PLT-2271: remediate eMudhra CA compromise and bump Go, base images and actions

.github/actions/bootstrap/action.yaml

@@ -5,9 +5,9 @@ runs:
   using: composite
   steps:
     - name: Setup
-      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@v5.3.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # pin@v7.0.0
       with:
-        go-version: 1.20.x
+        go-version: 1.26.x
 
     - name: Build
       shell: bash

.github/actions/cache/golang/action.yml

@@ -15,7 +15,7 @@ runs:
   steps:
     - name: Restore Go mod (pkg)
       if: ${{ inputs.refresh-go-cache != 'true' }}
-      uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       with:
         path: |          
           ~/go/pkg/mod
@@ -26,7 +26,7 @@ runs:
 
     - name: Restore Go build (test)
       if: ${{ inputs.refresh-go-cache != 'true' }}
-      uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       with:
         path: |
           ~/.cache/go-build
@@ -37,7 +37,7 @@ runs:
 
     - name: Cache Go mod (pkg)
       if: ${{ inputs.refresh-go-cache == 'true' }}
-      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       with:
         path: |
           ~/go/pkg/mod
@@ -48,7 +48,7 @@ runs:
 
     - name: Cache Go build (test)
       if: ${{ inputs.refresh-go-cache == 'true' }}
-      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       with:
         path: |
           ~/.cache/go-build

.github/actions/cache/golangci-lint/action.yml

@@ -10,15 +10,15 @@ inputs:
   golangci-lint-version:
     description: Golangci-lint version to use
     required: false
-    default: v1.51.1
+    default: v2.15.0
   refresh-analysis-cache:
     description: Flag to control if golangci-lint analysis cache needs to be refreshed
     default: false
 runs:
   using: "composite"
   steps:
     - name: Cache golangci-lint
-      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       id: cache-golangci-lint
       with:
         path: ~/go/bin/golangci-lint
@@ -27,11 +27,11 @@ runs:
     - name: Install golangci-lint
       if: steps.cache-golangci-lint.outputs.cache-hit != 'true'
       shell: bash
-      run: go install github.com/golangci/golangci-lint/cmd/golangci-lint@${{ inputs.golangci-lint-version }}
+      run: go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@${{ inputs.golangci-lint-version }}
 
     - name: Restore golangci-lint analysis cache
       if: ${{ inputs.refresh-analysis-cache != 'true' }}
-      uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       with:
         path: ~/.cache/golangci-lint
         # This technique will make the cache key unique to the commit SHA,
@@ -42,7 +42,7 @@ runs:
 
     - name: Cache golangci-lint analysis cache
       if: ${{ inputs.refresh-analysis-cache == 'true' }}
-      uses: actions/cache@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       with:
         path: ~/.cache/golangci-lint
         # This technique will make the cache key unique to the commit SHA,

.github/actions/push/action.yaml

@@ -30,21 +30,21 @@ runs:
   using: "composite"
   steps:
     - name: Log in to GitHub Container Registry
-      uses: docker/login-action@74a5d142397b4f367a81961eba4e8cd7edddf772 # pin@v3.4.0
+      uses: docker/login-action@dbcb813823bdd20940b903addbd779551569679f # pin@v4.6.0
       with:
         registry: ghcr.io
         username: ${{ github.actor }}
         password: ${{ inputs.github-token }}
 
     - name: Extract Docker metadata
       id: meta
-      uses: docker/metadata-action@902fa8ec7d6ecbf8d84d538b9b233a880e428804 # pin@v5.7.0
+      uses: docker/metadata-action@dc802804100637a589fabce1cb79ff13a1411302 # pin@v6.2.0
       with:
         images: ghcr.io/${{ github.repository }}/s
         github-token: ${{ inputs.github-token }}
 
     - name: Restore Go mod (pkg)
-      uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       with:
         path: "~/go/pkg/mod"
         key: ${{ runner.os }}-gomod-${{ hashFiles('**/go.sum') }}-${{ github.sha }}-${{ github.run_id }}
@@ -54,7 +54,7 @@ runs:
           ${{ runner.os }}-gomod-
 
     - name: Restore Go build (test)
-      uses: actions/cache/restore@d4323d4df104b026a6aa633fdb11d772146be0bf # pin@v4.2.2
+      uses: actions/cache/restore@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # pin@v6.1.0
       with:
         path: "~/.cache/go-build"
         key: ${{ runner.os }}-gobuild-${{ hashFiles('**/go.sum') }}-${{ github.sha }}-${{ github.run_id }}
@@ -71,14 +71,14 @@ runs:
 
