From 2c5391e33aa80160b6699448fc27d916098b1157 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Tue, 20 Oct 2026 20:56:12 +0000
Subject: [PATCH 1/2] Update Go toolchains and system certificate trust

---
 .github/workflows/deploy.yml             | 2 +-
 .github/workflows/release.yml            | 4 ++--
 .github/workflows/test.yml               | 6 +++---
 deploy/aws/cloudformation/template.yaml  | 2 +-
 go.mod                                   | 2 +-
 lib/builds/images/generic/Dockerfile     | 2 +-
 scripts/utm/bootstrap-dev-environment.sh | 2 +-
 7 files changed, 10 insertions(+), 10 deletions(-)

diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index ebe90cc0e..6760795e5 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,7 +24,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.25.4"
+          go-version: "1.26.10"
           cache: false
 
       - name: Install validation tools
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 4db74dc55..a45d43f0c 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
           # Not necessary to upload cache on self-hosted runner(s)
           # ~/go/pkg/mod and ~/.cache/go-build stay on disk between runs automatically.
           cache: false
-          go-version: '1.25.4'
+          go-version: '1.26.10'
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
@@ -49,7 +49,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.25.4'
+          go-version: '1.26.10'
 
       - name: Build server and token tool
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index bdafcd13a..2f1b7513c 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -89,7 +89,7 @@ jobs:
           # Not necessary to upload cache on self-hosted runner(s)
           # ~/go/pkg/mod and ~/.cache/go-build stay on disk between runs automatically.
           cache: false
-          go-version: '1.25.4'
+          go-version: '1.26.10'
 
       - name: Check UFFD pager version
         run: |
@@ -402,7 +402,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.4'
+          go-version: '1.26.10'
           cache: false
       - name: Ensure Docker is running
         run: |
@@ -514,7 +514,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.25.4'
+          go-version: '1.26.10'
           cache: false
       - name: Install dependencies
         run: |
diff --git a/deploy/aws/cloudformation/template.yaml b/deploy/aws/cloudformation/template.yaml
index ecd3f1330..e5fe90b78 100644
--- a/deploy/aws/cloudformation/template.yaml
+++ b/deploy/aws/cloudformation/template.yaml
@@ -481,7 +481,7 @@ Resources:
 
           if [ -n "${HypemanBranch}" ]; then
             apt-get install -y build-essential git make
-            curl -fsSL https://go.dev/dl/go1.25.4.linux-amd64.tar.gz | tar -C /usr/local -xzf -
+            curl -fsSL https://go.dev/dl/go1.26.10.linux-amd64.tar.gz | tar -C /usr/local -xzf -
             export PATH="/usr/local/go/bin:$PATH"
             export HOME=/root
             export GOPATH=/root/go
diff --git a/go.mod b/go.mod
index 6b7ea0e6e..f6f766145 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/kernel/hypeman
 
-go 1.25.4
+go 1.26.10
 
 require (
 	al.essio.dev/pkg/shellescape v1.6.0
diff --git a/lib/builds/images/generic/Dockerfile b/lib/builds/images/generic/Dockerfile
index 5f485f335..937efb68e 100644
--- a/lib/builds/images/generic/Dockerfile
+++ b/lib/builds/images/generic/Dockerfile
@@ -6,7 +6,7 @@
 FROM moby/buildkit:latest AS buildkit
 
 # Build the builder-agent and guest-agent (multi-stage build from hypeman repo)
-FROM golang:1.25-alpine AS agent-builder
+FROM golang:1.26.10-alpine AS agent-builder
 
 WORKDIR /app
 
diff --git a/scripts/utm/bootstrap-dev-environment.sh b/scripts/utm/bootstrap-dev-environment.sh
index fcd191b5a..41265451c 100755
--- a/scripts/utm/bootstrap-dev-environment.sh
+++ b/scripts/utm/bootstrap-dev-environment.sh
@@ -52,7 +52,7 @@ echo "[4/10] Installing Go..."
 if go version 2>/dev/null | grep -q "go1.2"; then
     echo "Go already installed: $(go version)"
 else
-    GO_VERSION="1.25.4"
+    GO_VERSION="1.26.10"
     curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-arm64.tar.gz" | sudo tar -C /usr/local -xzf -
     echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc
     export PATH=$PATH:/usr/local/go/bin

From ff894c3fd49abfaac2f09817c1493206b58b7c85 Mon Sep 17 00:00:00 2001
From: sjmiller609 <7516283+sjmiller609@users.noreply.github.com>
Date: Wed, 21 Oct 2026 12:51:57 +0000
Subject: [PATCH 2/2] Align workflow Go versions and fix bootstrap upgrades

---
 .github/actions/setup-stlc/action.yml    |  2 +-
 .github/workflows/deploy.yml             |  2 +-
 .github/workflows/release.yml            |  4 ++--
 .github/workflows/test.yml               |  6 +++---
 DEVELOPMENT.md                           |  6 +++---
 scripts/utm/bootstrap-dev-environment.sh | 14 +++++++++-----
 6 files changed, 19 insertions(+), 15 deletions(-)

diff --git a/.github/actions/setup-stlc/action.yml b/.github/actions/setup-stlc/action.yml
index 016cc0f33..56aefad52 100644
--- a/.github/actions/setup-stlc/action.yml
+++ b/.github/actions/setup-stlc/action.yml
@@ -17,7 +17,7 @@ runs:
     - name: Set up Go
       uses: actions/setup-go@v5
       with:
-        go-version: "stable"
+        go-version-file: go.mod
         cache: false
 
