fix(ci): build with Go 1.26.9 and adjudicate etcdutl x/net advisories

.github/scripts/build-release-etcdutl.sh

@@ -17,7 +17,7 @@ version='3.6.14'
 source_commit='fc04cf702b0a46c2fd85547a2be05705b100a496'
 source_archive_sha256='c02ebbf6af5f9266f111009fb8d585649a9fcafe5788c200f5a28a7f00d438f0'
 source_url="https://codeload.github.com/etcd-io/etcd/tar.gz/${source_commit}"
-go_version='go1.26.8'
+go_version='go1.26.9'
 
 # Resolve an explicitly selected toolchain once, then disallow automatic
 # switching and caller-specific build settings in both independent builds.

.github/scripts/check-release-binaries.sh

@@ -48,7 +48,7 @@ EOF
 etcd_version='3.6.14'
 source_commit='fc04cf702b0a46c2fd85547a2be05705b100a496'
 source_archive_sha256='c02ebbf6af5f9266f111009fb8d585649a9fcafe5788c200f5a28a7f00d438f0'
-go_version='go1.26.8'
+go_version='go1.26.9'
 
 etcd_version_arg=''
 source_commit_arg=''
@@ -269,7 +269,27 @@ fi
 # conservatism produces this trace. REMOVE THIS ENTRY when the pinned etcd
 # release ships grpc >= 1.83.1 (see ANCHOR(etcd-pin)); do not extend this
 # list without a recorded adjudication in the PR that adds it.
-advisory_overrides="GO-2026-6348"
+#
+# GO-2026-6603, GO-2026-6611, GO-2026-6612, GO-2026-6617 (HTTP/2 Trailer
+# memory exhaustion, initial-window CPU, flow-control refund, HPACK encoder
+# race): the go1.26.9 release compiler fixes their standard-library part;
+# golang.org/x/net v0.55.0 from the pinned etcd module graph remains. Of the
+# 27 example traces source mode reports per advisory, 12 enter through the
+# init-time closure dispatch of GO-2026-6348 (crc32 table init ->
+# sync.OnceFunc -> grpc client transport) and 15 through error, fmt.Stringer
+# and io.Writer interface dispatch from cobra, cobrautl and pflag. Each
+# advisory needs an HTTP/2 peer; no etcdutl subcommand opens a listener or
+# dials, and the recovery worker runs only version, snapshot status, hashkv
+# and snapshot restore on local files. These IDs also cover net/http and
+# overrides match every binary in one run, so each scanned binary must be
+# built with go1.26.9 or go1.27.2 and later. REMOVE THESE ENTRIES when the
+# pinned etcd release ships golang.org/x/net >= v0.60.0 (see
+# ANCHOR(etcd-pin)).
+advisory_overrides="GO-2026-6348
+GO-2026-6603
+GO-2026-6611
+GO-2026-6612
+GO-2026-6617"
 
 gate_failed=0
 for id in ${binary_ids}; do

.github/workflow-policy.json

@@ -2,11 +2,11 @@
   "schemaVersion": 1,
   "canonicalization": "yq-json+jq-cS",
   "workflows": {
-    ".github/workflows/ci.yml": "be63f023563fde67eef849a61cfa2f108b981a7685b6d9280bf48243b9a2526b",
+    ".github/workflows/ci.yml": "ff516325ce372b532df551ad62bf2a39f4154f98996cc8ed498380c36da62d0f",
     ".github/workflows/cla-dco.yml": "5c3437cfa6ec997d97a3e9218a87114c1bb14f524e648d0df775f5bc6340430f",
-    ".github/workflows/license.yml": "813e0774ad869ca4898449c0ba087b005a3187b32455d0dc2f3a62d89b4e8b81",
-    ".github/workflows/release-provenance.yml": "36712b212df0f999a1a699a41498030d5d634161d35de2a3ed3db80ffb7bbee9",
-    ".github/workflows/security.yml": "0c77bba18ea6e3d1bd1cf3447549fc0bbb4aaa3a1f94a2763dd53a3f42390e9e",
-    ".github/workflows/supply-chain.yml": "2d90a0d90de0f9dffa40005ae9134105ac9198bbee58416d570ed16f96e58097"
+    ".github/workflows/license.yml": "16cc80a7ebac7a17ff76fc348bedc00df8bf7a9a563b2519160399d195927d76",
+    ".github/workflows/release-provenance.yml": "4a627ea963e0b7639c817439a74ed4dd1af32024709f6281bb5f22a31d38bf09",
+    ".github/workflows/security.yml": "941de9382d8ce617429489c89a1cb469bb937ffee6af94de130c50ded97cc93f",
+    ".github/workflows/supply-chain.yml": "bb9e4e00966ba230ad595af547e5bbbd692af04bb85f350081986065d8a465f4"
   }
 }