     - name: Set up Docker Buildx
       id: buildx
-      uses: docker/setup-buildx-action@b5ca514318bd6ebac0fb2aedd5d36ec1b5c232a2 # pin@v3.10.0
+      uses: docker/setup-buildx-action@f87e5991a6d7451dcb8d9637bfbc97413f497069 # pin@v4.4.1
       with:
         version: latest
         endpoint: builders
 
     - name: Build and push
       id: build
-      uses: docker/build-push-action@471d1dc4e07e5cdedd4c2171150001c434f0b7a4 # pin@v6.15.0
+      uses: docker/build-push-action@c3c9e263c25d99ce0380d002d59b67737d91b0dc # pin@v7.4.0
       with:
         context: .
         platforms: ${{ inputs.platforms }}

.github/actions/rewind/action.yaml

@@ -5,9 +5,9 @@ runs:
   using: composite
   steps:
     - name: Setup
-      uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@v5.3.0
+      uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # pin@v7.0.0
       with:
-        go-version: 1.20.x
+        go-version: 1.26.x
 
     - name: Build
       shell: bash

.github/workflows/main.yaml

@@ -16,7 +16,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
 
       - name: Tags
         shell: bash
@@ -33,7 +33,7 @@ jobs:
           tags: ${{ env.TAGS }}
 
       - name: Attest
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # pin@v4.2.2
         id: attest
         with:
           subject-name: ghcr.io/${{ github.repository }}/immutable-geth

.github/workflows/pr.yaml

@@ -13,19 +13,19 @@ jobs:
     runs-on: ubuntu-24-04-4-cores
     timeout-minutes: 1
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
       - name: Invariants
         shell: bash
         run: ./.github/scripts/invariants.sh
       - name: TruffleHog OSS
-        uses: trufflesecurity/trufflehog@12164e38f0f1b673ab0594c7d94daf71b0be6823 # pin@3.88.17
+        uses: trufflesecurity/trufflehog@e63326d6545de8f425d93ce24078c6e68d83f70e # pin@3.99.3
 
   bootstrap:
     name: Local E2E Tests
     runs-on: ubuntu-24-04-4-cores
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
       - name: Cache modules
         uses: ./.github/actions/cache/golang
       - uses: ./.github/actions/bootstrap
@@ -35,7 +35,7 @@ jobs:
     runs-on: ubuntu-24-04-4-cores
     timeout-minutes: 10
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
       - name: Cache modules
         uses: ./.github/actions/cache/golang
       - uses: ./.github/actions/rewind
@@ -45,12 +45,12 @@ jobs:
     runs-on: ubuntu-24-04-4-cores
     timeout-minutes: 35
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
         with:
           fetch-depth: 0 # We need the full history to get the base commit in order to compute the diff in golanci-lint
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@v5.3.0
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # pin@v7.0.0
         with:
-          go-version: 1.20.x
+          go-version: 1.26.x
       - name: Cache modules
         uses: ./.github/actions/cache/golang
       - name: Cache linter
@@ -64,7 +64,6 @@ jobs:
           golangci-lint run \
             --new-from-rev=${{ github.event.pull_request.base.sha || 'HEAD~'}} \
             --concurrency=4 \
-            --out-format=github-actions \
             --config .golangci.yml \
             ./...
 
@@ -73,10 +72,10 @@ jobs:
     runs-on: ubuntu-24-04-4-cores
     timeout-minutes: 35
     steps:
-      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
-      - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # pin@v5.3.0
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
+      - uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # pin@v7.0.0
         with:
-          go-version: 1.20.x
+          go-version: 1.26.x
       - name: Cache modules
         uses: ./.github/actions/cache/golang
       - name: All Tests

.github/workflows/release.yaml

@@ -14,7 +14,7 @@ jobs:
       packages: write
     steps:
       - name: Checkout
-        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # pin@v4.2.2
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # pin@v7.0.1
 
       - name: Set Release Tag
         run: echo "TAG=$(echo ${GITHUB_REF} | sed 's/refs\/tags\///')" >> $GITHUB_ENV
@@ -27,7 +27,7 @@ jobs:
           platforms: linux/amd64,linux/arm64
 
       - name: Attest
-        uses: actions/attest-build-provenance@v2
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # pin@v4.2.2
         id: attest
         with:
           subject-name: ghcr.io/${{ github.repository }}/immutable-geth

