chore(go): raise module floor to 1.26 + absorb modernize sweep (RIG-3107)

flake.nix

@@ -53,7 +53,7 @@
       # touched (guest-image/default.nix:82-87). vendorHash pins the fetched set —
       # the whole module graph, so it matches guestd's proxyVendor hash. Recompute
       # with lib.fakeHash on a go.mod/go.sum move.
-      vendorHash = "sha256-GHZsEfvnu1tY6Bd7Fxg7SEWEI+HS0NlQuBbm6pz/UK4=";
+      vendorHash = "sha256-DFH5FhUc1M/nrwqREHgjD5JqIazdoNMZla5bqkwZEhs=";
     in
     {
       packages = forAllSystems (

go/go.mod

@@ -12,19 +12,29 @@
 // (Global Constraint 1, floor policy).
 module github.com/RigelBuild/compass/go
 
-go 1.25.0
+go 1.26.0
 
 require (
 	connectrpc.com/connect v1.20.0
 	connectrpc.com/cors v0.1.0
 	connectrpc.com/otelconnect v0.9.0
 	github.com/BurntSushi/toml v1.6.0
 	github.com/cachix/secretspec/secretspec-go v0.15.0
+	github.com/google/uuid v1.6.0
 	github.com/hashicorp/golang-lru/v2 v2.0.7
 	github.com/insomniacslk/dhcp v0.0.0-20260728151720-c308df0fdcef
 	github.com/jackc/pgx/v5 v5.10.0
 	github.com/mdlayher/vsock v1.3.0
 	github.com/minio/minio-go/v7 v7.2.1
+	// The two nats-io modules below are pre-declared here for the RIG-3107 NATS
+	// fabric slice (go/internal/fabric, PR #877) that stacks on this PR. No code
+	// in THIS PR imports them yet, so `go mod tidy` before that slice lands will
+	// drop both (plus their indirects) AND invalidate the shared Go vendorHash in
+	// flake.nix and guest-image/default.nix — breaking every nix build. Do not
+	// tidy this module until #877 has landed; the two PRs are meant to merge as a
+	// stack.
+	github.com/nats-io/nats-server/v2 v2.14.6
+	github.com/nats-io/nats.go v1.53.1
 	github.com/rs/cors v1.11.1
 	github.com/spf13/cobra v1.10.2
 	github.com/spf13/pflag v1.0.10
@@ -47,6 +57,7 @@ require (
 
 require (
 	github.com/adrg/xdg v0.5.3 // indirect
+	github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op // indirect
 	github.com/cenkalti/backoff/v5 v5.0.3 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
 	github.com/coder/websocket v1.8.14 // indirect
@@ -59,23 +70,27 @@ require (
 	github.com/go-ole/go-ole v1.3.0 // indirect
 	github.com/go-viper/mapstructure/v2 v2.5.0 // indirect
 	github.com/godbus/dbus/v5 v5.2.2 // indirect
-	github.com/google/uuid v1.6.0 // indirect
+	github.com/google/go-tpm v0.9.8 // indirect
 	github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jackc/pgpassfile v1.0.0 // indirect
 	github.com/jackc/pgservicefile v0.0.0-20240606120523-5a60cdf6a761 // indirect
 	github.com/jackc/puddle/v2 v2.2.2 // indirect
 	github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1 // indirect
 	github.com/josharian/native v1.1.0 // indirect
-	github.com/klauspost/compress v1.18.6 // indirect
+	github.com/klauspost/compress v1.19.2 // indirect
 	github.com/klauspost/cpuid/v2 v2.3.0 // indirect
 	github.com/klauspost/crc32 v1.3.0 // indirect
 	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
 	github.com/mdlayher/packet v1.1.2 // indirect
 	github.com/mdlayher/socket v0.6.0 // indirect
 	github.com/minio/crc64nvme v1.1.1 // indirect
+	github.com/minio/highwayhash v1.0.4 // indirect
 	github.com/minio/md5-simd v1.1.2 // indirect
+	github.com/nats-io/jwt/v2 v2.8.2 // indirect
+	github.com/nats-io/nkeys v0.4.16 // indirect
+	github.com/nats-io/nuid v1.0.1 // indirect
 	github.com/pelletier/go-toml/v2 v2.3.1 // indirect
 	github.com/philhofer/fwd v1.2.0 // indirect
 	github.com/pierrec/lz4/v4 v4.1.14 // indirect
@@ -95,6 +110,7 @@ require (
 	golang.org/x/crypto v0.55.0 // indirect
 	golang.org/x/sys v0.47.0 // indirect
 	golang.org/x/text v0.41.0 // indirect
+	golang.org/x/time v0.15.0 // indirect
 	google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/genproto/googleapis/rpc v0.0.0-20260819154853-08b0e4226688 // indirect
 	google.golang.org/grpc v1.83.1 // indirect

