Repository navigation
PLT-2271: remediate eMudhra CA compromise and bump Go, base images and actions - #49
Merged
timm088 merged 3 commits intoOct 22, 2026
Conversation
…d actions - Runtime image alpine:3.18.9 (EOL) -> 3.24.3 for ca-certificates 20261020-r0 - Builder golang:1.21-alpine -> 1.26.10-alpine3.24, CI Go 1.20.x -> 1.26.x - go.mod go 1.26, bump golang.org/x/*, blst v0.3.14 (Go 1.24 cgo fix) - Remove fjl/memsize (linkname breaks on Go 1.23+, as upstream v1.14.8) - Fix non-constant format strings flagged by Go 1.24 vet - Bump all actions to current releases, SHA pin attest-build-provenance - golangci-lint v1.51.1 -> v2.15.0 with migrated config
mw-w
previously approved these changes
Oct 22, 2026
mw-w
approved these changes
Oct 22, 2026
ermyas
approved these changes
Oct 22, 2026
1 of 5 tasks
timm088
deleted the
timcurtin/plt-2271-immutable-geth-remediate-emudhra-ca-compromise-and-bump-go
branch
October 22, 2026 02:31
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Resolves PLT-2271.
Why
Eight eMudhra intermediate CA keys are compromised (disclosure). On Linux, geth trusts whatever is in
/etc/ssl/certs, so the fix is the image'sca-certificatespackage. Our runtime image wasalpine:3.18.9, which went EOL in May 2025 and will never get the fixed package (20261020-r0only ships to 3.21+).What
Images
alpine:3.18.9->alpine:3.24.3.Dockerfile.alltoolspinned offlatest.golang:1.21-alpine->golang:1.26.10-alpine3.24(1.26.10 is also on the patched list).Go 1.20 -> 1.26
go.modtogo 1.26, CIsetup-goto1.26.x. Bumpedgolang.org/x/{crypto,net,sys,...}.fjl/memsize. Itslinknameinto the runtime fails to link on Go 1.23+. Upstream geth did the same in v1.14.8. This drops the/memsize/page on the pprof server (nothing else uses it).supranational/blstv0.3.11 -> v0.3.14 to fix the Go 1.24 cgo alias break.vet(whichgo testruns) flags non-constant format strings. Fixed the 8 hits (all trivial, mostly tests).Actions
attest-build-provenancewas floating on@v2, now pinned.golangci-lint migrate(gosimple/typecheckfold intostaticcheck,exportlooprefis obsolete on Go 1.22+). Dropped--out-format=github-actions, which v2 removed.Version
params/version.gobumped to1.0.0-beta.18. Tag the releasev1.0.0-beta.18after merge.Verification (local)
go build ./...andgo vet ./...clean on Go 1.26.core,consensus,crypto,trie,eth,p2p,accounts,node,rpc,miner,immutable,internal,cmd.TestUpdatedKeyfileContentsfailed once from timing, then passed 3/3 on rerun. It's the same onmain.golangci-lint run --new-from-rev=main: 0 issues.ca-certificates-20261020-r0installed.wget https://dv-g3b-emudhra.we-have-a-problem.com/fails cert verification, while a control site works.Rollout
Roll out to devnet, then testnet nodes before mainnet.