Harden compiler bootstrap against compromised certificate authorities

.devcontainer/Dockerfile

@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/devcontainers/go:1-bookworm
+FROM mcr.microsoft.com/devcontainers/base:bookworm
 
 # Remove the broken yarn apt source with expired GPG key
 RUN rm -f /etc/apt/sources.list.d/yarn.list

.devcontainer/devcontainer.json

@@ -44,6 +44,9 @@
     "ghcr.io/devcontainers/features/docker-in-docker:4.0.0": {},
     "ghcr.io/devcontainers/features/git-lfs:1": {},
     "ghcr.io/devcontainers/features/github-cli:1": {},
+    "ghcr.io/devcontainers/features/go:1": {
+      "version": "1.27.3"
+    },
     "ghcr.io/devcontainers/features/node:2.1.0": {
       "version": "24"
     }

.devcontainer/upgrade-tools.sh

@@ -1,35 +1,13 @@
 #!/bin/bash
-# Upgrade Go and the GitHub CLI (gh) to their latest released versions.
-# Intended to run on devcontainer post-create so the environment always
-# picks up the newest toolchain.
+# Verify the pinned Go feature and upgrade the GitHub CLI (gh).
 set -euo pipefail
 
-ARCH="$(dpkg --print-architecture 2>/dev/null || uname -m)"
-case "$ARCH" in
-  x86_64) ARCH="amd64" ;;
-  aarch64) ARCH="arm64" ;;
-esac
-
-# --- Upgrade Go to the latest stable version ---
-echo "Determining latest Go version..."
-LATEST_GO="$(curl -fsSL https://go.dev/VERSION?m=text | head -n1)"
-if [ -z "${LATEST_GO:-}" ]; then
-  echo "Failed to determine latest Go version; skipping Go upgrade." >&2
-else
-  CURRENT_GO="$(go version 2>/dev/null | awk '{print $3}' || echo "none")"
-  if [ "$CURRENT_GO" = "$LATEST_GO" ]; then
-    echo "Go is already up to date ($CURRENT_GO)."
-  else
-    echo "Upgrading Go from ${CURRENT_GO} to ${LATEST_GO}..."
-    TARBALL="${LATEST_GO}.linux-${ARCH}.tar.gz"
-    TMP="$(mktemp -d)"
-    curl -fsSL "https://go.dev/dl/${TARBALL}" -o "${TMP}/${TARBALL}"
-    sudo rm -rf /usr/local/go
-    sudo tar -C /usr/local -xzf "${TMP}/${TARBALL}"
-    rm -rf "${TMP}"
-    echo "Go upgraded to $(/usr/local/go/bin/go version | awk '{print $3}')."
-  fi
+CURRENT_GO="$(env -u GOROOT GOTOOLCHAIN=local go version | awk '{print $3}')"
+if [ "$CURRENT_GO" != go1.27.3 ]; then
+  echo "ERROR: Expected Go 1.27.3 from the pinned devcontainer feature; found ${CURRENT_GO}. Rebuild the devcontainer." >&2
+  exit 1
 fi
+echo "Go tooling is pinned to ${CURRENT_GO}."
 
 # --- Upgrade the GitHub CLI (gh) to the latest release ---
 echo "Upgrading GitHub CLI (gh)..."

.github/workflows/cgo.yml

@@ -1522,7 +1522,7 @@ jobs:
       # Downloads pre-built binary from GitHub releases instead of using go install
     - name: Install golangci-lint
       run: |
-        GOLANGCI_LINT_VERSION="v2.13.2"
+        GOLANGCI_LINT_VERSION="v2.15.0"
         GOOS=$(go env GOOS)
         GOARCH=$(go env GOARCH)
         GOPATH=$(go env GOPATH)