.golangci.yml

@@ -1,60 +1,61 @@
-# This file configures github.com/golangci/golangci-lint.
-
+version: "2"
 run:
-  timeout: 20m
   tests: true
-  # default is true. Enables skipping of directories:
-  #   vendor$, third_party$, testdata$, examples$, Godeps$, builtin$
-  skip-dirs-use-default: true
-  skip-files:
-    - core/genesis_alloc.go
-
 linters:
-  disable-all: true
+  default: none
   enable:
-    - goimports
-    - gosimple
+    - bidichk
+    - durationcheck
     - govet
     - ineffassign
     - misspell
+    - staticcheck
     - unconvert
-    - typecheck
     - unused
-    - staticcheck
-    - bidichk
-    - durationcheck
-    - exportloopref
     - whitespace
-
-    # - structcheck # lots of false positives
-    # - errcheck #lot of false positives
-    # - contextcheck
-    # - errchkjson # lots of false positives
-    # - errorlint # this check crashes
-    # - exhaustive # silly check
-    # - makezero # false positives
-    # - nilerr # several intentional
-
-linters-settings:
-  gofmt:
-    simplify: true
-
-issues:
-  exclude-rules:
-    - path: crypto/bn256/cloudflare/optate.go
-      linters:
-        - deadcode
-        - staticcheck
-    - path: internal/build/pgp.go
-      text: 'SA1019: "golang.org/x/crypto/openpgp" is deprecated: this package is unmaintained except for security fixes.'
-    - path: core/vm/contracts.go
-      text: 'SA1019: "golang.org/x/crypto/ripemd160" is deprecated: RIPEMD-160 is a legacy hash and should not be used for new applications.'
-    - path: accounts/usbwallet/trezor.go
-      text: 'SA1019: "github.com/golang/protobuf/proto" is deprecated: Use the "google.golang.org/protobuf/proto" package instead.'
-    - path: accounts/usbwallet/trezor/
-      text: 'SA1019: "github.com/golang/protobuf/proto" is deprecated: Use the "google.golang.org/protobuf/proto" package instead.'
-  exclude:
-    - 'SA1019: event.TypeMux is deprecated: use Feed'
-    - 'SA1019: strings.Title is deprecated'
-    - 'SA1019: strings.Title has been deprecated since Go 1.18 and an alternative has been available since Go 1.0: The rule Title uses for word boundaries does not handle Unicode punctuation properly. Use golang.org/x/text/cases instead.'
-    - 'SA1029: should not use built-in type string as key for value'
+  exclusions:
+    generated: lax
+    presets:
+      - comments
+      - common-false-positives
+      - legacy
+      - std-error-handling
+    rules:
+      - linters:
+          - deadcode
+          - staticcheck
+        path: crypto/bn256/cloudflare/optate.go
+      - path: internal/build/pgp.go
+        text: 'SA1019: "golang.org/x/crypto/openpgp" is deprecated: this package is unmaintained except for security fixes.'
+      - path: core/vm/contracts.go
+        text: 'SA1019: "golang.org/x/crypto/ripemd160" is deprecated: RIPEMD-160 is a legacy hash and should not be used for new applications.'
+      - path: accounts/usbwallet/trezor.go
+        text: 'SA1019: "github.com/golang/protobuf/proto" is deprecated: Use the "google.golang.org/protobuf/proto" package instead.'
+      - path: accounts/usbwallet/trezor/
+        text: 'SA1019: "github.com/golang/protobuf/proto" is deprecated: Use the "google.golang.org/protobuf/proto" package instead.'
+      - path: (.+)\.go$
+        text: 'SA1019: event.TypeMux is deprecated: use Feed'
+      - path: (.+)\.go$
+        text: 'SA1019: strings.Title is deprecated'
+      - path: (.+)\.go$
+        text: 'SA1019: strings.Title has been deprecated since Go 1.18 and an alternative has been available since Go 1.0: The rule Title uses for word boundaries does not handle Unicode punctuation properly. Use golang.org/x/text/cases instead.'
+      - path: (.+)\.go$
+        text: 'SA1029: should not use built-in type string as key for value'
+    paths:
+      - core/genesis_alloc.go
+      - third_party$
+      - builtin$
+      - examples$
+formatters:
+  enable:
+    - goimports
+  settings:
+    gofmt:
+      simplify: true
+  exclusions:
+    generated: lax
+    paths:
+      - core/genesis_alloc.go
+      - third_party$
+      - builtin$
+      - examples$

CHANGELOG.md

@@ -6,6 +6,12 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to
 [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [v1.0.0-beta.18]
+
+- Update `ca-certificates` to remove trust in compromised eMudhra intermediate CAs (runtime image `alpine:3.18.9` to `alpine:3.24.3`)
+- Build with Go 1.26 (was Go 1.21)
+- Remove the `/memsize/` page from the pprof server
+
 ## [v1.0.0-beta.17]
 
 - Security fix for p2p networking layer (CVE-2026-22868)