[mbyczkowski]

Why

v1.18.1 was built with Go 1.27.1, and master still pins that version for releases. govulncheck finds 9 standard library vulnerabilities that certigo code reaches with Go 1.27.1, and none with 1.27.3.

The most important one is GO-2026-6809 (CVE-2026-111943, golang/go#82345). Go 1.27.3 adds a crypto/x509 denylist of compromised intermediate certificates from one CA. certigo verify and connect call x509.Certificate.Verify (lib/verify.go:148). Built with Go 1.27.1, certigo can report a chain through one of those intermediates as valid. Most of the others are net/http and HTTP/2 fixes in 1.27.2.

Each workflow also chose its Go version differently. Releases and the compile check pinned an exact version in two places that had to be kept in sync. Tests and lint used the newest stable Go, so a new Go release could break CI on its own, as Go 1.27.2 did to lint (#387).

What

Build and test everything with Go 1.27.3, from one .go-version file, for v1.18.2.

How

• Add .go-version with 1.27.3. Every workflow reads it with go-version-file: release, compile check, unit, integration and JCEKS tests, and lint.
• Set GOTOOLCHAIN=local in every workflow, so Go never downloads a different toolchain than the one .go-version names.
• Run checkout before setup-go where it ran after, because setup-go needs the file.
• Leave go.mod at go 1.26.0. Raising it to 1.27 would change the main module's GODEBUG defaults. In particular, x509sslcertoverrideplatform would make certigo load roots from SSL_CERT_FILE/SSL_CERT_DIR on macOS and Windows instead of the platform store.

To update Go, change .go-version. If lint then fails to type-check, bump golangci-lint in the same PR.

Risk

Tests and lint no longer pick up new Go releases automatically. A Go update is now a deliberate one-line PR. Compile check job names drop the version, for example Compile Check (darwin, macos-latest, amd64). They aren't required checks.

Testing

• With Go 1.27.3, go vet and the unit tests pass, and the linux/amd64, darwin/arm64 and windows/amd64 builds succeed.
• govulncheck reports 0 vulnerabilities in a Go 1.27.3 linux/amd64 build.
• Every workflow except release runs on this PR.

🤖 Generated with Claude Code