fix: update opm build toolchain and fulcio

[russell-parks]

Summary

• update the module Go version from 1.26.3 to 1.26.5 so GitHub Actions and GoReleaser build opm with a patched Go stdlib
• pin upstream-builder.Dockerfile to golang:1.26.5-alpine for the direct upstream builder path
• bump github.com/sigstore/fulcio from v1.8.5 to v1.8.6 and keep the minimal go mod tidy result required by that bump

Trivy evidence

Before, quay.io/operator-framework/opm:master at sha256:a9f84574354fb46686fd0958b0ab5f6f49d6b2736c5c99f10e05d6d92cca10ea failed Trivy 0.70.0 with HIGH findings in usr/bin/opm:

• github.com/sigstore/fulcio CVE-2026-49478, fixed in v1.8.6
• Go stdlib CVE-2026-27145, fixed in Go 1.26.4 / 1.25.11
• Go stdlib CVE-2026-39822, fixed in Go 1.26.5 / 1.25.12 / 1.27.0-rc.2
• Go stdlib CVE-2026-42504, fixed in Go 1.26.4 / 1.25.11

After, I built a local linux/arm64 release-shaped image using Go 1.26.5, distroless static, /bin/opm, /bin/grpc_health_probe, nsswitch.conf, user 1001, and the opm entrypoint. The image ID was sha256:7a7598e588808493efb14e9b9398939e6d836509983b9cca4cfcc1197dc10a37.

Trivy command run locally, adapted only for the OrbStack Docker socket path:

docker run --rm -v /Users/russell/.orbstack/run/docker.sock:/var/run/docker.sock aquasec/trivy:0.70.0 image --ignore-unfixed --severity CRITICAL,HIGH --exit-code 1 opm-trivy-test:go1.26.5-fulcio1.8.6

Result:

Report Summary

Target                                                Type      Vulnerabilities
opm-trivy-test:go1.26.5-fulcio1.8.6 (debian 13.6)  debian    0
usr/bin/grpc_health_probe                             gobinary  0
usr/bin/opm                                           gobinary  0

Verification

• GOCACHE=/tmp/opreg-go-build-cache GOMODCACHE=/tmp/opreg-go-mod-cache GOTOOLCHAIN=auto go mod tidy
• GOCACHE=/tmp/opreg-go-build-cache GOMODCACHE=/tmp/opreg-go-mod-cache GOTOOLCHAIN=auto go mod verify
• GOCACHE=/tmp/opreg-go-build-cache GOMODCACHE=/tmp/opreg-go-mod-cache GOTOOLCHAIN=auto make bin/opm
• GOMODCACHE=/tmp/opreg-go-mod-cache GOTOOLCHAIN=auto go version -m bin/opm
  • reported go1.26.5
  • included github.com/sigstore/fulcio v1.8.6
• GOCACHE=/tmp/opreg-go-build-cache GOMODCACHE=/tmp/opreg-go-mod-cache GOTOOLCHAIN=auto make unit
  • first sandboxed run failed only because localhost binds were denied
  • rerun with local socket permissions passed
• docker buildx build --platform linux/arm64 -f /private/tmp/opm-release-trivy.Dockerfile -t opm-trivy-test:go1.26.5-fulcio1.8.6 --load .
• Trivy command above

No vulnerability suppressions, ignores, or scan weakening were added.

[openshift-ci]

Hi @russell-parks. Thanks for your PR.

I'm waiting for a operator-framework member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work.

Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Copilot]

Pull request overview

This pull request updates the Operator Registry’s build toolchain and Go module dependencies to pick up security fixes (patched Go stdlib and a Fulcio CVE fix), aligning the Docker-based upstream builder path and the module’s Go version used by CI/GoReleaser.

Changes:

• Bumped the module Go version to Go 1.26.5 (CI uses go-version-file: go.mod, so this propagates to GitHub Actions).
• Pinned upstream-builder.Dockerfile to golang:1.26.5-alpine for the upstream builder path.
• Updated github.com/sigstore/fulcio to v1.8.6 and incorporated the minimal go mod tidy-driven dependency checksum updates.