.github/workflows/ci.yml

@@ -32,7 +32,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Verify delivery roadmap
@@ -83,7 +83,7 @@ jobs:
           wait "${etcd_pid}" || true
           trap - EXIT
           chmod 0600 "${snapshot}"
-          GOTOOLCHAIN=go1.26.8 bash .github/scripts/build-release-etcdutl.sh \
+          GOTOOLCHAIN=go1.26.9 bash .github/scripts/build-release-etcdutl.sh \
             "${RUNNER_TEMP}/release-etcdutl"
           bash .github/scripts/check-release-binaries.sh "${RUNNER_TEMP}/release-etcdutl/etcdutl"
           CLOUDRING_TEST_ETCD_SNAPSHOT="${snapshot}" \
@@ -99,7 +99,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - run: go test -race ./... -count=1
@@ -108,7 +108,7 @@ jobs:
     runs-on: ubuntu-latest
     timeout-minutes: 15
     container:
-      image: golang:1.26.8-bookworm@sha256:9fdc884aacc3bec89b20ffc69f4bb369c78210e3e4f600387b5128b12c199f81
+      image: golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c
     services:
       postgres:
         image: postgres:18.6-bookworm@sha256:1c59e2c3c818eaa0f0628f695b36e7c9e362d6b219b36a54a32df645cbd7e1af
@@ -127,7 +127,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Test transactional state and public runtime against PostgreSQL
@@ -150,7 +150,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - run: go vet ./...
@@ -164,7 +164,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Verify generic platform manifests
@@ -183,7 +183,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Test minimum supported Go
@@ -198,7 +198,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Verify module graph and build
@@ -211,7 +211,7 @@ jobs:
           go build -mod=readonly -trimpath ./...
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Reproduce, scan and execute the complete release bundle
@@ -231,7 +231,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Validate every shipped connector package
@@ -253,7 +253,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Check conformance for the same shipped connector packages
@@ -307,7 +307,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Scan complete checkout

.github/workflows/license.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - shell: bash

