[ety001]

Background

• GO-2026-6809 / CVE-2026-111943: crypto/x509.Certificate.Verify now distrusts 8 compromised eMudhra/emSign intermediate CA certificates. The fix is a hardcoded SPKI-SHA256 denylist compiled into the stdlib — only binaries built with go1.26.10+ / go1.27.3+ contain the patch. Rebuilding with an old toolchain, updating system CA stores, or bumping dependency versions does NOT fix it.
• This repo builds with golang:1.23-alpine3.20. The go1.23 line is EOL (last release 1.23.12, no further patches will ever be issued), so a minor-version bump is mandatory — there is no patched 1.23 patch release.
• Production impact: beta-hivemind and beta-hivemindsync (Elastic Beanstalk, P1) run steemit/hivemind:latest built with go1.23 (unpatched). Note that the server-* / indexer-* tags pushed on 2026-10-21 (after the 2026-10-19 patch release) are still 1.23 builds — freshly built but still unpatched, because the base image is on an EOL line.
• Both services make outbound TLS calls to api.steemit.com, i.e. they perform certificate-chain verification and are exposed to MITM via certificates issued by the compromised intermediates.

Changes (minimal diff)

File	Change
Dockerfile	build stage FROM golang:1.23-alpine3.20 -> FROM golang:1.27.3-alpine (runtime stage alpine:3.20 untouched)
Dockerfile.server	same build-stage bump (runtime stage untouched)
Dockerfile.indexer	same build-stage bump (runtime stage untouched)
go.mod	add toolchain go1.27.3; the go 1.23.0 directive is unchanged (no language-level change; no go mod tidy)
.github/workflows/check.yml	unchanged — its 3 go-version-file: go.mod entries are backstopped by the new toolchain line (GOTOOLCHAIN=auto downloads go1.27.3)

Verification

Local build with the new toolchain line (built from this branch):

$ go build -o /tmp/hivemind-server ./cmd/server
$ go version -m /tmp/hivemind-server | head -1
/tmp/hivemind-server: go1.27.3
$ ./go-distrust-check.sh /tmp/hivemind-server
  [PATCHED]   /tmp/hivemind-server  toolchain=go1.27.3  黑名单命中=8/8

go build ./... also passes with go1.27.3 (1.23 -> 1.27 cross-minor compile check).

Post-merge acceptance for the rebuilt images:

go version -m <binary>          # must report go1.27.3
./go-distrust-check.sh --image steemit/hivemind:<tag> --path <binary-path>   # must be [PATCHED], 8/8

(Do not rely on govulncheck for acceptance.)

Caveats

• The golang base image moves from alpine3.20 to whatever default Alpine ships with golang:1.27.3-alpine; build-stage apk packages (git, make) are expected to resolve, but this needs confirming on the first rebuild.
• This PR only fixes the build line. Rebuilding and redeploying beta-hivemind / beta-hivemindsync is a separate, manual ops step (per deployment constraints, production changes are executed by the operator).

Note

The working tree had an unrelated local uncommitted change (docs/api-reference.md); it was protected via git stash before branching and is restored after this PR — it is intentionally not part of this diff.