Repository navigation
Hotfix/emudhra ca go toolchain - #49
Merged
Merged
Conversation
…ed eMudhra CAs Go 1.27.3 and 1.26.10 filter out any chain containing one of the eMudhra intermediates whose keys leaked (CVE-2026-111943, go.dev/issue/82345). The fix is in crypto/x509 in the toolchain, not in a dependency, so the only way to get it is to build with a patched Go — and an already-built binary keeps the old behaviour until it is rebuilt. The floor is 1.27.3 rather than 1.26.10 because a `go 1.26.10` directive is also satisfied by 1.27.0-1.27.2, which are unpatched; 1.27.3 is the lowest version from which every greater one carries the fix. That raises the minimum Go for downstream users of qpi-client/go, which is the intent for a trust fix in a client SDK.
certifi 2026.5.20 predates Mozilla's removal of emSign ECC Root CA - G3 on 2026-10-20, so the Python client and driver still carried it. 2026.10.23 ships 118 roots against the old 119: emSign ECC Root CA - C3, emSign ECC Root CA - G3 and emSign Root CA - C1 are gone, emSign Root CA - G1 stays. Go's crypto/x509 denylist does nothing here — these processes verify through certifi, not through the Go toolchain. uv rewrote both locks from format revision 3 to 5; setup-uv installs the latest uv in CI, so it reads either.
Tinitto
previously approved these changes
Oct 30, 2026
--prerelease allow was added to install-systemd.sh for the qblox extra, but uv applies it to every package in the resolution. pynng then published 1.0.0b1, whose manylinux wheel links libatomic.so.1, and a stock Ubuntu 22.04 does not ship libatomic1. Every install since produced a driver that died on `import pynng`, restarted five times and gave up — for all devices, not just qblox. if-necessary keeps the qblox extra resolving (checked with a dry-run of qpi-driver[cli,qblox]) and takes pynng back to the 0.9.0 release. Verified in jrei/systemd-ubuntu:22.04: pynng 0.9.0 installs, its .so has no libatomic dependency, and make test-e2e-systemd passes all four installers. Fixing the constraint in pyproject.toml instead would not have reached anyone, since the installer resolves qpi-driver from PyPI; the script is curled from the repo, so this helps operators before the next release.
Tinitto
force-pushed
the
hotfix/emudhra-ca-go-toolchain
branch
from
October 30, 2026 11:37
673f808 to
185eb82
Compare
Go 1.27 enables encoding/json/v2 by default — `go list encoding/json` picks v2_decode.go over scanner.go with GOEXPERIMENT empty. pocketbase 0.39.2 unmarshals a Collection through `type alias *Collection`, which carries no methods under v1 but re-enters UnmarshalJSON under v2, so the server overflowed its stack on the first collection it decoded and every dashboard request after that got ECONNREFUSED. The trigger is the toolchain, not the go directive, so this broke any build on an installed Go 1.27 — moving CI from 1.26.x to 1.27.x would have taken it red too. There is no fix on the 0.39 line: 0.39.11 still has the pointer alias, and 0.40.6 changed it to `type alias Collection`. The upgrade needs no source changes, but it carries modernc.org/sqlite 1.52 -> 1.60 and the rest of pocketbase's transitives with it. Verified: qpi-ui's five test packages pass, and the Cypress dashboard suite goes from 15/143 to 143/143 with no stack overflow in the server log. Note the suite seeds a fresh pb_data, so it does not cover migrating a database that already exists across the upgrade.
Tinitto
force-pushed
the
hotfix/emudhra-ca-go-toolchain
branch
from
October 30, 2026 12:06
de2c70f to
360cf30
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.