Repository navigation
fix(security): require patched Go toolchain for eMudhra incident - #28
Merged
Merged
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Scope
Require Go 1.26.10 for the eMudhra incident in
go.mod. Based on freshly clonedmainat332a063127d9afc0e20d0377384f73329db8fe8c; no dependency version, source, archive, or release-artifact changes. Existing toolchain directives were absent.Existing CI/build selectors follow go.mod or the selected Go compiler; no old literal active compiler selector found. Historical plans and source examples are unchanged.
Verification
Bounded commands with an allowlisted environment, scratch HOME, no ambient credentials/Go configuration, and task-local patched public CA bundle (empty system cert directory); no TLS bypass. Default verification uses Go 1.27.3.
go version: exit 0.go mod tidy -diff: exit 0.go test -mod=readonly -count=1 -timeout=90s ./...: exit 0.go vet -mod=readonly ./...: exit 0.go version(exact Go 1.26.10): exit 0.go test -mod=readonly -run=^$ -timeout=60s ./...(exact Go 1.26.10): exit 0.git diff --checkpassed; complete diff directly reviewed as security-only. Independent review/parent gates and live required CI/review policy remain pending. No release, deployment, running-binary replacement, or deployed runtime proof is claimed. Previously distributed artifacts still require reviewed patched-compiler rebuild/release. Do not merge until parent review gates. No merge, policy/Actions changes, admin bypass, or force push.