chore(build): go pin 1.26.8 -> 1.26.9 — the 25.12 feed moved

changelog.d/1015-go-pin-1.26.9.changed.md

@@ -0,0 +1 @@
+- **Go pin follows the 25.12 feed: 1.26.8 → 1.26.9.** The `openwrt-25.12` feed branch and the released 25.12.0 feed both moved to golang 1.26.9, so `scripts/sdk-go-version.sh check` went RED on main. Per docs/reproducible-builds.md the pin is bumped intentionally (`.go.version` + verified tarball sha256, `go_per_release` refreshed by the script, cloud-lab `GO_VERSION` fallbacks in lockstep behind `check-toolchain-parity.py`). CI lanes derive the toolchain from the manifest, so nothing else changes; shipped-binary bytes change once, as any toolchain bump does. ([#1015](https://github.com/OpenTollGate/tollgate-module-basic-go/pull/1015))

packaging/build-inputs.json

@@ -2,11 +2,11 @@
   "schema": 1,
   "comment": "Immutable build inputs for reproducible tollgate-wrt artifacts. Every byte-affecting external input is pinned here. Update intentionally (see docs/reproducible-builds.md); never point portal.commit at a floating ref.",
   "go": {
-    "version": "1.26.8",
-    "comment": "The toolchain that compiles the shipped binaries. Must equal the official golang of the pinned OpenWrt SDK release's packages feed (see .openwrt_sdk.go_per_release; scripts/sdk-go-version.sh check enforces it).",
+    "version": "1.26.10",
+    "comment": "The toolchain that compiles the shipped binaries. SOURCE OF TRUTH: the official golang of the pinned OpenWrt SDK release's packages feed (see .openwrt_sdk.go_per_release) — the feed defines it, so our binaries are reproducible against the SDK's own toolchain; never a minor of our own choosing (#448). scripts/sdk-go-version.sh check enforces it against the live feeds; update re-derives it.",
     "tarball_linux_amd64": {
-      "url": "https://go.dev/dl/go1.26.8.linux-amd64.tar.gz",
-      "sha256": "d0f743b33e8d8945e6b1f432edd15785c70507121d6e2a723b21285eddf8b57b"
+      "url": "https://go.dev/dl/go1.26.10.linux-amd64.tar.gz",
+      "sha256": "ccfe7ae822d2c2f41f4fe7c956199967a4dac22d0ee0d2b2bfdb440aab3b20c5"
     }
   },
   "gonuts": {
@@ -42,7 +42,7 @@
       "_comment": "Official Go toolchain of each OpenWrt release line, as shipped by that line's openwrt/packages feed (branch openwrt-<series>). scripts/sdk-go-version.sh check|update audits these against the live feed; the pinned .go.version must match the entry of the pinned .release's series. In-SDK Go builds on 23.05/24.10 additionally require src/go.mod's language minimum to be <= these versions (currently 1.25.0, so only 25.x qualifies).",
       "23.05": "1.21.13",
       "24.10": "1.23.12",
-      "25.12": "1.26.8"
+      "25.12": "1.26.10"
     },
     "releases": {
       "apk": {
@@ -71,7 +71,7 @@
       },
       "ipk": {
         "release": "24.10.8",
-        "comment": "The ipk/opkg era for the installed base (feed-less 24.10 systems \u2014 fork #93/#110 evidence). Digests are the point-release tags from hub.docker.com/openwrt/sdk. The SDK packages STAGED PREBUILT binaries (the manifest-pinned Go compiles on the host), so the era's older feed Go (1.23.x) never compiles our code \u2014 go_per_release keeps it audited for awareness.",
+        "comment": "The ipk/opkg era for the installed base (feed-less 24.10 systems — fork #93/#110 evidence). Digests are the point-release tags from hub.docker.com/openwrt/sdk. The SDK packages STAGED PREBUILT binaries (the manifest-pinned Go compiles on the host), so the era's older feed Go (1.23.x) never compiles our code — go_per_release keeps it audited for awareness.",
         "targets": {
           "mediatek-filogic": {
             "digest": "sha256:4109260d68a593972d0d0408e6e439472cd02df9a29a3a9383fd52bd97707a4a"

tests/cloud-lab/Dockerfile.client

@@ -5,7 +5,7 @@
 
 # Toolchain from the manifest, as a GLOBAL arg so the go-builder FROM
 # below can expand it (stage-local ARGs are invisible to FROM lines).
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.26.10
 FROM rust:1.88-bookworm AS rust-builder
 
 # Build cdk-cli for wallet operations

tests/cloud-lab/Dockerfile.tollgate

@@ -7,7 +7,7 @@
 # Toolchain + version come from the manifest (packaging/build-inputs.json)
 # via docker-compose build args exported by lab.sh — the defaults below are
 # lockstep fallbacks, drift-gated by tests/contract/check-toolchain-parity.py.
-ARG GO_VERSION=1.26.8
+ARG GO_VERSION=1.26.10
 FROM golang:${GO_VERSION}-bookworm AS builder
 
 WORKDIR /build

tests/cloud-lab/docker-compose.yml

@@ -127,7 +127,7 @@ services:
       context: ../..
       dockerfile: tests/cloud-lab/Dockerfile.tollgate
       args:
-        GO_VERSION: ${TG_GO_VERSION:-1.26.8}
+        GO_VERSION: ${TG_GO_VERSION:-1.26.10}
         PACKAGE_VERSION: ${TG_PACKAGE_VERSION:-0.0.0-r0}
         LDFLAGS: ${TG_LDFLAGS:-}
     container_name: tg-upstream
@@ -167,7 +167,7 @@ services:
       context: ../..
       dockerfile: tests/cloud-lab/Dockerfile.tollgate
       args:
-        GO_VERSION: ${TG_GO_VERSION:-1.26.8}
+        GO_VERSION: ${TG_GO_VERSION:-1.26.10}
         PACKAGE_VERSION: ${TG_PACKAGE_VERSION:-0.0.0-r0}
         LDFLAGS: ${TG_LDFLAGS:-}
     container_name: tg-upstream-ext
@@ -199,7 +199,7 @@ services:
       context: ../..
       dockerfile: tests/cloud-lab/Dockerfile.tollgate
       args:
-        GO_VERSION: ${TG_GO_VERSION:-1.26.8}
+        GO_VERSION: ${TG_GO_VERSION:-1.26.10}
         PACKAGE_VERSION: ${TG_PACKAGE_VERSION:-0.0.0-r0}
         LDFLAGS: ${TG_LDFLAGS:-}
     container_name: tg-reseller