Bump Go toolchain to 1.26.4 and golang.org/x/net to v0.53.0 (Least Authority audit Issue A) - #476
Conversation
philippecamacho
changed the title
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 7a92edaf7f
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| @@ -1,3 +1,3 @@ | |||
| DEPRECATED_TARGETS := elf go1-24 go1-25 clean | |||
| DEPRECATED_TARGETS := diff-hello-elf clean | |||
There was a problem hiding this comment.
When a developer runs make clean from cannon/testdata, this retained deprecated target delegates to just clean, but the shortened cannon/testdata/justfile no longer defines that recipe. The documented cleanup command therefore fails instead of removing testdata/bin; either restore the Just recipe or stop advertising the Make target.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: add091c433
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| module github.com/ethereum-optimism/optimism | ||
|
|
||
| go 1.24.0 | ||
| go 1.26.0 |
There was a problem hiding this comment.
When just run-vm-compat or just regenerate-vm-compat-baseline is run, op-program/justfile still selects golang:1.24.10-alpine3.21, and Dockerfile.vmcompat copies this root module before executing go mod download. The official image uses GOTOOLCHAIN=local, so raising this directive to 1.26 makes that build stop with go.mod requires go >= 1.26.0 before the compatibility analyzer runs; update the VM-compat builder/toolchain strategy along with the module directive.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: ebba981941
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| wait "$pid1" "$pid2" | ||
| # wait with multiple PIDs only propagates the last PID's exit status; wait | ||
| # separately so an op-program build failure can't be masked by a kona success. | ||
| wait "$pid1" |
There was a problem hiding this comment.
When the op-program build fails while the Kona build is still running, set -e exits immediately at this first wait, so wait "$pid2" is never reached. The Kona process then continues after just reproducible-prestate has returned and may keep writing artifacts or race with a retry; capture the first status without triggering errexit, wait for the second process, and only then return the combined failure.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 8195bed2cf
ℹ️ About Codex in GitHub
Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".
| test: | ||
| # Required for cannon/provider_test TestLastStepCacheAccuracy | ||
| cd ../cannon && make cannon elf | ||
| cd ../cannon && just diff-hello-elf |
There was a problem hiding this comment.
On a clean checkout, just test in op-challenger now builds only the guest ELF, but TestLastStepCacheAccuracy unconditionally launches cannon/bin/cannon via its VmBin configuration. Since the previous make cannon elf invocation built that executable, this change makes the documented package test target fail with a missing binary unless a stale artifact happens to exist; invoke both cannon and diff-hello-elf here.
Useful? React with 👍 / 👎.
| _go-tests-ci-internal go_test_flags="": sync-superchain | ||
| set -euo pipefail | ||
| (cd cannon && just cannon elf) | ||
| (cd cannon && just diff-hello-elf) |
There was a problem hiding this comment.
When just go-tests-short-ci or just go-tests-ci is run directly from a clean checkout, this setup no longer creates cannon/bin/cannon, although ALL_TEST_PACKAGES includes ./op-challenger/... and TestLastStepCacheAccuracy executes that binary. The CircleCI workflow masks this through the go-binaries-for-sysgo workspace, but the local wrappers previously worked independently because this line ran just cannon elf; build cannon alongside diff-hello-elf here.
Useful? React with 👍 / 👎.
