golang: replace 1.26 with 1.27 - #30241

Reviewed 5 commits. The only thing I'd call blocking is the release-candidate question in the inline comment on golang1.27/Makefile — the rest is small.

Commit checks

• e8593ee "golang: add 1.27.0" — the commit adds go1.27rc2 (GO_VERSION_RC:=2, GO_VERSION_PATCH empty, source go1.27rc2.src.tar.gz), not 1.27.0; upstream has no go1.27.0 tag yet. Subject, the Fixes: CVE-... lines and Link: https://go.dev/doc/go1.27 all read as if a final release. It also changes test.sh's heredoc quoting relative to the 1.26 copy it is derived from, which the message doesn't mention (see inline).
• 9211919 "golang: fix target binary stripping" — the body says "Fix stripping when using previous version as a bootstrap", but the diff changes go-strip-helper to ../go-strip-helper in RSTRIP, which affects every build: a bare go-strip-helper has no slash, so the shell resolves it through $PATH and never finds it, regardless of which bootstrap is used. The relative form matches the existing include ../golang-version.mk convention and looks right; only the explanation seems narrower than the fix.

The extra_provides cleanup in ee26052 is a genuine no-op in output ('libc.so.6' libstdc++.so.6' libtiff.so.6' already concatenates to the same three names) — the message describes it accurately.

PKG_NAME reuse in the BuildPackage calls and the PKG_RELEASE audit are already covered by the formality bot, so I won't repeat them.

Generated by Claude Code

Reviewed 3 new commits (branch was rebased; ee26052 and 9211919 are unchanged).

The whole content delta since 269df43 is one line — cat <<EOF → cat <<'EOF' in golang1.27/test.sh. That resolves the nit from the last round: the file is now byte-identical to golang1.26/test.sh, and GitHub shows it as a pure rename again. 673ef2f and c7f3e15 both do exactly what their subjects say (GO_DEFAULT_VERSION:=1.27, and deleting the three golang1.26/ files).

Commit checks

• a3d63c6 "golang: add 1.27.0" — rebase of e8593ee, message unchanged, so the subject/content mismatch carries over: the Makefile adds go1.27rc2 (GO_VERSION_RC:=2, empty GO_VERSION_PATCH, PKG_SOURCE:=go1.27rc2.src.tar.gz), not 1.27.0. Re-checked at review time — git ls-remote https://github.com/golang/go 'refs/tags/go1.27*' still returns only go1.27rc1 and go1.27rc2, and go1.26.5 is still the newest 1.26 tag. The open thread on golang1.27/Makefile covers the consequences (the PKG_VERSION → test-version.sh mismatch, and the same five targets are still red); nothing there has changed, so I won't repeat it inline. Understood from your reply on the netbird question that this is deliberately a draft until 1.27 is tagged.

Nothing else new. The remaining CI failures and the PKG_NAME-reuse errors are the same ones already reported by the formality bot.

Generated by Claude Code

Reviewed 3 new commits (branch was rebased; ee26052 and 9211919 are unchanged).

The entire content delta since c7f3e15 is the release-candidate bump in golang1.27/Makefile — GO_VERSION_RC:=2 → 3 plus the matching PKG_HASH. Re-verified upstream at review time: git ls-remote https://github.com/golang/go 'refs/tags/go1.27*' returns go1.27rc1, go1.27rc2 and go1.27rc3, so rc3 is the newest 1.27 tag and go1.27.0 is still untagged. The open thread on golang1.27/Makefile therefore still applies as written (PKG_VERSION resolves to 1.27.0 while the toolchain reports go1.27rc3, and test-version.sh:16 greps for " go1.27.0 "). You have already said this stays a draft until 1.27 ships, so I won't re-litigate it — it resolves itself the moment GO_VERSION_RC is cleared and GO_VERSION_PATCH:=0, at which point both PKG_VERSION and PKG_FILE_VERSION evaluate to 1.27.0.

I could not verify the new PKG_HASH: go.dev is not reachable from this environment.

62b4b8b and 1f5765c do exactly what their subjects say (GO_DEFAULT_VERSION:=1.27, and deleting the three golang1.26/ files). git grep golang1.26 at head comes back empty, so nothing in the feed is left pointing at the dropped package.

Commit checks

• 88b866b "golang: add 1.27.0" — the CVE trailers are no longer consistent. Ten lines use Fixed: CVE-..., but the two entries added this round use Fixes: CVE-2026-39822 and Fixes: CVE-2026-42505. Everywhere else in this series Fixes: introduces a commit SHA (Fixes: 5657eb0e2 ("golang: split src into separate packages") in 9211919, Fixes: a6e94447f ("golang: fix missing dependency check") in ee26052), and the PR body follows the same split, so the two odd lines read as commit references rather than advisories. Worth settling on Fixed: for all twelve. Those same two CVEs are also missing from the PR body, which still lists only the original ten.
• The subject still names 1.27.0 while the Makefile packages go1.27rc3 — noted for completeness only, since it goes away with the RC.

Generated by Claude Code