     - name: Install pnpm
diff --git a/.github/workflows/deploy.yml b/.github/workflows/deploy.yml
index 6760795e5..318d512c9 100644
--- a/.github/workflows/deploy.yml
+++ b/.github/workflows/deploy.yml
@@ -24,7 +24,7 @@ jobs:
 
       - uses: actions/setup-go@v6
         with:
-          go-version: "1.26.10"
+          go-version-file: go.mod
           cache: false
 
       - name: Install validation tools
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index a45d43f0c..b398a92c3 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -23,7 +23,7 @@ jobs:
           # Not necessary to upload cache on self-hosted runner(s)
           # ~/go/pkg/mod and ~/.cache/go-build stay on disk between runs automatically.
           cache: false
-          go-version: '1.26.10'
+          go-version-file: go.mod
 
       - name: Run GoReleaser
         uses: goreleaser/goreleaser-action@v6
@@ -49,7 +49,7 @@ jobs:
       - name: Set up Go
         uses: actions/setup-go@v5
         with:
-          go-version: '1.26.10'
+          go-version-file: go.mod
 
       - name: Build server and token tool
         run: |
diff --git a/.github/workflows/test.yml b/.github/workflows/test.yml
index 2f1b7513c..c99517e68 100644
--- a/.github/workflows/test.yml
+++ b/.github/workflows/test.yml
@@ -89,7 +89,7 @@ jobs:
           # Not necessary to upload cache on self-hosted runner(s)
           # ~/go/pkg/mod and ~/.cache/go-build stay on disk between runs automatically.
           cache: false
-          go-version: '1.26.10'
+          go-version-file: go.mod
 
       - name: Check UFFD pager version
         run: |
@@ -402,7 +402,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26.10'
+          go-version-file: go.mod
           cache: false
       - name: Ensure Docker is running
         run: |
@@ -514,7 +514,7 @@ jobs:
           persist-credentials: false
       - uses: actions/setup-go@v6
         with:
-          go-version: '1.26.10'
+          go-version-file: go.mod
           cache: false
       - name: Install dependencies
         run: |
diff --git a/DEVELOPMENT.md b/DEVELOPMENT.md
index 17e99c1da..0fd22d8d8 100644
--- a/DEVELOPMENT.md
+++ b/DEVELOPMENT.md
@@ -6,7 +6,7 @@ This document covers development setup, configuration, and contributing to Hypem
 
 ### Linux (Default)
 
-**Go 1.25.4+**, **KVM**, **erofs-utils**, **dnsmasq**
+**Go 1.26.10+**, **KVM**, **erofs-utils**, **dnsmasq**
 
 ### macOS (Experimental)
 
@@ -16,7 +16,7 @@ See [macOS Development](#macos-development) below for native macOS development u
 
 **Linux Prerequisites:**
 
-**Go 1.25.4+**, **KVM**, **erofs-utils**, **dnsmasq**. QEMU development and testing also require the architecture-appropriate `qemu-system` package (for example, `qemu-system-x86` on amd64).
+**Go 1.26.10+**, **KVM**, **erofs-utils**, **dnsmasq**. QEMU development and testing also require the architecture-appropriate `qemu-system` package (for example, `qemu-system-x86` on amd64).
 
 ```bash
 # Verify prerequisites
@@ -368,7 +368,7 @@ Hypeman supports native macOS development using Apple's Virtualization.framework
 - **Apple Silicon** (M1/M2/M3) recommended
 - **macOS 14.0+** (Sonoma) required for snapshot/restore (ARM64 only)
 - **Rosetta** required for running `linux/amd64` images on Apple Silicon: `softwareupdate --install-rosetta --agree-to-license`
-- **Go 1.25.4+**
+- **Go 1.26.10+**
 - **Caddy** (for ingress): `brew install caddy`
 - **e2fsprogs** (for ext4 disk images): `brew install e2fsprogs`
 
diff --git a/scripts/utm/bootstrap-dev-environment.sh b/scripts/utm/bootstrap-dev-environment.sh
index 41265451c..09417396b 100755
--- a/scripts/utm/bootstrap-dev-environment.sh
+++ b/scripts/utm/bootstrap-dev-environment.sh
@@ -49,13 +49,17 @@ fi
 
 # Install Go
 echo "[4/10] Installing Go..."
-if go version 2>/dev/null | grep -q "go1.2"; then
+GO_VERSION="1.26.10"
+if [ "$(GOTOOLCHAIN=local go env GOVERSION 2>/dev/null)" = "go${GO_VERSION}" ]; then
     echo "Go already installed: $(go version)"
 else
-    GO_VERSION="1.26.10"
-    curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-arm64.tar.gz" | sudo tar -C /usr/local -xzf -
-    echo 'export PATH=$PATH:/usr/local/go/bin' >> ~/.bashrc
-    export PATH=$PATH:/usr/local/go/bin
+    archive=$(mktemp)
+    curl -fsSL "https://go.dev/dl/go${GO_VERSION}.linux-arm64.tar.gz" -o "$archive"
+    sudo rm -rf /usr/local/go
+    sudo tar -C /usr/local -xzf "$archive"
+    rm -f "$archive"
+    echo 'export PATH=/usr/local/go/bin:$PATH' >> ~/.bashrc
+    export PATH=/usr/local/go/bin:$PATH
     echo "Go ${GO_VERSION} installed"
 fi