diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml index ee87484f739..7f14e499cfd 100644 --- a/.github/workflows/release.yml +++ b/.github/workflows/release.yml @@ -35,7 +35,8 @@ jobs: fail-fast: false matrix: GO_VERSION: - - "1.25.5" + - "1.25.8" + - "1.26.1" runs-on: ubuntu-24.04 permissions: contents: write diff --git a/.github/workflows/try-release.yml b/.github/workflows/try-release.yml index 0b5a371f1f3..a7b67c06d05 100644 --- a/.github/workflows/try-release.yml +++ b/.github/workflows/try-release.yml @@ -20,7 +20,8 @@ jobs: fail-fast: false matrix: GO_VERSION: - - "1.25.5" + - "1.25.8" + - "1.26.1" runs-on: ubuntu-24.04 steps: - uses: actions/checkout@v6 diff --git a/tools/fetch-and-verify-go.sh b/tools/fetch-and-verify-go.sh index afd661d0ba4..e44cde78ea8 100755 --- a/tools/fetch-and-verify-go.sh +++ b/tools/fetch-and-verify-go.sh @@ -14,47 +14,24 @@ PLATFORM="${2:-linux-amd64}" export GNUPGHOME="$(mktemp -d)" -# From https://www.google.com/linuxrepositories/ +# Import Google's published Linux package signing key bundle. +# Source: https://dl.google.com/linux/linux_signing_key.pub # -# Key Details -# Download: https://dl.google.com/linux/linux_signing_key.pub -# Key ID: Google, Inc. Linux Package Signing Key -# Fingerprint: 4CCA 1EAF 950C EE4A B839 76DC A040 830F 7FAC 5991 -# Google, Inc. (Linux Package Signing Authority) -# Fingerprint: EB4C 1BFD 4F04 2F6D DDCC EC91 7721 F63B D38B 4796 +# You may occasionally need to update the pinned key bundle below. To verify +# "old block vs new block" is only a subkey update: +# 1) Make an isolated keyring: `export GNUPGHOME="$(mktemp -d)"`. +# 2) Save this embedded key block into a file named `old` +# 3) Run `gpg --show-keys --with-fingerprint old` and note the +# fingerprint under `pub`. +# 4) `curl -fsSL https://dl.google.com/linux/linux_signing_key.pub -o new`, +# then `gpg --show-keys --with-fingerprint --with-subkey-fingerprint new`. +# Confirm the same `pub` fingerprint. +# 5) Import the old keyblock with `gpg --import old`. +# 6) `gpg --import new` and expect only new subkeys to be added. +# 7) With this confirmed, update the embedded key block with the contents +# of `new`. gpg2 --import <