Repository navigation
fix(build): build with Go 1.27.3 to distrust compromised eMudhra CAs - #621
Merged
Merged
Conversation
Go 1.27.3 hard-codes distrust of the eight compromised eMudhra (emSign) intermediate CAs (CVE-2026-111943) in crypto/x509, on the Go verifier and on the macOS and Windows platform-verifier paths. Release builds resolved to go1.27.1 (setup-go installed 1.25, then GOTOOLCHAIN=auto switched to the go.mod minimum), which accepts chains through those CAs, so an on-path attacker could impersonate the CRE API, login, Vault gateway or RPC endpoints the CLI dials. - go.mod: go 1.27.1 -> 1.27.3 - release and preview workflows: setup-go reads the version from go.mod - .tool-versions: golang 1.27.3 Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
golangci-lint v2.13.1 cannot read Go 1.27.3 export data ("export data
version 5 is greater than maximum supported version 4"), so ci-lint
failed on typecheck. v2.15.0 lints Go 1.27.3 cleanly (same pairing as
smartcontractkit/chainlink-common#2481).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
v2.15.0 lint rejects both forms of discarding the goroutine's error:
errcheck flags a bare <-errCh and staticcheck S1005 flags _ = <-errCh.
The error is already delivered to the model via p.Send, so the channel
only needs to signal that the goroutine has exited; use a closed
chan struct{} for that.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
leeyikjiun
approved these changes
Oct 21, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
go.mod:go 1.27.1→go 1.27.3build-and-release.yml,preview-build.yml: the sixsetup-gosteps usego-version-file: go.modinstead ofgo-version: "1.25".tool-versions:golang 1.26.2→golang 1.27.3Why
Eight eMudhra (emSign) intermediate CA keys were compromised (CVE-2026-111943).
Go 1.27.3 and 1.26.10 add a hard-coded SPKI blocklist for the eight CAs in
crypto/x509. The check runs in the Go verifier and on the macOS and Windows platform-verifier paths, and it also catches the Comodo AAA cross-signed chains.Today's release builds don't get it. CI installs Go 1.25, and
GOTOOLCHAIN=autothen switches to the go.mod minimum, go1.27.1, which has no fix. With this change, go.mod sets the version CI installs.Evidence
Same program, built with each toolchain, verifying the researcher's proof hosts (
dv-g3b-emudhra.we-have-a-problem.com,dv-g3b-aaa-emudhra.we-have-a-problem.com). The chain's own top cert is the only trusted root, so the OS trust store plays no part:x509: no valid chains built)Intermediate
EM DV TLS CA - G3Bhas SPKI sha256ebed6475…5105, the first entry in go1.27.3'sdistrustedSPKIHashes.Testing
go mod tidywith go1.27.3: no changes beyond thegodirectivego build→go version crereportsgo1.27.3test/not run)🤖 Generated with Claude Code