.github/workflows/release-provenance.yml

@@ -33,7 +33,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Independently reproduce release bundle and CycloneDX SBOM
@@ -95,7 +95,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
@@ -203,7 +203,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - uses: docker/setup-buildx-action@8d2750c68a42422c14e847fe6c8ac0403b4cbd6f # v3.12.0
@@ -247,7 +247,7 @@ jobs:
           test "$(dist/etcd-recovery-worker/etcdutl version)" = $'etcdutl version: 3.6.14\nAPI version: 3.6'
           tool_digest="$(sha256sum dist/etcd-recovery-worker/etcdutl | cut -d ' ' -f 1)"
           worker_digest="$(sha256sum dist/etcd-recovery-worker/cloudring-etcd-recovery-worker | cut -d ' ' -f 1)"
-          test "${tool_digest}" = '2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d'
+          test "${tool_digest}" = '8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1'
           bash .github/scripts/check-release-binaries.sh dist/etcd-recovery-worker/*
           jq -n -cS \
             --arg source_commit "${GITHUB_SHA}" \
@@ -282,7 +282,7 @@ jobs:
                 purl: "pkg:github/etcd-io/etcd@v3.6.14",
                 properties: [
                   {name: "cloudring.upstream.source-commit", value: "fc04cf702b0a46c2fd85547a2be05705b100a496"},
-                  {name: "cloudring.upstream.build-compiler", value: "go1.26.8"}
+                  {name: "cloudring.upstream.build-compiler", value: "go1.26.9"}
                 ],
                 hashes: [{alg: "SHA-256", content: $tool_digest}]
               },
@@ -483,7 +483,7 @@ jobs:
             (.imageSubjectDigest | test("^sha256:[0-9a-f]{64}$")) and
             (.workerExecutableSha256 | test("^[0-9a-f]{64}$")) and
             .etcdutlVersion == "3.6.14" and
-            .etcdutlSha256 == "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d" and
+            .etcdutlSha256 == "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1" and
             .baseImageName == "gcr.io/distroless/static-debian12:nonroot" and
             .baseImageDigest == "sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35" and
             (.containerfileSha256 | test("^[0-9a-f]{64}$")) and

.github/workflows/security.yml

@@ -29,7 +29,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4.37.1
@@ -48,7 +48,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - run: go run golang.org/x/vuln/cmd/govulncheck@v1.6.0 ./...
@@ -62,7 +62,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - run: go run github.com/securego/gosec/v2/cmd/gosec@v2.27.1 -quiet -fmt=golint -tests -nosec-require-justification -nosec-require-rules ./...
@@ -77,7 +77,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Scan current tree and pushed history

.github/workflows/supply-chain.yml

@@ -26,7 +26,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7.0.0
         with:
-          go-version: 1.26.8
+          go-version: 1.26.9
           check-latest: false
           cache: true
       - name: Validate workflow syntax

README.md

@@ -223,7 +223,7 @@ operations, documentation, and developer experience.
 
 ## Validate a fresh clone
 
-Prerequisites: Git and Go 1.26.8 or a newer supported security patch. The development installer and CI use Go 1.26.8.
+Prerequisites: Git and Go 1.26.9 or a newer supported security patch. The development installer and CI use Go 1.26.9.
 
 ```bash
 git clone https://github.com/opencloudtech/CloudRING.git

contracts/etcd-recovery/README.md

@@ -32,9 +32,9 @@ object key/version and credentials never appear in tool arguments, environment,
 stdout, stderr or receipts.
 
 `etcdutl` 3.6.14 is content-pinned to
-`2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d`
+`8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1`
 before execution. This executable is rebuilt from the unchanged official source
-with Go 1.26.8 and retained symbols using the [release build procedure](../../docs/releasing.md);
+with Go 1.26.9 and retained symbols using the [release build procedure](../../docs/releasing.md);
 its source and build identity are retained as `etcdutl-source.json`.
 Source `hashkv` runs only against a verified disposable
 private copy, because upstream `hashkv` can mutate bbolt metadata. The restored

contracts/etcd-recovery/image-identity.schema.json

@@ -32,7 +32,7 @@
     "imageSubjectDigest": {"$ref": "#/$defs/imageDigest"},
     "workerExecutableSha256": {"$ref": "#/$defs/sha"},
     "etcdutlVersion": {"const": "3.6.14"},
-    "etcdutlSha256": {"const": "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d"},
+    "etcdutlSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"},
     "baseImageName": {"const": "gcr.io/distroless/static-debian12:nonroot"},
     "baseImageDigest": {"const": "sha256:f5b485ea962d9bd1186b2f6b3a061191539b905b82ec395de78cbfae51f20e35"},
     "containerfileSha256": {"$ref": "#/$defs/sha"},

contracts/etcd-recovery/receipt.schema.json

@@ -30,7 +30,7 @@
       "properties": {
         "name": {"const": "etcdutl"},
         "version": {"const": "3.6.14"},
-        "executableSha256": {"const": "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d"}
+        "executableSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"}
       }
     },
     "sourceStatusSha256": {"$ref": "#/$defs/sha"},

contracts/etcd-recovery/request.schema.json

@@ -27,7 +27,7 @@
     "workerExecutableSha256": {"$ref": "#/$defs/sha"},
     "workerImageDigest": {"type": "string", "pattern": "^sha256:[0-9a-f]{64}$"},
     "etcdutlVersion": {"const": "3.6.14"},
-    "etcdutlSha256": {"const": "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d"},
+    "etcdutlSha256": {"const": "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"},
     "issuedAt": {"type": "string", "format": "date-time"},
     "expiresAt": {"type": "string", "format": "date-time"},
     "timeoutSeconds": {"type": "integer", "minimum": 1, "maximum": 1800}

docs/ci-checks.md

@@ -102,7 +102,7 @@ the bundle checksum, and creates GitHub artifact attestations.
 The recovery image job independently reproduces the worker binary and two OCI image
 layouts, checks their Linux AMD64 subject manifest digests are identical, and
 requires the separately pushed registry subject to match that reviewed digest.
-The official `etcdutl` 3.6.14 source is rebuilt twice with Go 1.26.8 and
+The official `etcdutl` 3.6.14 source is rebuilt twice with Go 1.26.9 and
 independent caches. The source archive, rebuilt binary, BuildKit, Dockerfile frontend,
 Buildx and Syft inputs are immutable-version or content pinned. The job
 publishes only `sha-<commit>`, creates a real Syft image-package SBOM plus a

docs/development-installation.md

@@ -57,7 +57,7 @@ substitute `latest` images or an unverified BOM.
 
 Linux users can use the verified `cloudring-linux-amd64` asset as `cloudring`.
 Linux and macOS users can also build the client from the clean public release
-checkout with Go 1.26.8 or a newer supported security release:
+checkout with Go 1.26.9 or a newer supported security release:
 
