Repository navigation
fix: build with Go 1.26.10 for the eMudhra CA distrust - #37
Merged
Merged
Conversation
monit-reviewer
approved these changes
Oct 21, 2026
monit-reviewer
left a comment
monit-reviewer
left a comment
There was a problem hiding this comment.
Automated PR Review
Reviewed commit: 9895acab6a66
Profile: claude-monit-reviewer - Posting as: monit-reviewer
Summary
| Reviewer | Findings |
|---|---|
| automation:ci-release | 0 |
| go:implementation-tests | 0 |
| policies:conventions | 0 |
| structure:repo-health | 0 |
Reviewer Coverage
automation:ci-release— complete (broad); skipped: none; constraints: Only go.mod was assigned; workflow files were checked only via grep for go-version-file usage.go:implementation-tests— complete (broad); skipped: none; constraints: Change is a two-line toolchain directive in go.mod; no Go code or tests changed. Did not run a build with GOTOOLCHAIN=go1.26.10.policies:conventions— complete (broad); skipped: none; constraints: Shared cli-common docs were not available in context; review limited to the repo checkout and diff.structure:repo-health— complete (broad); skipped: none; constraints: Only go.mod was assigned; workflow files were checked only by grep to confirm they read go-version-file from go.mod. The repo has a single module and no go.work.
Inspected files (1)
go.mod
0 PR discussion threads considered. 0 summarized; 0 resolved.
Completed in 3m 24s | ~$0.91 (est.) | claude-sonnet-5-5 | cr 0.10.325
| Field | Value |
|---|---|
| Model | claude-sonnet-5-5 |
| Reviewers | automation:ci-release, go:implementation-tests, policies:conventions, structure:repo-health |
| Engine | claude_cli · claude-sonnet-5-5 |
| Reviewed by | cr · monit-reviewer |
| Duration | 3m 24s wall · 7m 17s compute |
| Cost | ~$0.91 (est.) |
| Pricing basis | baseline-2026-10-02/pricing |
| Tokens | 44 in / 5.2k out |
Per-workstream usage
orchestrator-selection— claude-sonnet-5-5- In: 4
- Out: 665
- Cache read: 9.2k
- Cache create: 35.5k
- Cost: ~$0.15 (est.)
- Duration: 15s
automation:ci-release— claude-sonnet-5-5- In: 8
- Out: 954
- Cache read: 93.1k
- Cache create: 19.9k
- Cost: ~$0.11 (est.)
- Duration: 1m 38s
go:implementation-tests— claude-sonnet-5-5- In: 8
- Out: 864
- Cache read: 93.6k
- Cache create: 20.0k
- Cost: ~$0.11 (est.)
- Duration: 1m 13s
policies:conventions— claude-sonnet-5-5- In: 10
- Out: 1.2k
- Cache read: 103.7k
- Cache create: 31.9k
- Cost: ~$0.16 (est.)
- Duration: 1m 31s
structure:repo-health— claude-sonnet-5-5- In: 8
- Out: 1.1k
- Cache read: 73.5k
- Cache create: 32.2k
- Cost: ~$0.16 (est.)
- Duration: 1m 32s
orchestrator-rollup— claude-sonnet-5-5- In: 6
- Out: 439
- Cache read: 95.9k
- Cache create: 51.1k
- Cost: ~$0.23 (est.)
- Duration: 1m 06s
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Add
toolchain go1.26.10to every Go module so CI and release builds use Go 1.26.10. Go 1.26.10 and 1.27.3 add acrypto/x509distrust of the compromised eMudhra intermediate keys (CVE-2026-111943), which applies whatever root store the binary verifies against. Binaries built with earlier releases still accept certificates issued through those keys on Linux, where verification uses the system roots.actions/setup-gouses thetoolchaindirective in preference to thegodirective, so builds, tests and releases all pick it up. Thegolanguage version is unchanged.Verification
GOTOOLCHAIN=go1.26.10 go build ./...passes for every module.