Repository navigation
build: prepare legacy Go 1.27.3 security release - #525
Merged
Merged
Conversation
Go 1.27.3 carries the fix for CVE-2026-111943, which distrusts a set of intermediate certificates in crypto/x509. Release binaries are statically linked, so they only pick up the new trust decision when rebuilt with a patched toolchain. pool was pinned to Go 1.23.6, four release lines behind the first patched release, so there was no patch release to move to within its line. Raise the language version in every tracked go.mod to 1.27.3 and move CI and every Docker image to match. The poolrpc image was further behind still, at 1.22.3.
The pinned golangci-lint v1.64.5 cannot decode Go 1.27 export data, so it failed to typecheck the standard library and reported every downstream symbol as undefined. v2.15.0 is the first release that handles Go 1.27, and it is the version lnd already runs on that toolchain. The jump spans a major version, so the configuration is migrated to the v2 schema with golangci-lint's own migrate command. Preserve the existing linter decisions across the v2 renames: wsl and exhaustruct were deliberately disabled and their wsl_v5 and exhaustruct_v5 successors are disabled too, while gomodguard was active and is kept active as gomodguard_v2. Restore run.timeout, which the migration dropped, and drop govet.check-shadowing, a key removed back in v1.57 that is already the default. Defer funcorder, modernize and noinlineerr. They are new in v2 with no prior decision here, and follow the existing policy of holding new linters until the code is adjusted. A test discarded the error from HandleServerShutdown, which the newer errcheck reports. Bind it and record why it is not asserted.
The tools image hardcodes the install path, which still pointed at the v1 module after the v2.15.0 bump, so the image build failed before the linter could run.
In this commit, we retain the checks previously run by gosimple. The v2 linter groups those checks under staticcheck. Selecting only S preserves that coverage without enabling the other categories.
In this commit, we regenerate the existing protobuf Go stubs with Go 1.27.3. Only comment formatting changes; the proto sources and generated logic remain unchanged.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
In this PR, we prepare the legacy v0.7 line for a Go 1.27.3 security
release, starting from the released v0.7.1-beta source. The original
Go-only commits from #523 and the container Git trust fix are included;
the btcsuite-v2 migration on master isn't. Runtime module requirements,
replacements and Bitcoin package identities stay unchanged.
The linter migration retains the checks previously run by gosimple,
which v2 now groups under staticcheck. We also normalize generated RPC
comments for the new toolchain. No proto sources, generated message
logic or RPC schema fields change.
The existing
v0.7maintenance branch was behind v0.7.1-beta, so it isfast-forwarded to that already released source before this PR. The
feature diff therefore contains the Go/tooling update rather than
already released fixes or a revert of master.
Validation
On Go 1.27.3, root unit, race, build, coverage and one-minute fuzz checks
pass. Docker lint passes with zero issues in a full clone, including the
Git-based issue filter. Runtime module versions are unchanged. Remote CI,
including regeneration checks, remains required before merging.
A standalone
poolrpctest/tidy check still fails on a missing bakeryrequirement. The same failure is present at the released baseline; root
unit/build checks compile the RPC package with the root module graph.
We haven't added or upgraded dependencies to repair that separate module,
and this PR doesn't claim readiness to publish a new standalone RPC tag.
No tag or release is created here, and no deployment trigger is broadened.