From 7b4ceef1965a93e9bc85bb42305d1149389a98b4 Mon Sep 17 00:00:00 2001 From: Claude Date: Tue, 20 Oct 2026 21:06:27 +0000 Subject: [PATCH] fix(golang): require Go 1.26.10 so crypto/x509 blocks the eMudhra intermediates Go 1.26.10 and 1.27.3 are the first releases whose crypto/x509 rejects chains through the eight compromised eMudhra intermediate CAs (CVE-2026-111943, golang/go#82345). A program built with an older toolchain would accept a chain through them, which would let the key holder impersonate ZeroKMS or the auth endpoints to the Go SDK. - languages/golang/go.mod: `go 1.26.0` -> `go 1.26.10`. The `go` line is the one directive a dependency's go.mod imposes on its consumers: `go get` raises the consumer's own `go` line to it, and GOTOOLCHAIN=auto then fetches a fixed toolchain. A `toolchain` directive is honoured only in the main module, so it would protect this repo's builds and nobody importing the SDK. - mise.toml: pin go to "1.26.10" rather than the floating "1.26", so CI (tests-golang.yml and release-golang.yml both resolve Go from this pin) and local builds cannot pick an older patch from a cache. - The encrypt and stashgen READMEs, encrypt/doc.go and AGENTS.md state the new minimum, and note that 1.27.0 to 1.27.2 are also vulnerable, which a minimum version cannot express. Closes #1300 Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_014Givi9JCPVy1s8ZL8oPo6D --- AGENTS.md | 4 +++- languages/golang/cmd/stashgen/README.md | 6 +++++- languages/golang/encrypt/README.md | 6 +++++- languages/golang/encrypt/doc.go | 4 +++- languages/golang/go.mod | 2 +- mise.toml | 7 +++++-- 6 files changed, 22 insertions(+), 7 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index d828dd683..758f89c3c 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -699,7 +699,9 @@ exact pin would stop the suite sharing one `cts-common` with it. with its own `Cargo.lock`. - **The toolchain is pinned in the root `mise.toml`:** Rust 1.94.1 (the `stack-encrypt` `tests/ui` trybuild snapshots record its diagnostics) and - Go 1.26. EQL's `mise.toml` overrides the Rust pin in its folder. + Go 1.26.10, the module's `go` minimum (#1300: the first 1.26 patch whose + `crypto/x509` blocks the compromised eMudhra intermediates). EQL's + `mise.toml` overrides the Rust pin in its folder. protect-ffi's does not pin Rust, so the root pin applies there. - **The cargo tools are pinned in `mise.test.toml`, not `mise.toml`:** nextest, llvm-cov, crap, mutants, fuzz and udeps. EQL and protect-ffi diff --git a/languages/golang/cmd/stashgen/README.md b/languages/golang/cmd/stashgen/README.md index d3f38554e..1c73fa72b 100644 --- a/languages/golang/cmd/stashgen/README.md +++ b/languages/golang/cmd/stashgen/README.md @@ -8,7 +8,11 @@ Your program calls those functions, and it never builds or names a plan. ## Use the SDK 1. Add the generator to your module. - This needs Go 1.26 or later. + This needs Go 1.26.10 or later (or 1.27.3 or later on 1.27): + those are the first releases whose `crypto/x509` blocks the compromised eMudhra intermediate CAs + ([CVE-2026-111943](https://github.com/golang/go/issues/82345)). + The module's `go` line requires 1.26.10, so under the default `GOTOOLCHAIN=auto` an older local Go downloads and switches to 1.26.10. + A minimum cannot exclude 1.27.0 to 1.27.2, which are also vulnerable: do not build with those. ```sh go get -tool github.com/cipherstash/stack/languages/golang/cmd/stashgen diff --git a/languages/golang/encrypt/README.md b/languages/golang/encrypt/README.md index 6f8f51904..50d54390b 100644 --- a/languages/golang/encrypt/README.md +++ b/languages/golang/encrypt/README.md @@ -14,7 +14,11 @@ The package reference is on [pkg.go.dev]; the generator's reference is ## Use the SDK -1. Add the generator to your module. This needs Go 1.26 or later. +1. Add the generator to your module. This needs Go 1.26.10 or later (or 1.27.3 or later on 1.27): + those are the first releases whose `crypto/x509` blocks the compromised eMudhra intermediate CAs + ([CVE-2026-111943](https://github.com/golang/go/issues/82345)). + The module's `go` line requires 1.26.10, so under the default `GOTOOLCHAIN=auto` an older local Go downloads and switches to 1.26.10. + A minimum cannot exclude 1.27.0 to 1.27.2, which are also vulnerable: do not build with those. ```sh go get -tool github.com/cipherstash/stack/languages/golang/cmd/stashgen diff --git a/languages/golang/encrypt/doc.go b/languages/golang/encrypt/doc.go index 7b114f0e3..f161e8a96 100644 --- a/languages/golang/encrypt/doc.go +++ b/languages/golang/encrypt/doc.go @@ -4,7 +4,9 @@ // // # Use the SDK // -// 1. Add the generator to your module (Go 1.26 or later): +// 1. Add the generator to your module (Go 1.26.10 or later, or 1.27.3 or later +// on 1.27: the first releases whose crypto/x509 blocks the compromised eMudhra +// intermediate CAs, CVE-2026-111943): // // go get -tool github.com/cipherstash/stack/languages/golang/cmd/stashgen // diff --git a/languages/golang/go.mod b/languages/golang/go.mod index 0b886ca9b..e47125bab 100644 --- a/languages/golang/go.mod +++ b/languages/golang/go.mod @@ -1,6 +1,6 @@ module github.com/cipherstash/stack/languages/golang -go 1.26.0 +go 1.26.10 require ( github.com/cipherstash/vitaminc/bindings/go/vcffi v0.0.0-20260902024806-f2c7f7d17fbc diff --git a/mise.toml b/mise.toml index 99c81a215..b89136a98 100644 --- a/mise.toml +++ b/mise.toml @@ -28,8 +28,11 @@ rust = { version = "1.94.1", components = "rustc,cargo,rustfmt,rust-std,clippy,r # The cargo tools (nextest, llvm-cov, crap, mutants, fuzz, udeps) live in # mise.test.toml, pinned, and load only with `--env test` / MISE_ENV=test. # The Go module (languages/golang) — the wazero host of the WASI guests. -# CGO_ENABLED=0 throughout; see `go:test`. -go = "1.26" +# CGO_ENABLED=0 throughout; see `go:test`. Pinned to the patch, not the minor: +# 1.26.10 is the first 1.26 release whose crypto/x509 blocks the compromised +# eMudhra intermediates (CVE-2026-111943, #1300), and a floating "1.26" could +# resolve an older patch from a cache. Keep it at or above go.mod's `go` line. +go = "1.26.10" golangci-lint = "2.14.0" # wasm-pack for the auth binding's `build:wasm`, which builds # languages/typescript/packages/stack-auth-wasm into the auth package's wasm/.