build: bump golang image to 1.27.1 and prepare code for Go 1.27 - #4505
Open
stevenvegt wants to merge 2 commits into
Open
build: bump golang image to 1.27.1 and prepare code for Go 1.27#4505stevenvegt wants to merge 2 commits into
stevenvegt wants to merge 2 commits into
Conversation
Go 1.27 backs encoding/json with encoding/json/v2 and changes how pkix.Name.String renders attributes with unrecognized OIDs. Both break nuts-node when built with the golang:1.27.1 image while the unit tests (run with the go.mod toolchain) stay green: - go-did's CredentialStatus.UnmarshalJSON recursed until stack overflow under json/v2, crashing the node on any credential that carries a credentialStatus. Bump go-did to the commit that fixes this (to be replaced by the tagged release). - The denylist test hardcoded the pre-1.27 hex rendering of the emailAddress attribute in the banned certificate's issuer; derive it from the certificate instead. - json error messages changed wording for invalid bytes and nested type errors; assert on the stable parts only. Assisted-by: AI
Replaces the pseudo-version of the CredentialStatus fix (go-did#163) with the tagged release that contains it. Assisted-by: AI
stevenvegt
marked this pull request as ready for review
September 9, 2026 11:55
stevenvegt
requested review from
Dirklectisch,
JorisHeadease,
gerardsn,
reinkrul and
woutslakhorst
as code owners
September 9, 2026 11:55
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Supersedes #4461 (same Dockerfile change) and includes the fixes needed to make it pass. The go-did fix has been released as v0.22.1, so this is ready for review.
Why #4461 fails
Building with Go 1.27 changes two standard-library behaviours that the unit tests do not cover (the
testjob uses the go.mod toolchain, only the Docker build uses the image's Go):encoding/jsonis now backed byencoding/json/v2(release notes). go-did'sCredentialStatus.UnmarshalJSONusedtype alias *CredentialStatus; the v2-backed decoder resolves the method through the pointer alias and recurses untilfatal error: stack overflow. Every credential with acredentialStatuscrashed the node, which is theEmpty reply from serverin the redis e2e job. Fixed in fix(vc): avoid infinite recursion in CredentialStatus.UnmarshalJSON on Go 1.27 go-did#163, released in go-did v0.22.1.pkix.Name.Stringnow renders string attributes with unrecognized OIDs as text instead of hex (crypto/x509/pkix: Name.String() hex-encodes string-type ExtraNames golang/go#33093). The denylist tests hardcoded the old hex form of theemailAddressattribute in the banned certificate's issuer, socertificate is bannedwas no longer returned in the tests. The production denylist currently has one entry with a CN-only issuer, so live matching is unaffected, but future entries whose issuer has such attributes will only match nodes on the same Go generation.Two more differences are cosmetic: json prints an invalid byte as
\xd7instead of×, and nested type errors sayinto .0 of typeinstead ofinto Go value of type. Those tests now assert on the stable parts of the message.Changes
Dockerfile: golang 1.26.6-alpine -> 1.27.1-alpine (identical to chore(deps): bump golang from 1.26.6-alpine to 1.27.1-alpine in the docker group across 1 directory #4461).go.mod: go-did v0.22.0 -> v0.22.1 (contains theCredentialStatusfix from fix(vc): avoid infinite recursion in CredentialStatus.UnmarshalJSON on Go 1.27 go-did#163).pki/denylist_test.go: derive the banned issuer string from the certificate at runtime.auth/services/oauth,vcr/credential,vcr/verifiertests: assert on toolchain-independent parts of json error messages.Verification
GOTOOLCHAIN=go1.27.1 go test ./...and the Go 1.26.5 run both pass locally with go-did v0.22.1, exceptTestNetwork_checkHealth, which fails in my local environment on master as well. The e2e job on this PR is the actual check for the crash.Follow-up
V6.2 and V5.4 need go-did v0.22.1 on their pinned go-did lines before their Go image can move to 1.27.