[go1.25.2] Edge case breaking SAN validation issue #6289
Description
Contributing guidelines and issue reporting guide
- I've read the contributing guidelines and wholeheartedly agree. I've also read the issue reporting guide.
Well-formed report checklist
- I have found a bug that the documentation does not mention anything about my problem
- I have found a bug that there are no open or closed issues that are related to my problem
- I have provided version/information about my environment and done my best to provide a reproducer
Description of bug
Bug description
The latest version includes a breaking change from upstream go that introduces stricter SSL SAN name validations, including now failing vaildations for SANs with trailing dots or where thier SAN DNS name is longer than 63 characters, as per:
In this case this broke communication with our upstream minio server, for which the minio-operator generates a certificate with a 73 character san as part of the atomated certificate generation.
The upstream go maintainers will be rolling back the stricter validations with the next release of go on Novemberr 4th 2025 or potentially will do an eariler patch release.
In the meantime, the buildx maintainers may want to consider making a release against an older version of go, and this issue should at least be left open so others don't have to spend as long as I did trying to track this down.
Version information
buildkitd github.com/moby/buildkit 7cf577a 7cf577a2f736ced2fa453226f3f2bb5f83648e85