 ```sh
 go build -o ./cloudring ./cmd/cloudring

docs/releasing.md

@@ -23,7 +23,7 @@ the exact Go toolchain pinned in the workflow, Linux/amd64 target, GNU tar and
 Python 3 (standard-library UUID generation only);
 using a different compiler is a different build input.
 
-The release compiler is Go 1.26.8, a supported patch release. The required
+The release compiler is Go 1.26.9, a supported patch release. The required
 pull-request build check also reproduces the complete bundle with this exact
 compiler. Before artifacts are uploaded or attested, pinned `govulncheck`
 examines every compiled command, including the recovery worker and its upstream

go.mod

@@ -1,6 +1,6 @@
 module github.com/opencloudtech/CloudRING
 
-go 1.26.8
+go 1.26.9
 
 require (
 	github.com/jackc/pgx/v5 v5.11.0

pkg/backup/etcdrecovery/types.go

@@ -17,7 +17,7 @@ const (
 	SandboxStateSchemaVersion    = "cloudring.etcd-recovery.sandbox-state/v1"
 	ToolName                     = "etcdutl"
 	ToolVersion                  = "3.6.14"
-	ToolSHA256                   = "2b7fea46e31fda1989168fbd8f7ec73f5839155f4b1af7bab274950e337e996d"
+	ToolSHA256                   = "8cc788cf08a2ad326ab54add1a161000fd0d563a0f28d6a6d842877c0d2148c1"
 
 	DefaultRequestPath     = "/run/cloudring/request/request.json"
 	DefaultArchivePath     = "/run/cloudring/archive/snapshot.db"

reference/synthetic-service/Containerfile

@@ -1,4 +1,4 @@
-FROM golang:1.26.8-bookworm@sha256:9fdc884aacc3bec89b20ffc69f4bb369c78210e3e4f600387b5128b12c199f81 AS build
+FROM golang:1.26.9-bookworm@sha256:d9c68c2c51161e12fd77e4c6320687c9cd86e1af1e3ad6e6cd63ff970641453c AS build
 
 WORKDIR /src
 COPY go.mod ./