Repository navigation
This patch release rebuilds AICR with Go 1.27.3, which stops crypto/x509 from trusting eight eMudhra intermediate certificate authorities, and adds OpenVEX statements for seven new pillow advisories on the aiperf-bench image. It is cut from v1.1.0 and contains no other changes. v1.1.1 was tagged but never published: its release image scan failed on the pillow advisories, which were published the day before. v1.1.2 replaces it.
Highlights
Go 1.27.3 (crypto/x509 CA distrust) - aicr, aicrd, and the gate and validator images are built with Go 1.27.3, an urgent security release whose only change makes certificate verification reject any chain through eight eMudhra intermediates (golang/go#82345, CVE-2026-111943). Binaries from v1.1.0 and earlier still trust them.
aiperf-bench OpenVEX - Published OpenVEX statements document why aiperf-bench is not_affected by seven pillow 12.3.0 advisories (1 Critical, 6 High). The fixes ship only in pillow 13.0.0, which aiperf 0.13.0 does not accept, and AICR's text-only benchmark never opens an image, so the vulnerable decoders are never reached (2bf662b).
Upgrade Notes
- Private registries and chart mirrors: a server whose TLS certificate chains through one of the distrusted eMudhra intermediates now fails with
x509: no valid chains built, and the check cannot be disabled. None of the public endpoints AICR uses chain through eMudhra.