build(deps): bump golang.org/x/crypto to 0.56.0, golangci-lint to v2.13.2 and the toolchain to Go 1.27 - #16
Merged
Merged
Conversation
golang.org/x/crypto v0.56.0 declares `go 1.26.0`, so the module bump and the toolchain floor are one change: taking the dependency without moving the floor leaves a tree no supported toolchain can build. v0.56.0 hardens golang.org/x/crypto/ssh — it drops traffic on undecided channels, rejects unexpected message types on established ones, stops skipping the source-address critical option in CertChecker.CheckCert, and bounds the pre-version banner lines readVersion will ignore. koc uses the package only to parse OpenSSH private keys for "koc server password show", so none of those paths are reachable from here; the bump is hygiene, not a fix for an exposure. Raising the floor moves every setup-go pin with it. All the offline jobs run GOTOOLCHAIN=local, so a 1.25.x runner fails before the first build step rather than downloading a toolchain — that is what the Dependabot PR hit on all eleven checks. The pins stay an explicit `1.26.x` + check-latest rather than go-version-file: go.mod, for the reason already recorded next to them: go.mod names a full patch, and resolving it exactly would ship the original .0 standard library. Go 1.26 also deprecates rsa.EncryptPKCS1v15, which staticcheck's SA1019 then flags in the server password test. PKCS#1 v1.5 is the padding nova's get-password API stores and the one gophercloud's ExtractPassword undoes, so the fixture has to keep speaking it; the call carries a nolint naming the linter and the reason. The binary grows ~400 KiB, all of it the 1.26 standard library: master built with go1.26.8 is 16,502,946 bytes against this branch's 16,478,370, so x/crypto v0.56.0 is itself slightly smaller than v0.55.0. Verified offline (-mod=vendor, GOPROXY=off): gofmt, go vet, golangci-lint v2.12.2 (the CI pin, built with go1.26.2) 0 issues, go test ./..., go test -race ./..., the static build, and all six crossbuild targets. govulncheck could not run here — vuln.go.dev is blocked from this sandbox — so supply-chain.yml is the first place it is exercised. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VpBdgJiWyoiYBGN4ndbTLk
The three changes here are one change. golangci-lint's whole v2.13 line is built with go1.27.0, and it enforces the gofmt it was built against. Go 1.27 reindented a multi-value `return` whose operands are composite literals, so v2.13.2 rejects three files the previous pin accepted — and the two gofmts disagree in both directions: 1.26's reformats what 1.27's wrote, and back. Taking the newer linter therefore means formatting the tree with 1.27's gofmt, and running the CI toolchain on 1.27 so `make fmt` agrees with the lint job instead of fighting it every commit. So: the checksum-verified pin moves 2.12.2 -> 2.13.2, the setup-go pins move 1.26.x -> 1.27.x in all three workflows, and gofmt 1.27 reformats auth/provider_test.go, baremetal/allocation.go and network/qos.go. Those three diffs are whitespace only. go.mod's floor deliberately stays at `go 1.26.0`. Nothing in the code needs 1.27 — building and testing on 1.26 still works, verified — and the floor is what decides whether a contributor's GOTOOLCHAIN=local build stays offline, so it keeps tracking the dependency graph (x/crypto v0.56.0) rather than the toolchain CI happens to run. The pin sitting a minor above the floor is now load-bearing, so the reason is recorded next to it in ci.yml, in AGENTS.md under "Build / test / lint", and above the Makefile's fmt target: formatting under an older toolchain silently reverts the tree. The binary grows ~304 KiB, all of it the 1.27 standard library: 16,789,664 bytes against 16,478,370 on 1.26.8, same tree. Verified offline (-mod=vendor, GOPROXY=off) on go1.27.1: gofmt, go vet, golangci-lint v2.13.2 (checksum-verified against the release's published checksums.txt) 0 issues, go test ./..., go test -race ./..., the static build and all six crossbuild targets. Also re-checked on go1.26.8 that the floor still holds: go build ./... and go test ./... pass, and its gofmt reverts exactly the three files above — the footgun the notes describe. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01VpBdgJiWyoiYBGN4ndbTLk
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #15, which could not merge: Dependabot raised
go.mod's floor togo 1.26.0(x/crypto v0.56.0 declares it) but cannot touch thesetup-gopins, so all eleven checks died ongo: go.mod requires go >= 1.26.0 (running go 1.25.14; GOTOOLCHAIN=local).build(deps): x/crypto 0.55.0 → 0.56.0, Go floor → 1.26go.mod/go.sum/vendor/re-derived withmake tidy; byte-identical to Dependabot's tree. The vendored delta is fourx/crypto/sshhardening fixes (drop traffic on undecided channels, reject unexpected message types on established ones, stop skippingsource-addressinCertChecker.CheckCert, bound the pre-version banner lines). koc imports the package only to parse OpenSSH private keys forkoc server password show, so none of those paths are reachable from here — hygiene, not a fix for an exposure.Every
setup-gopin moves with the floor. Go 1.26 also deprecatesrsa.EncryptPKCS1v15, which staticcheck then flags in the server password test; PKCS#1 v1.5 is nova's wire format and what gophercloud'sExtractPasswordundoes, so the fixture keeps it under a//nolintnaming the linter and the reason.ci: golangci-lint 2.12.2 → 2.13.2, CI toolchain → Go 1.27Three changes that are really one. The whole v2.13 line is built with go1.27.0 and enforces the gofmt it was built against; Go 1.27 reindented a multi-value
returnwhose operands are composite literals, so v2.13.2 rejects three files v2.12.2 accepted. The two gofmts disagree in both directions — 1.26's reformats what 1.27's wrote, and back — so the newer linter drags the tree's formatting and the CI toolchain along with it, ormake fmtand the lint job fight over the same files every commit.go.mod's floor deliberately stays atgo 1.26.0: nothing in the code needs 1.27 (go buildandgo teston go1.26.8 verified), and the floor is what decides whether a contributor'sGOTOOLCHAIN=localbuild stays offline. The pin now sitting a minor above the floor is load-bearing, so the reason is recorded inci.yml, in AGENTS.md, and above the Makefile'sfmttarget.The three reformatted files are whitespace only.
Verification
Offline (
-mod=vendor,GOPROXY=off) on go1.27.1: gofmt,go vet, golangci-lint v2.13.2 0 issues,go test ./...,go test -race ./..., the static build, all six crossbuild targets. CI is green on both commits, includinggovulncheckandvendor-integrity.Binary size, same tree: 16,478,370 bytes on go1.26.8 → 16,789,664 on go1.27.1. All of it stdlib — x/crypto 0.56.0 is itself slightly smaller than 0.55.0.
No
docs/coverage.mdchange: the command surface is untouched.🤖 Generated with Claude Code
https://claude.ai/code/session_01VpBdgJiWyoiYBGN4ndbTLk
Generated by Claude Code