Reviewed changes

Copilot reviewed 2 out of 3 changed files in this pull request and generated no comments.

File	Description
upstream-builder.Dockerfile	Pins the upstream builder image to Go 1.26.5 to ensure patched stdlib in that build path.
go.mod	Updates the module Go version and bumps Fulcio (plus associated indirect deps) to pick up security fixes.
go.sum	Updates dependency checksums consistent with the go.mod bumps / tidy result.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 58.81%. Comparing base (6a6d882) to head (62c07bd).
⚠️ Report is 16 commits behind head on master.

Additional details and impacted files

@@           Coverage Diff           @@
##           master    #2034   +/-   ##
=======================================
  Coverage   58.81%   58.81%           
=======================================
  Files         141      141           
  Lines       13434    13434           
=======================================
  Hits         7901     7901           
  Misses       4323     4323           
  Partials     1210     1210           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[russell-parks]

The only failing check is go-verdiff, and it is failing because this PR intentionally updates the root go.mod Go version from 1.26.3 to 1.26.5:

Found golang version: 1.26.5
./go.mod: 1.26.5: Updated ROOT golang version from 1.26.3
No go-verdiff-override label found, failing the job.

The rest of CI is passing. Could a maintainer please add the go-verdiff-override label for this intentional security/toolchain bump?

[tmshort]

/hold
We can't move beyond golang 1.26.3

[russell-parks]

Thanks for the context. Is the blocker specifically that the OLM/operator-framework release train is currently constrained to the OpenShift 4.23 / ART-supported Go 1.26.3 builder?

If so, would you prefer that I retarget this PR to only address the Fulcio/dependency findings while leaving the root go.mod at 1.26.3, and defer the Go patch-level bump until the coordinated builder/toolchain update lands across the related repos?

[grokspawn]

Hey @russell-parks. Yes, that's our challenge exactly. But we now have 1.26.5 capability so I think we're safe to proceed.

/hold cancel
/label go-verdiff-override
/ok-to-test

[openshift-ci]

@grokspawn: The label(s) /label go-verdiff-override cannot be applied. These labels are supported: acknowledge-critical-fixes-only, platform/aws, platform/azure, platform/baremetal, platform/google, platform/libvirt, platform/openstack, ga, tide/merge-method-merge, tide/merge-method-rebase, tide/merge-method-squash, px-approved, docs-approved, qe-approved, ux-approved, no-qe, rebase/manual, cluster-config-api-changed, run-integration-tests, verified, ready-for-human-review, approved, backport-risk-assessed, bugzilla/valid-bug, cherry-pick-approved, jira/skip-dependent-bug-check, jira/valid-bug, ok-to-test, stability-fix-approved, staff-eng-approved. Is this label configured under labels -> additional_labels or labels -> restricted_labels in plugin.yaml?

Details

In response to this:

Hey @russell-parks. Yes, that's our challenge exactly. But we now have 1.26.5 capability so I think we're safe to proceed.

/hold cancel
/label go-verdiff-override
/ok-to-test

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[tmshort]

/approve
Rebase needed!

[openshift-ci]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: tmshort

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• OWNERS [tmshort]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[grokspawn]

/lgtm
pending passing CI after rebase.

[openshift-ci]

New changes are detected. LGTM label has been removed.

[russell-parks]

/test all

[openshift-ci]

@russell-parks: No presubmit jobs available for operator-framework/operator-registry@master

Details

In response to this:

/test all

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated no new comments.

Suppressed comments (1)

go.mod:3

• PR description says Fulcio is bumped to v1.8.6, but go.mod currently resolves github.com/sigstore/fulcio to v1.8.7 (indirect). Please reconcile this (either update the PR description/Trivy evidence to match the actual dependency version, or pin/tidy back to v1.8.6 if that is the intended target).

go 1.26.5