go/go.sum

@@ -8,6 +8,8 @@ github.com/BurntSushi/toml v1.6.0 h1:dRaEfpa2VI55EwlIW72hMRHdWouJeRF7TPYhI+AUQjk
 github.com/BurntSushi/toml v1.6.0/go.mod h1:ukJfTF/6rtPPRCnwkur4qwRxa8vTRFBF0uk2lLoLwho=
 github.com/adrg/xdg v0.5.3 h1:xRnxJXne7+oWDatRhR1JLnvuccuIeCoBu2rtuLqQB78=
 github.com/adrg/xdg v0.5.3/go.mod h1:nlTsY+NNiCBGCK2tpm09vRqfVzrc2fLmXGpBLF0zlTQ=
+github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op h1:p2zFsAzvhIpFya8AIOHIbWf7NGvO34QpLGclyf7nXj8=
+github.com/antithesishq/antithesis-sdk-go v0.7.2-default-no-op/go.mod h1:FQyySiasQQM8735Ddel3MRojmy4dA1IqCeyJ5jmPMbI=
 github.com/cachix/secretspec/secretspec-go v0.15.0 h1:DMxh5/hkgZyMysSyFzf9RwUxoj+NfgmlnS6UKJ8n0k4=
 github.com/cachix/secretspec/secretspec-go v0.15.0/go.mod h1:4QjSax/Qd3JXEqNFUwvov93jnhVD1PmcDbeQBLg2r9Y=
 github.com/cenkalti/backoff/v5 v5.0.3 h1:ZN+IMa753KfX5hd8vVaMixjnqRZ3y8CuJKRKj1xcsSM=
@@ -46,6 +48,8 @@ github.com/golang/protobuf v1.5.4 h1:i7eJL8qZTpSEXOPTxNKhASYpMn+8e5Q6AdndVa1dWek
 github.com/golang/protobuf v1.5.4/go.mod h1:lnTiLA8Wa4RWRcIUkrtSVa5nRhsEGBg48fD6rSs7xps=
 github.com/google/go-cmp v0.7.0 h1:wk8382ETsv4JYUZwIsn6YpYiWiBsYLSJiTsyBybVuN8=
 github.com/google/go-cmp v0.7.0/go.mod h1:pXiqmnSA92OHEEa9HXL2W4E7lf9JzCmGVUdgjX3N/iU=
+github.com/google/go-tpm v0.9.8 h1:slArAR9Ft+1ybZu0lBwpSmpwhRXaa85hWtMinMyRAWo=
+github.com/google/go-tpm v0.9.8/go.mod h1:h9jEsEECg7gtLis0upRBQU+GhYVH6jMjrFxI8u6bVUY=
 github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
 github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.30.0 h1:/Tnpcb2E0Pz/tN9s3bfEY2Q8ePCEX9iuS+cneUwncnw=
@@ -71,8 +75,8 @@ github.com/jchv/go-winloader v0.0.0-20250406163304-c1995be93bd1/go.mod h1:alcuEE
 github.com/josharian/native v1.0.1-0.20221213033349-c1e37c09b531/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
 github.com/josharian/native v1.1.0 h1:uuaP0hAbW7Y4l0ZRQ6C9zfb7Mg1mbFKry/xzDAfmtLA=
 github.com/josharian/native v1.1.0/go.mod h1:7X/raswPFr05uY3HiLlYeyQntB6OO7E/d2Cu7qoaN2w=
-github.com/klauspost/compress v1.18.6 h1:2jupLlAwFm95+YDR+NwD2MEfFO9d4z4Prjl1XXDjuao=
-github.com/klauspost/compress v1.18.6/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
+github.com/klauspost/compress v1.19.2 h1:hMRETovs/pu/dVWN7zIT1PGG8t509MwT6bO7XSi26R8=
+github.com/klauspost/compress v1.19.2/go.mod h1:cwPg85FWrGar70rWktvGQj8/hthj3wpl0PGDogxkrSQ=
 github.com/klauspost/cpuid/v2 v2.0.1/go.mod h1:FInQzS24/EEf25PyTYn52gqo7WaD8xa0213Md/qVLRg=
 github.com/klauspost/cpuid/v2 v2.3.0 h1:S4CRMLnYUhGeDFDqkGriYKdfoFlDnMtqTiI/sFzhA9Y=
 github.com/klauspost/cpuid/v2 v2.3.0/go.mod h1:hqwkgyIinND0mEev00jJYCxPNVRVXFQeu1XKlok6oO0=
@@ -96,10 +100,22 @@ github.com/mdlayher/vsock v1.3.0 h1:bqQfZ1OznI03y6YiXp2sze05RVdzLn/zsfjnjd4+ivI=
 github.com/mdlayher/vsock v1.3.0/go.mod h1:WsuksavOvwCnV5UqGHUkvAvCy+Dqy81y4goKQTzxxNY=
