Use cached Go 1.26.6 from nixpkgs

RELEASING.md

@@ -157,9 +157,9 @@ make update-nix-hash
 The PR-time `nix-build` job fails on every dependency bump by design — dependabot
 does not update `vendorHash` — and prints the correct hash with that command.
 
-`nix/package.nix` rebuilds Go from the upstream source tarball while
-nixpkgs-unstable lags `go.mod`'s toolchain (`minGo`). After a `nix flake update`
-that brings nixpkgs level, delete that block.
+`nix/go.nix` selects the Go toolchain from the locked nixpkgs snapshot for both
+the package and development shell. When `go.mod` moves beyond that snapshot,
+run `nix flake update nixpkgs` and commit `flake.lock` with the toolchain bump.
 
 ## CLI surface compatibility
 

nix/go.nix

@@ -1,28 +1,10 @@
-{ lib, fetchurl, go_1_26 }:
+{ go_1_26 }:
 
 # The Go toolchain shared by the package build and the dev shell.
 #
-# go.mod's `go` directive is the floor; nixpkgs-unstable lagged it at 1.26.5
-# when this flake was written, so the toolchain is rebuilt from the upstream
-# source tarball until nixpkgs catches up. The override is conditional and
-# drops itself once go_1_26 reaches 1.26.6 — delete this file's override and
-# return go_1_26 directly after a `nix flake update` that makes
-# `lib.versionOlder` false. Keep minGo in step with go.mod: a toolchain bump
-# that outpaces flake.lock breaks the build without touching go.mod or go.sum,
-# which is why the nix-build CI job runs on every go.mod change and on tags.
-#
-# Both consumers must use this one derivation. The dev shell once listed
-# go_1_26 directly, which handed `nix develop` a Go older than go.mod's
-# directive — `make build` then failed under GOTOOLCHAIN=local or offline.
-let
-  minGo = "1.26.6";
-in
-if lib.versionOlder go_1_26.version minGo
-then go_1_26.overrideAttrs (_: {
-  version = minGo;
-  src = fetchurl {
-    url = "https://go.dev/dl/go${minGo}.src.tar.gz";
-    hash = "sha256-oHIcVMaIkBRI13rZs+x+p8R0cwdV/4kTgukuy5P/LLE=";
-  };
-})
-else go_1_26
+# Both consumers use this one derivation so the package and `nix develop`
+# cannot drift. flake.lock temporarily selects a NixOS 26.05 snapshot because
+# nixpkgs-unstable still carried Go 1.26.5 when 1.26.6 landed; a normal lock
+# update can return to unstable once it catches up. The nix-build CI job covers
+# every go.mod change and every release tag, so a regression fails closed.
+go_1_26

scripts/extract-nix-vendor-hash.sh

@@ -18,11 +18,11 @@
 # - Matching a bare `got:` is far too loose: any failing build whose log happens
 #   to contain one — a Go test assertion printing `got: 42`, say — would yield
 #   "42" as a vendorHash and misreport an unrelated failure as a hash problem.
-# - Accepting any fixed-output mismatch is also too loose. This flake has a
-#   second fixed-output derivation — the Go source tarball nix/go.nix fetches
-#   while nixpkgs lags go.mod — and a stale hash there must not be written
-#   into vendorHash, nor reported to a contributor as the vendorHash remedy.
-#   The rebuild would then fail with nix/package.nix already corrupted.
+# - Accepting any fixed-output mismatch is also too loose. This flake used to
+#   carry a second one — the Go source tarball needed while nixpkgs lagged
+#   go.mod — and its hash must not be written into vendorHash or reported as
+#   the vendorHash remedy. The rebuild would then fail with nix/package.nix
+#   already corrupted.
 #
 # Exit codes:
 #   0 — a go-modules fixed-output hash mismatch was reported; the SRI hash is

tests/e2e/extract_nix_vendor_hash.bats

@@ -89,10 +89,9 @@ LOG
 }
 
 @test "rejects a mismatch in a fixed-output derivation that is not go-modules" {
-  # This flake carries a second fixed-output derivation: the Go source tarball
-  # nix/go.nix fetches while nixpkgs lags go.mod. A stale hash there is a
-  # nix/go.nix problem; writing it into vendorHash corrupts the tracked file and
-  # then fails the verification rebuild anyway.
+  # A source-toolchain workaround used to add a second fixed-output derivation.
+  # Keep the classifier scoped to go-modules: writing any other derivation's
+  # hash into vendorHash corrupts the tracked file and fails the rebuild.
   run "$EXTRACT" <<'LOG'
 error: hash mismatch in fixed-output derivation '/nix/store/abc-go1.26.6.src.tar.gz.drv':
          specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=

tests/e2e/update_nix_flake.bats

@@ -116,10 +116,10 @@ NIX_BUILD_EXIT=1"
 }
 
 @test "does not write the Go source tarball's hash into vendorHash" {
-  # nix/go.nix fetches the Go source with its own fixed-output hash. When that
-  # one is stale, the remedy is in go.nix; the classifier must not hand its
-  # `got:` to this script, which would corrupt package.nix and then fail the
-  # verification rebuild.
+  # nix/go.nix used to fetch Go from source while nixpkgs lagged go.mod. Keep
+  # proving that a non-vendor fixed-output failure cannot hand its `got:` to
+  # this script, which would corrupt package.nix and fail the verification
+  # rebuild.
   stub_docker "error: hash mismatch in fixed-output derivation '/nix/store/abc-go1.26.6.src.tar.gz.drv':
          specified: sha256-AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA=
             got:    sha256-BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBB=