fix(build): build with Go 1.27.3 to distrust compromised eMudhra CAs

.changeset/go-1-27-3-emudhra.md

@@ -0,0 +1,5 @@
+---
+"cre-cli": patch
+---
+
+Build the CLI with Go 1.27.3, which distrusts the eight compromised eMudhra (emSign) intermediate CAs (CVE-2026-111943). Earlier builds accept TLS certificates issued from those keys, so an attacker on the network path could impersonate the CRE API, login, Vault gateway or RPC endpoints the CLI connects to. Release builds now take the Go version from `go.mod`.

.github/workflows/build-and-release.yml

@@ -24,7 +24,7 @@
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/setup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Setup GitHub Token
         id: setup-github-token
@@ -37,7 +37,7 @@
           set-git-config: true
 
       - name: Install Dependencies
         run: |
           sudo apt-get update
           if [ "${{ matrix.arch }}" == "arm64" ]; then
             sudo apt-get install -y gcc-aarch64-linux-gnu g++-aarch64-linux-gnu libc6-dev-arm64-cross $(if [ "${{ matrix.os }}" = "ubuntu24.04" ]; then echo "libstdc++-13-dev-arm64-cross"; fi) libstdc++-12-dev-arm64-cross
@@ -149,7 +149,7 @@
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/setup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Setup GitHub Token
         id: setup-github-token
@@ -250,7 +250,7 @@
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/stup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Setup GitHub Token
         id: setup-github-token

.github/workflows/preview-build.yml

@@ -21,7 +21,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/setup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Install Dependencies
         run: |
@@ -72,7 +72,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # actions/setup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Build the Go Binary
         env:
@@ -107,7 +107,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@3041bf56c941b39c61721a86cd11f3bb1338122a # stup-go@v5.2.0
         with:
-          go-version: "1.25"
+          go-version-file: go.mod
 
       - name: Install Dependencies
         shell: pwsh

.github/workflows/pull-request-main.yml

@@ -15,7 +15,7 @@
 
 jobs:
   ci-lint:
     runs-on: ubuntu-latest-4cores-16GB
     permissions:
       id-token: write
       contents: read
@@ -25,7 +25,7 @@
         uses: smartcontractkit/.github/actions/ci-lint-go@31f7a923a25f7672641b5099cbb85ce4a984fc05 # ci-lint-go@3.1.0
         with:
           only-new-issues: false
-          golangci-lint-version: v2.13.1
+          golangci-lint-version: v2.15.0
           aws-region: ${{ secrets.AWS_REGION }}
           use-gati: "true"
           aws-role-arn-gati: ${{ secrets.AWS_OIDC_DEV_PLATFORM_READ_REPOS_EXTERNAL_TOKEN_ISSUER_ROLE_ARN }}
@@ -124,7 +124,7 @@
           artifact-name: go-test-${{ matrix.os }}
 
   ci-test-system:
     runs-on: ubuntu-latest-4cores-16GB
     if: false # Disable system test untill we have a version of the test that works with the new CRE CLI (Smartcon)
     environment: system-test
     permissions:

.tool-versions

@@ -1,5 +1,5 @@
-golang 1.26.2
-golangci-lint 2.11.2
+golang 1.27.3
+golangci-lint 2.15.0
 goreleaser 2.0.1
 python 3.10.5
 nodejs 20.13.1

go.mod

@@ -1,6 +1,6 @@
 module github.com/smartcontractkit/cre-cli
 
-go 1.27.1
+go 1.27.3
 
 require (
 	github.com/BurntSushi/toml v1.6.0

internal/ui/progress.go

@@ -112,32 +112,33 @@ func DownloadWithProgress(resp io.ReadCloser, contentLength int64, destFile *os.
 		},
 	}
 
-	// Start download in goroutine
-	errCh := make(chan error, 1)
+	// Start download in goroutine. The result is reported to the model via
+	// p.Send; copyDone only signals that the goroutine has exited.
+	copyDone := make(chan struct{})
 	go func() {
+		defer close(copyDone)
 		_, err := io.Copy(pw, resp)
 		if err != nil {
 			p.Send(progressErrMsg{err: err})
 		} else {
 			p.Send(progressDoneMsg{})
 		}
-		errCh <- err
 	}()
 
 	// Run the UI — blocks until done, error, or Ctrl+C
 	finalModel, err := p.Run()
 	if err != nil {
 		// Bubble Tea itself failed. Close the response body to unblock the
-		// download goroutine, then drain the channel so it can exit.
+		// download goroutine, then wait for it to exit.
 		resp.Close()
-		<-errCh
+		<-copyDone
 		return err
 	}
 
 	// Close the response body so the download goroutine's io.Copy finishes.
 	// For a completed download this is a no-op; for Ctrl+C it unblocks io.Copy.
 	resp.Close()
-	<-errCh
+	<-copyDone
 
 	// If the user pressed Ctrl+C, the model is not done — treat as cancellation
 	if fm, ok := finalModel.(downloadModel); ok && !fm.done {