 github.com/minio/crc64nvme v1.1.1 h1:8dwx/Pz49suywbO+auHCBpCtlW1OfpcLN7wYgVR6wAI=
 github.com/minio/crc64nvme v1.1.1/go.mod h1:eVfm2fAzLlxMdUGc0EEBGSMmPwmXD5XiNRpnu9J3bvg=
+github.com/minio/highwayhash v1.0.4 h1:asJizugGgchQod2ja9NJlGOWq4s7KsAWr5XUc9Clgl4=
+github.com/minio/highwayhash v1.0.4/go.mod h1:GGYsuwP/fPD6Y9hMiXuapVvlIUEhFhMTh0rxU3ik1LQ=
 github.com/minio/md5-simd v1.1.2 h1:Gdi1DZK69+ZVMoNHRXJyNcxrMA4dSxoYHZSQbirFg34=
 github.com/minio/md5-simd v1.1.2/go.mod h1:MzdKDxYpY2BT9XQFocsiZf/NKVtR7nkE4RoEpN+20RM=
 github.com/minio/minio-go/v7 v7.2.1 h1:PfBfwvKB/MmqyN8Vb1G9voWisaM9OrLv+WwOvMwS9Dw=
 github.com/minio/minio-go/v7 v7.2.1/go.mod h1:EU9hENAStx/xXduNdrGO5e4X5vk19NtgB+RIPjZO8o0=
+github.com/nats-io/jwt/v2 v2.8.2 h1:XXRgB60MSTnqsRwejQurVDs/hcv2dkt+86GjI+I/bMc=
+github.com/nats-io/jwt/v2 v2.8.2/go.mod h1:Ag/56sq9OblL4JgdYufDd16Egb17Kr/8WwwuO/forVc=
+github.com/nats-io/nats-server/v2 v2.14.6 h1:dHjEHa49lUTxIb5jrsk5kz/AmOyOQ4T9ti8djcBumDQ=
+github.com/nats-io/nats-server/v2 v2.14.6/go.mod h1:u/0bNBzN/m5orQGz7q2NNzxCQ6PWdwaOSwPNDADZn/A=
+github.com/nats-io/nats.go v1.53.1 h1:Otsq3uLc/kLdjmkNHkXH0jBqwUquwdKFoe3fq6/3/Xo=
+github.com/nats-io/nats.go v1.53.1/go.mod h1:26HypzazeOkyO3/mqd1zZd53STJN0EjCYF9Uy2ZOBno=
+github.com/nats-io/nkeys v0.4.16 h1:rd5oAuLOb8mnAycB0xleuEBNS1pVVnN0fv/FF34Eypg=
+github.com/nats-io/nkeys v0.4.16/go.mod h1:llLgWoI0o4z/Q57q2R1kHfmocyhGV6VG/U18Glg1Afs=
+github.com/nats-io/nuid v1.0.1 h1:5iA8DT8V7q8WK2EScv2padNa/rTESc1KdnPw4TC2paw=
+github.com/nats-io/nuid v1.0.1/go.mod h1:19wcPz3Ph3q0Jbyiqsd0kePYG7A95tJPxeL+1OSON2c=
 github.com/pelletier/go-toml/v2 v2.3.1 h1:MYEvvGnQjeNkRF1qUuGolNtNExTDwct51yp7olPtrEc=
 github.com/pelletier/go-toml/v2 v2.3.1/go.mod h1:2gIqNv+qfxSVS7cM2xJQKtLSTLUE9V8t9Stt+h56mCY=
 github.com/philhofer/fwd v1.2.0 h1:e6DnBTl7vGY+Gz322/ASL4Gyp1FspeMvx1RNDoToZuM=
@@ -199,10 +215,13 @@ golang.org/x/sys v0.1.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.2.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.6.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
 golang.org/x/sys v0.10.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
+golang.org/x/sys v0.21.0/go.mod h1:/VUhepiaJMQUp4+oa/7Zr1D23ma6VTLIYjOOTFZPUcA=
 golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
 golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
 golang.org/x/text v0.41.0 h1:vz/seA0lnX87Othu2f/0L24RcgrXD9/YFTSuGjj3rH8=
 golang.org/x/text v0.41.0/go.mod h1:jvf1O8ajNzZqhSrQBPbutR/EB83Cc0CFrezNQIwbb5M=
+golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
+golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
 gonum.org/v1/gonum v0.17.0 h1:VbpOemQlsSMrYmn7T2OUvQ4dqxQXU+ouZFQsZOx50z4=
 gonum.org/v1/gonum v0.17.0/go.mod h1:El3tOrEuMpv2UdMrbNlKEh9vd86bmQ6vqIcDwxEOc1E=
 google.golang.org/genproto/googleapis/api v0.0.0-20260819154853-08b0e4226688 h1:ax2KzoSRIZU/M0cIxri3pKxy99vniH1PVxWC6si/eZI=

