[trukhinyuri]

Advisories published with the Go security release of 2026-10-08 turn three required checks red on every change: govulncheck, go-build-module-integrity and go-test. Main last passed on 2026-10-07; #176, a docs-only change, fails the same three.

Compiler. Go 1.26.9 fixes the thirteen standard-library advisories behind the failures (GO-2026-6599, 6600, 6603, 6604, 6605, 6607, 6608, 6609, 6610, 6611, 6612, 6613 and 6617 in net/http, net/textproto, mime/multipart, crypto/tls, html/template and os). It is now pinned in go.mod, every setup-go step, the PostgreSQL test container and the synthetic reference image (golang:1.26.9-bookworm index d9c68c2c), the etcdutl build and adjudication scripts and the release component inventory, and the docs that name the release compiler follow. The rebuilt etcdutl 3.6.14 changes with the compiler, so its digest is re-pinned to 8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1 in the worker, the three etcd-recovery schemas, the contract README and release provenance. .github/workflow-policy.json carries the new workflow digests.

etcdutl x/net overrides. CloudRING requires neither golang.org/x/net nor google.golang.org/grpc; both come from the unchanged etcd 3.6.14 module graph of etcdutl. After the compiler update the etcdutl gate still fails on GO-2026-6603, GO-2026-6611, GO-2026-6612 and GO-2026-6617, whose remaining part is x/net v0.55.0. The fix is x/net v0.60.0 (2026-10-08), and no etcd release ships it yet: 3.6.15, 3.7.2 and both release branches carry v0.58.0, main v0.59.0. Rebuilding etcdutl with patched dependencies would break the rule in docs/releasing.md ("without source or dependency patches"), so this extends the reviewed overrides instead. That weakens a gate, so per QUALITY.md the adjudication is recorded here:

1. Attack model. GO-2026-6603, 6612 and 6617 need a malicious HTTP/2 client talking to an HTTP/2 server; 6611 needs a malicious HTTP/2 peer on either side.
2. Reachability. govulncheck -mode=source -scan symbol -show traces on the pinned etcdutl main package reports 27 example traces per advisory, one per vulnerable symbol. 12 start at snap.init (crc32.MakeTable -> sync.OnceFunc -> grpc pickfirst -> NewHTTP2Client), the closure conflation already adjudicated for GO-2026-6348. 7 reach Error methods through cobra Command.Execute, 6 reach String methods through cobrautl ExitWithError and fmt, and 2 reach Write methods through pflag AddFlag and fmt.
3. Surface. etcdutl 3.6.14 registers defrag, snapshot restore, snapshot status, hashkv, migrate, version and completion; none opens a listener or dials (snapshot.v3Manager.Save, the only dialing code in its packages, has no subcommand). The recovery worker runs only version, snapshot status, hashkv and snapshot restore on local files.
4. Scope and removal. Overrides match by advisory ID for every binary in one gate run, and these IDs also cover net/http, so every scanned binary must keep the fixed compiler; govulncheck on the CloudRING source stays a separate required check. The entries go when the pinned etcd release ships x/net >= v0.60.0. GO-2026-6443 stays informational as unreachable, GO-2026-6610 is not a binary-mode finding, and the gate still prints the full binary and source reports.

Validation with go1.26.9 on macOS: go test, race, vet, go mod tidy -diff, govulncheck (0 reachable), the Windows build, ocsctl validate and conformance, platform manifests, docscheck, source-safety for the tree and the commit range, go-licenses, gosec, gitleaks with its probes, DCO, CLA, actionlint, the SBOM step and the workflow policy step all pass. The 17 release bundle binaries scan clean. Two etcdutl builds give 8cc788cf…, and the same script with go1.26.8 reproduces the previous pin 2b7fea46… on this host, so the digest does not depend on the build host. The etcdutl gate passes with the overrides.

CI on Linux covers the rest: the real offline snapshot restore with the rebuilt etcdutl, the reproducible bundle archive, the synthetic image build, PostgreSQL integration and the Windows suite. Moving to the first etcd release with x/net >= v0.60.0, dropping these overrides and scoping overrides to the etcdutl binary are separate changes.

[Copilot]

🟢 Approval recommended

The pins and contracts are consistent, the advisory scope is documented, and all completed CI checks pass.

0 open findings

What changed in this PR

Updates CloudRING’s pinned Go toolchain to 1.26.9, restoring security and build checks while preserving reproducible recovery artifacts.

Changes:

• Updates Go pins across modules, CI, containers, and documentation.
• Re-pins the rebuilt etcdutl binary and related contracts.
• Adds reviewed overrides for unreachable x/net HTTP/2 advisories.

File	Description
go.mod	Raises the minimum Go version.
README.md	Updates development prerequisites.
reference/​synthetic-service/​Containerfile	Pins the Go 1.26.9 image.
pkg/​backup/​etcdrecovery/​types.go	Updates the trusted etcdutl digest.
docs/​releasing.md	Updates the release compiler.
docs/​development-installation.md	Updates build prerequisites.
docs/​ci-checks.md	Documents the new compiler pin.
contracts/​etcd-recovery/​README.md	Updates recovery-tool provenance.
contracts/​etcd-recovery/​request.schema.json	Updates the accepted tool digest.
contracts/​etcd-recovery/​receipt.schema.json	Updates the receipt digest constraint.
contracts/​etcd-recovery/​image-identity.schema.json	Updates image identity validation.
.github/​workflows/​ci.yml	Uses Go 1.26.9 throughout CI.
.github/​workflows/​security.yml	Updates security jobs’ toolchain.
.github/​workflows/​license.yml	Updates the license job’s toolchain.
.github/​workflows/​supply-chain.yml	Updates the policy job’s toolchain.
.github/​workflows/​release-provenance.yml	Updates compiler provenance and digest pins.
.github/​workflow-policy.json	Re-pins workflow semantic digests.
.github/​scripts/​build-release-etcdutl.sh	Rebuilds etcdutl with Go 1.26.9.
.github/​scripts/​check-release-binaries.sh	Adjudicates the remaining x/net findings.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.