[barnabasbusa]

Eight eMudhra intermediate CA private keys were compromised (Mozilla, Google), and Go 1.26.10/1.27.3 ship the crypto/x509 fix, so every binary built with an older toolchain still trusts certificates minted with those keys. This raises the go.mod minimum to go 1.26.10, so Docker, goreleaser and CI builds can no longer silently use an older toolchain, and moves pinned or pre-1.26 golang builder images and setup-go versions to match.

[redpandabot]

Summary

Version bump of setup-go and the Docker builder image from Go 1.26.9 to 1.26.10 in response to the eMudhra CA compromise. The workflow and Dockerfile bumps are consistent, but scripts/update-deps.sh — which generates the go.mod every build path (both workflows and the Dockerfile) uses — still pins toolchain=go1.26.9, so the PR's stated goal of preventing builds from silently using the vulnerable toolchain is only half-done.

Issues

• 🟡 scripts/update-deps.sh:19 — generated go.mod still pins toolchain go1.26.9 — go mod edit -go=1.26.2 -toolchain=go1.26.9 still writes the vulnerable toolchain into the go.mod that spageth-build.sh generates on every build path (build.yml, check-patches.yml, ci/Dockerfile). CI is safe only because its pinned 1.26.10 toolchain is newer, so GOTOOLCHAIN=auto keeps it; a local build with an older Go silently downloads and builds with go1.26.9, defeating the PR's purpose. Should be bumped to go1.26.10 alongside the rest.

---

_{Reviewed @ a689aa01
"First, solve the problem. Then, write the code." — John Johnson}

[samcm]

Reviewed the Go 1.26.10 bump: versions, image tags and pins check out.