go/internal/comms/comms_test.go

@@ -219,7 +219,7 @@ func TestSearchMessagesAuthorizationScoped(t *testing.T) {
 	if err != nil {
 		t.Fatalf("CreateChannel: %v", err)
 	}
-	if _, _, err := st.AppendMessage(ctx, store.Message{AuthorAccountID: alice.ID, Blocks: []store.MessageBlock{{Text: ptr("peregrine falcon")}}}, string(chA.ID), store.TopicRef{Name: "general", Create: true}, ""); err != nil {
+	if _, _, err := st.AppendMessage(ctx, store.Message{AuthorAccountID: alice.ID, Blocks: []store.MessageBlock{{Text: new("peregrine falcon")}}}, string(chA.ID), store.TopicRef{Name: "general", Create: true}, ""); err != nil {
 		t.Fatalf("AppendMessage: %v", err)
 	}
 
@@ -262,7 +262,7 @@ func TestListMessagesVisibilityScopedAtEdge(t *testing.T) {
 	if err != nil {
 		t.Fatalf("CreateChannel: %v", err)
 	}
-	if _, _, err := st.AppendMessage(ctx, store.Message{AuthorAccountID: alice.ID, Blocks: []store.MessageBlock{{Text: ptr("private plans")}}}, string(chA.ID), store.TopicRef{Name: "general", Create: true}, ""); err != nil {
+	if _, _, err := st.AppendMessage(ctx, store.Message{AuthorAccountID: alice.ID, Blocks: []store.MessageBlock{{Text: new("private plans")}}}, string(chA.ID), store.TopicRef{Name: "general", Create: true}, ""); err != nil {
 		t.Fatalf("AppendMessage: %v", err)
 	}
 
@@ -829,8 +829,6 @@ func pendingAskStore(id string) store.MessageBlock {
 	}}
 }
 
-func ptr(s string) *string { return &s }
-
 func containsString(ids []string, want string) bool {
 	for _, id := range ids {
 		if id == want {

go/internal/guestd/supervisor_test.go

@@ -85,13 +85,11 @@ func newTestSupervisor(t *testing.T, provisioned bool, defaultUID uint32) (compa
 	return client, svc
 }
 
