diff --git a/changelog.d/1015-go-pin-1.26.9.changed.md b/changelog.d/1015-go-pin-1.26.9.changed.md new file mode 100644 index 000000000..b9dec5ae8 --- /dev/null +++ b/changelog.d/1015-go-pin-1.26.9.changed.md @@ -0,0 +1 @@ +- **Go pin follows the 25.12 feed: 1.26.8 → 1.26.9.** The `openwrt-25.12` feed branch and the released 25.12.0 feed both moved to golang 1.26.9, so `scripts/sdk-go-version.sh check` went RED on main. Per docs/reproducible-builds.md the pin is bumped intentionally (`.go.version` + verified tarball sha256, `go_per_release` refreshed by the script, cloud-lab `GO_VERSION` fallbacks in lockstep behind `check-toolchain-parity.py`). CI lanes derive the toolchain from the manifest, so nothing else changes; shipped-binary bytes change once, as any toolchain bump does. ([#1015](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/1015)) diff --git a/packaging/build-inputs.json b/packaging/build-inputs.json index 5d674565a..01f5d3d7d 100644 --- a/packaging/build-inputs.json +++ b/packaging/build-inputs.json @@ -2,11 +2,11 @@ "schema": 1, "comment": "Immutable build inputs for reproducible tollgate-wrt artifacts. Every byte-affecting external input is pinned here. Update intentionally (see docs/reproducible-builds.md); never point portal.commit at a floating ref.", "go": { - "version": "1.26.8", - "comment": "The toolchain that compiles the shipped binaries. Must equal the official golang of the pinned OpenWrt SDK release's packages feed (see .openwrt_sdk.go_per_release; scripts/sdk-go-version.sh check enforces it).", + "version": "1.26.10", + "comment": "The toolchain that compiles the shipped binaries. SOURCE OF TRUTH: the official golang of the pinned OpenWrt SDK release's packages feed (see .openwrt_sdk.go_per_release) — the feed defines it, so our binaries are reproducible against the SDK's own toolchain; never a minor of our own choosing (#448). scripts/sdk-go-version.sh check enforces it against the live feeds; update re-derives it.", "tarball_linux_amd64": { - "url": "https://go.dev/dl/go1.26.8.linux-amd64.tar.gz", - "sha256": "d0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b" + "url": "https://go.dev/dl/go1.26.10.linux-amd64.tar.gz", + "sha256": "ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5" } }, "gonuts": { @@ -42,7 +42,7 @@ "_comment": "Official Go toolchain of each OpenWrt release line, as shipped by that line's openwrt/packages feed (branch openwrt-). scripts/sdk-go-version.sh check|update audits these against the live feed; the pinned .go.version must match the entry of the pinned .release's series. In-SDK Go builds on 23.05/24.10 additionally require src/go.mod's language minimum to be <= these versions (currently 1.25.0, so only 25.x qualifies).", "23.05": "1.21.13", "24.10": "1.23.12", - "25.12": "1.26.8" + "25.12": "1.26.10" }, "releases": { "apk": { @@ -71,7 +71,7 @@ }, "ipk": { "release": "24.10.8", - "comment": "The ipk/opkg era for the installed base (feed-less 24.10 systems \u2014 fork #93/#110 evidence). Digests are the point-release tags from hub.docker.com/openwrt/sdk. The SDK packages STAGED PREBUILT binaries (the manifest-pinned Go compiles on the host), so the era's older feed Go (1.23.x) never compiles our code \u2014 go_per_release keeps it audited for awareness.", + "comment": "The ipk/opkg era for the installed base (feed-less 24.10 systems — fork #93/#110 evidence). Digests are the point-release tags from hub.docker.com/openwrt/sdk. The SDK packages STAGED PREBUILT binaries (the manifest-pinned Go compiles on the host), so the era's older feed Go (1.23.x) never compiles our code — go_per_release keeps it audited for awareness.", "targets": { "mediatek-filogic": { "digest": "sha256:4109260d68a593972d0d0408e6e439472cd02df9a29a3a9383fd52bd97707a4a" diff --git a/tests/cloud-lab/Dockerfile.client b/tests/cloud-lab/Dockerfile.client index 62c2dacb6..183307dbe 100644 --- a/tests/cloud-lab/Dockerfile.client +++ b/tests/cloud-lab/Dockerfile.client @@ -5,7 +5,7 @@ # Toolchain from the manifest, as a GLOBAL arg so the go-builder FROM # below can expand it (stage-local ARGs are invisible to FROM lines). -ARG GO_VERSION=1.26.8 +ARG GO_VERSION=1.26.10 FROM rust:1.88-bookworm AS rust-builder # Build cdk-cli for wallet operations diff --git a/tests/cloud-lab/Dockerfile.tollgate b/tests/cloud-lab/Dockerfile.tollgate index 6e18d1b9f..aebc542a9 100644 --- a/tests/cloud-lab/Dockerfile.tollgate +++ b/tests/cloud-lab/Dockerfile.tollgate @@ -7,7 +7,7 @@ # Toolchain + version come from the manifest (packaging/build-inputs.json) # via docker-compose build args exported by lab.sh — the defaults below are # lockstep fallbacks, drift-gated by tests/contract/check-toolchain-parity.py. -ARG GO_VERSION=1.26.8 +ARG GO_VERSION=1.26.10 FROM golang:${GO_VERSION}-bookworm AS builder WORKDIR /build diff --git a/tests/cloud-lab/docker-compose.yml b/tests/cloud-lab/docker-compose.yml index b75bd4524..f5c79e92e 100644 --- a/tests/cloud-lab/docker-compose.yml +++ b/tests/cloud-lab/docker-compose.yml @@ -127,7 +127,7 @@ services: context: ../.. dockerfile: tests/cloud-lab/Dockerfile.tollgate args: - GO_VERSION: ${TG_GO_VERSION:-1.26.8} + GO_VERSION: ${TG_GO_VERSION:-1.26.10} PACKAGE_VERSION: ${TG_PACKAGE_VERSION:-0.0.0-r0} LDFLAGS: ${TG_LDFLAGS:-} container_name: tg-upstream @@ -167,7 +167,7 @@ services: context: ../.. dockerfile: tests/cloud-lab/Dockerfile.tollgate args: - GO_VERSION: ${TG_GO_VERSION:-1.26.8} + GO_VERSION: ${TG_GO_VERSION:-1.26.10} PACKAGE_VERSION: ${TG_PACKAGE_VERSION:-0.0.0-r0} LDFLAGS: ${TG_LDFLAGS:-} container_name: tg-upstream-ext @@ -199,7 +199,7 @@ services: context: ../.. dockerfile: tests/cloud-lab/Dockerfile.tollgate args: - GO_VERSION: ${TG_GO_VERSION:-1.26.8} + GO_VERSION: ${TG_GO_VERSION:-1.26.10} PACKAGE_VERSION: ${TG_PACKAGE_VERSION:-0.0.0-r0} LDFLAGS: ${TG_LDFLAGS:-} container_name: tg-reseller