From fc002c727d86aa23b357c9bd59cbfee9de2e2b31 Mon Sep 17 00:00:00 2001 From: Manuel de Brito Fontes Date: Wed, 21 Oct 2026 17:05:40 -0300 Subject: [PATCH] build: Go 1.27.3, which distrusts the compromised intermediates Eight of eMudhra's intermediate CA keys were weak enough to recover (CVE-2026-111943). Go 1.27.3 refuses a chain through any of them, by key. Pinned as the toolchain: with `go 1.27` alone a build here resolved to 1.27.0, the series' first. Co-Authored-By: Claude Fable 5.1 --- go.mod | 2 ++ 1 file changed, 2 insertions(+) diff --git a/go.mod b/go.mod index 5108cad..d5c6181 100644 --- a/go.mod +++ b/go.mod @@ -2,6 +2,8 @@ module github.com/spin-stack/spin-machine go 1.27 +toolchain go1.27.3 + tool ( github.com/spin-stack/go-tools/cmd/attestgate github.com/spin-stack/go-tools/cmd/ctxlife