-func uidPtr(u uint32) *uint32 { return &u }
-
 func TestExecRefusedBeforeProvision(t *testing.T) {
 	client, _ := newTestSupervisor(t, false, 0)
 	_, err := client.Exec(t.Context(), connect.NewRequest(&compassv1internal.ExecRequest{
 		Command: []string{"/bin/true"},
-		Uid:     uidPtr(1000),
+		Uid:     new(uint32(1000)),
 	}))
 	if err == nil {
 		t.Fatal("Exec before Provision returned nil, want failed-precondition")
@@ -306,7 +304,7 @@ func TestExecUIDZeroRefused(t *testing.T) {
 	client, _ := newTestSupervisor(t, true, 1000)
 	_, err := client.Exec(t.Context(), connect.NewRequest(&compassv1internal.ExecRequest{
 		Command: []string{"/bin/true"},
-		Uid:     uidPtr(0),
+		Uid:     new(uint32(0)),
 	}))
 	if err == nil || connect.CodeOf(err) != connect.CodeFailedPrecondition {
 		t.Fatalf("Exec uid 0 = %v, want FailedPrecondition", err)
@@ -338,7 +336,7 @@ func TestExecStdinReachesChildNotArgv(t *testing.T) {
 	secret := "s3cr3t-body"
 	resp, err := client.Exec(t.Context(), connect.NewRequest(&compassv1internal.ExecRequest{
 		Command: []string{"/bin/sh", "-c", "cat"},
-		Uid:     uidPtr(uint32(syscall.Getuid())),
+		Uid:     new(uint32(syscall.Getuid())),
 		Stdin:   []byte(secret),
 	}))
 	if err != nil {
@@ -353,7 +351,7 @@ func TestExecNonZeroExitIsSuccessfulResponse(t *testing.T) {
 	client, _ := newTestSupervisor(t, true, 1000)
 	resp, err := client.Exec(t.Context(), connect.NewRequest(&compassv1internal.ExecRequest{
 		Command: []string{"/bin/sh", "-c", "exit 7"},
-		Uid:     uidPtr(uint32(syscall.Getuid())),
+		Uid:     new(uint32(syscall.Getuid())),
 	}))
 	if err != nil {
 		t.Fatalf("Exec with non-zero exit returned handler error %v, want successful response", err)
@@ -370,7 +368,7 @@ func TestExecEnvMergedExecKeysWin(t *testing.T) {
 	svc.mu.Unlock()
 	resp, err := client.Exec(t.Context(), connect.NewRequest(&compassv1internal.ExecRequest{
 		Command: []string{"/bin/sh", "-c", "printf '%s,%s' \"$A\" \"$B\""},
-		Uid:     uidPtr(uint32(syscall.Getuid())),
+		Uid:     new(uint32(syscall.Getuid())),
 		Env:     map[string]string{"B": "exec"},
 	}))
 	if err != nil {
@@ -418,7 +416,7 @@ func TestExecOutputOverflowIsResourceExhausted(t *testing.T) {
 	svc.mu.Unlock()
 	_, err := client.Exec(t.Context(), connect.NewRequest(&compassv1internal.ExecRequest{
 		Command: []string{"/bin/sh", "-c", "printf 'x%.0s' $(seq 1 64)"},
-		Uid:     uidPtr(uint32(syscall.Getuid())),
+		Uid:     new(uint32(syscall.Getuid())),
 	}))
 	if err == nil {
 		t.Fatal("Exec with output past the cap returned success, want ResourceExhausted")
@@ -439,7 +437,7 @@ func TestExecTimeoutKillsAndReapsChild(t *testing.T) {
 	start := time.Now()
 	_, err := client.Exec(t.Context(), connect.NewRequest(&compassv1internal.ExecRequest{
 		Command:        []string{"/bin/sh", "-c", "sleep 300"},
-		Uid:            uidPtr(uint32(syscall.Getuid())),
+		Uid:            new(uint32(syscall.Getuid())),
 		TimeoutSeconds: 1,
 	}))
 	if err == nil {
@@ -468,7 +466,7 @@ func TestExecCanceledReapsChild(t *testing.T) {
 	go func() {
 		_, err := client.Exec(ctx, connect.NewRequest(&compassv1internal.ExecRequest{
 			Command: []string{"/bin/sh", "-c", "touch " + marker + "; sleep 300"},
-			Uid:     uidPtr(uint32(syscall.Getuid())),
+			Uid:     new(uint32(syscall.Getuid())),
 		}))
 		errCh <- err
 	}()
@@ -504,7 +502,7 @@ func TestExecStreamDemuxOrdering(t *testing.T) {
 		Frame: &compassv1internal.ExecStreamRequest_Start{
 			Start: &compassv1internal.StartExec{
 				Command: []string{"/bin/sh", "-c", "echo out; echo err 1>&2; exit 0"},
-				Uid:     uidPtr(uint32(syscall.Getuid())),
+				Uid:     new(uint32(syscall.Getuid())),
 			},
 		},
 	}); err != nil {
@@ -572,7 +570,7 @@ func TestSignalKillsLiveChildAndExitCarriesSignal(t *testing.T) {
 		Frame: &compassv1internal.ExecStreamRequest_Start{
 			Start: &compassv1internal.StartExec{
 				Command: []string{"/bin/sh", "-c", "sleep 300"},
-				Uid:     uidPtr(uint32(syscall.Getuid())),
+				Uid:     new(uint32(syscall.Getuid())),
 			},
 		},
 	}); err != nil {
@@ -628,7 +626,7 @@ func TestBrokenExecStreamReapsChild(t *testing.T) {
 		Frame: &compassv1internal.ExecStreamRequest_Start{
 			Start: &compassv1internal.StartExec{
 				Command: []string{"/bin/sh", "-c", "sleep 300"},
-				Uid:     uidPtr(uint32(syscall.Getuid())),
+				Uid:     new(uint32(syscall.Getuid())),
 			},
 		},
 	}); err != nil {