* chore(docker): bump Go builder image to 1.26.4 Rebuild OP Stack release images on golang:1.26.4 to pick up stdlib security fixes. Docker builder pins only; go.mod and CI Go version unchanged. * chore: bump Go toolchain pins to 1.26.4 Align mise.toml and go.mod with the Docker builder image bump so CircleCI tests and shipped images use the same Go version. * fix: unblock CI for Go 1.26.4 toolchain bump Bump mockery to 2.53.6 for Go 1.26 AST parsing, regen mocks, fix govet format string, tidy cannon testdata go.mod files, and raise Random cannon test step budget (~510k needed vs 500k cap). * fix(cannon): noop Go 1.26 prctl syscall in mips64 VM Go 1.26 claim binaries call prctl (5153). Handle it as a guest noop in the Go VM, onchain MIPS64, and cannon EVM syscall tests. * chore(op-chain-ops): drop removed legacy withdrawal fuzz target FuzzEncodeDecodeLegacyWithdrawal no longer exists; remove from just fuzz list to avoid noisy parallel worker. * ci: bust Go build cache for 1.26.4 toolchain bump Stale go-build cache from Go 1.24 can break fuzz/tests under 1.26. * ci: sync go-cache-version defaults to v0.1 * fix(op-node): disable QUIC in peer score test for Go 1.26 quic-go v0.46 panics on Go 1.26 TLS session ticket behavior; test only needs TCP gossipsub so use OptDisableQUIC in swarm setup. * fix(cannon): drop Go FPVM fixtures and revert prctl VM bump Production FPVM runs kona, not Go claim programs. Revert MIPS64 prctl noop and semver bump per review feedback, remove legacy go-1-24/1-25 guest fixtures and tests that forced Go-runtime syscall tracking, and keep a minimal diff-hello ELF only for diff-cannon parity checks. * fix(cannon): update CI test prep for diff-hello-elf recipe go-tests-short still invoked removed `just elf` when building Cannon guest binaries. Point root and op-challenger test prep at diff-hello-elf. * fix(cannon): build diff-hello guest with Go 1.24 toolchain Go 1.26-linked hello binaries call prctl in the FPVM, which we intentionally do not implement after dropping legacy Go guest fixtures. Pin diff-hello to Go 1.24 in an isolated module so provider and diff-cannon tests keep working.
Second part of the remediation for Least Authority Initial Audit Report (20 July 2026), Issue A: DoS vulnerabilities reachable through the L1 RPC requests used for Espresso batch authentication. The Go 1.26.4 toolchain bump (previous commit, cherry-picked from upstream ad29082) covers the stdlib issues (GO-2026-4870 TLS KeyUpdate deadlock, GO-2026-5037 quadratic X.509 SAN verification). This commit updates golang.org/x/net to v0.53.0 to cover the HTTP/2 zero SETTINGS_MAX_FRAME_SIZE loop (GO-2026-4918), along with the sibling golang.org/x/* version bumps required by go get / go mod tidy. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
The reproducible prestate Docker build was still pinned to Go 1.24, which fails 'go mod download' now that go.mod requires go >= 1.26 (GOTOOLCHAIN=local in the image prevents auto-upgrade). This left the cannon-prestate CI job green without producing op-program prestates, which in turn failed the acceptance tests with 'cannon pre-state should be built'. Also wait on the parallel prestate builds separately: 'wait pid1 pid2' only propagates the last PID's exit status, so the op-program build failure was masked by the kona build succeeding.
…ngs=0 The MIPS client ELFs were built with 'go build ./client/cmd/main.go', which compiles only that single file and silently drops godebug.go — the file carrying the '//go:debug decoratemappings=0' directive. With the prestate build now on Go 1.26, the runtime's default decoratemappings=1 makes the client call prctl(PR_SET_VMA, PR_SET_VMA_ANON_NAME, ...) — syscall 5153 on mips64 — which cannon does not implement, so every cannon trace execution panicked with 'unrecognized syscall: 5153' (memory-all-opn-op-geth: TestExecuteStep_Cannon, TestFPP, etc.). Build the package directories instead so the directive is honored (go version -m now shows DefaultGODEBUG=decoratemappings=0), and add the same godebug.go to client/interopcmd, which never had one. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Three jobs (semgrep-scan-local, fuzz-golang-op-node, contracts-bedrock-build-1) died with infrastructure_fail before memory-all-opn-op-geth could run; no way to rerun from failed without a CircleCI token. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
8195bed to
98450b7
Compare
|
On the Every Go cache key in Underneath that, Go's build cache is keyed internally by a hash that includes the compiler version, so entries built by an older toolchain are never hit — they're dead weight rather than a correctness risk. Which leaves the commit message's claim that "stale go-build cache from Go 1.24 can break fuzz/tests under 1.26." If you saw that concretely, it's worth keeping the bump and recording what broke, because it wouldn't be the build cache proper — Harmless either way — worst case it's one cold cache. Just flagging so the next person doesn't infer that toolchain bumps require it. |
I agree. |
4 participants
Remediates points 1 and 2 of Least Authority audit Issue A (Go DoS CVEs GO-2026-4870, GO-2026-4918, GO-2026-5037 reachable via L1 RPC).
golang.org/x/netv0.48.0 → v0.53.0 (not covered by the upstream commit)