ci: add Go 1.27

.github/workflows/boulder-ci.yml

@@ -36,7 +36,8 @@ jobs:
       matrix:
         # Add additional docker image tags here and all tests will be run with the additional image.
         BOULDER_TOOLS_TAG:
-          - go1.26.6_2026-08-13
+          - go1.26.6_2026-08-20
+          - go1.27.0_2026-08-20
         # Tests command definitions. Use the entire "docker compose" command you want to run.
         tests:
           # Run ./test.sh --help for a description of each of the flags.

.github/workflows/release.yml

@@ -36,6 +36,7 @@ jobs:
       matrix:
         GO_VERSION:
           - "1.26.6"
+          - "1.27.0"
     runs-on: ubuntu-24.04
     permissions:
       contents: write

.github/workflows/try-release.yml

@@ -21,6 +21,7 @@ jobs:
       matrix:
         GO_VERSION:
           - "1.26.6"
+          - "1.27.0"
     runs-on: ubuntu-24.04
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

docker-compose.yml

@@ -8,7 +8,7 @@ services:
       context: test/boulder-tools/
       # Should match one of the GO_CI_VERSIONS in test/boulder-tools/tag_and_upload.sh.
       args:
-        GO_VERSION: 1.26.6
+        GO_VERSION: 1.27.0
     environment:
       # To solve HTTP-01 and TLS-ALPN-01 challenges, change the IP in FAKE_DNS
       # to the IP address where your ACME client's solver is listening. This is

test.sh

@@ -96,8 +96,10 @@ function run_unit_tests() {
     # The ra and sa unittests conflict because they both mutate the database.
     # Exclude the ra from our first test run, then run on its own.
     # https://github.com/letsencrypt/boulder/issues/1499
-    go_test $(go list ./... | grep -v 'boulder\/ra$')
+    # Same issue applies to the mtca and the mtpublisher.
+    go_test $(go list ./... | grep -v 'boulder\/\(ra|mtpublisher\)$')
     go_test ./ra
+    go_test ./mtpublisher
   else
     go_test "${UNIT_PACKAGES[@]}"
   fi
@@ -108,7 +110,7 @@ function run_unit_tests() {
 # Run `go test` on a given set of packages.
 #
 function go_test() {
-  "${GO}" test "${UNIT_FLAGS[@]}" "${FILTER[@]}" "$@"
+  "${GO}" test -count=1 "${UNIT_FLAGS[@]}" "${FILTER[@]}" "$@"
 }
 
 #

test/boulder-tools/Dockerfile

@@ -19,7 +19,7 @@ RUN gotip download
 RUN go install github.com/rubenv/sql-migrate/sql-migrate@v1.1.2
 RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.5
 RUN go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
-RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6
+RUN go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.13.1
 RUN go install github.com/jsha/minica@v1.1.0
 
 FROM rust:latest AS rustdeps

test/boulder-tools/tag_and_upload.sh

@@ -12,7 +12,7 @@ DOCKER_REPO="letsencrypt/boulder-tools"
 # .github/workflows/release.yml,
 # .github/workflows/try-release.yml if appropriate,
 # and .github/workflows/boulder-ci.yml with the new container tag.
-GO_CI_VERSIONS=( "1.26.6" )
+GO_CI_VERSIONS=( "1.26.6" "1.27.0" )
 
 echo "Please login to allow push to DockerHub"
 docker login

test/config/mtca.json

@@ -0,0 +1,82 @@
+{
+	"mtca": {
+		"logID": {
+			"caID": "44947.4.1",
+			"logNumber": 44
+		},
+		"sequencingPeriod": "100ms",
+		"db": {
+			"dbConnectFile": "test/secrets/mtca1_dburl"
+		},
+		"s3": {
+			"s3endpoint": "http://boulder-minio:9000",
+			"s3bucket": "boulder-mtc-tiles",
+			"awsConfigFile": "test/config-next/mtca-s3-config.ini",
+			"awsCredsFile": "test/secrets/mtca-s3-creds.ini"
+		},
+		"tls": {
+			"caCertFile": "test/certs/ipki/minica.pem",
+			"certFile": "test/certs/ipki/mtca.boulder/cert.pem",
+			"keyFile": "test/certs/ipki/mtca.boulder/key.pem"
+		},
+		"grpcMTCA": {
+			"maxConnectionAge": "30s",
+			"services": {
+				"mtca.MTCA": {
+					"clientNames": [
+						"ra.boulder"
+					]
+				},
+				"grpc.health.v1.Health": {
+					"clientNames": [
+						"health-checker.boulder"
+					]
+				}
+			}
+		},
+		"issuance": {
+			"certProfiles": {
+				"mtcshortlived": {
+					"mtc": true,
+					"omitCommonName": true,
+					"omitKeyEncipherment": true,
+					"omitSKID": true,
+					"maxValidityPeriod": "160h",
+					"maxValidityBackdate": "1h5m",
+					"maxCertificateSize": 10000,
+					"lintConfig": "test/config-next/zlint.toml",
+					"ignoredLints": [
+						"e_pkimetal_lint_cabf_serverauth_cert",
+						"e_signature_algorithm_not_supported",
+						"e_ext_authority_key_identifier_no_key_identifier",
+						"w_ext_subject_key_identifier_missing_sub_cert",
+						"w_ct_sct_policy_count_unsatisfied",
+						"e_subscriber_server_certificate_matches_cps_profile"
+					]
+				}
+			},
+			"issuers": [
+				{
+					"profiles": [
+						"mtcshortlived"
+					],
+					"crlShards": 10,
+					"issuerURL": "http://ignored.letsencrypt.org",
+					"crlURLBase": "http://ignored.letsencrypt.org/",
+					"location": {
+						"file": "test/certs/mtpki/mtca1.key.pem",
+						"certFile": "test/certs/mtpki/mtca1.cert.pem"
+					}
+				}
+			]
+		}
+	},
+	"syslog": {
+		"stdoutlevel": 6,
+		"sysloglevel": -1
+	},
+	"openTelemetry": {
+		"endpoint": "bjaeger:4317",
+		"sampleratio": 1
+	}
+}