go/internal/ingest/notify_router_test.go

@@ -197,7 +197,7 @@ func TestRouteCarriesRevision(t *testing.T) {
 	if err := newRouter(t, st, d, &fakeChecksRoller{}).Route(context.Background(), ev); err != nil {
 		t.Fatalf("Route: %v", err)
 	}
-	want := SnapshotRevision(ptr(ApplyEvent(nil, ev)))
+	want := SnapshotRevision(new(ApplyEvent(nil, ev)))
 	if d.sent[0].GetRevision() != want {
 		t.Errorf("notification revision = %q, want %q", d.sent[0].GetRevision(), want)
 	}
@@ -632,8 +632,6 @@ func TestRouteZeroCoordinateRejected(t *testing.T) {
 
 // ---- helpers ----
 
-func ptr(s ArtifactSnapshot) *ArtifactSnapshot { return &s }
-
 func subIDs(ns []*compassv1internal.ForgeNotification) []string {
 	out := make([]string, len(ns))
 	for i, n := range ns {

go/internal/runtime/microvm_lifecycle_test.go

@@ -195,7 +195,7 @@ func TestExecCallMapping(t *testing.T) {
 	workdir := "/workspace"
 	spec := ExecSpec{
 		Command: []string{"sh", "-s"},
-		User:    strPtr("1000"),
+		User:    new("1000"),
 		Workdir: &workdir,
 		Env:     map[string]string{"K": "V"},
 		Stdin:   &stdin,
@@ -246,11 +246,11 @@ func TestParseUID(t *testing.T) {
 	if uid, err := parseUID(nil); err != nil || uid != nil {
 		t.Fatalf("parseUID(nil) = (%v, %v), want (nil, nil)", uid, err)
 	}
-	uid, err := parseUID(strPtr("1000"))
+	uid, err := parseUID(new("1000"))
 	if err != nil || uid == nil || *uid != 1000 {
 		t.Fatalf("parseUID(1000) = (%v, %v), want (*1000, nil)", uid, err)
 	}
-	if _, err := parseUID(strPtr("agent")); err == nil {
+	if _, err := parseUID(new("agent")); err == nil {
 		t.Fatal("parseUID(agent) err = nil, want a non-numeric-uid error")
 	}
 }
@@ -476,5 +476,3 @@ func TestCreateRejectsOverLongGatewaySocketPath(t *testing.T) {
 		})
 	}
 }
-
-func strPtr(s string) *string { return &s }

guest-image/default.nix

@@ -96,7 +96,7 @@ let
     };
     subPackages = [ "cmd/compass-guestd" ];
     proxyVendor = true;
-    vendorHash = "sha256-GHZsEfvnu1tY6Bd7Fxg7SEWEI+HS0NlQuBbm6pz/UK4=";
+    vendorHash = "sha256-DFH5FhUc1M/nrwqREHgjD5JqIazdoNMZla5bqkwZEhs=";
     env.CGO_ENABLED = 0;
     ldflags = [
       "-s"