sa: check for sql.ErrNoRows on Get() (#8732)

This pulls in the latest borp, including
letsencrypt/borp#13, which makes `Get()` return
`sql.ErrNoRows` instead of a `nil` object.

This fixes the lagFactor check in `sa.GetAuthorization2`, which was
expecting `sql.ErrNoRows` but never received it (because `Get()` was
returning `nil, nil`). `GetAuthorization2` is not touched in this PR
because we're updating the dependency to match its existing behavior.

Change the behavior of all the other SA calls to `Get()` to look for
`sql.ErrNoRows` instead of `obj == nil`.

Author: jsha

go.mod

@@ -15,7 +15,7 @@ require (
 	github.com/google/certificate-transparency-go v1.3.2-0.20250507091337-0eddb39e94f8
 	github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1
 	github.com/jmhodges/clock v1.2.0
-	github.com/letsencrypt/borp v0.0.0-20251118150929-89c6927051ae
+	github.com/letsencrypt/borp v0.0.0-20260428182343-7962eada420f
 	github.com/letsencrypt/challtestsrv v1.4.2
 	github.com/letsencrypt/pkcs11key/v4 v4.0.1
 	github.com/letsencrypt/validator/v10 v10.0.0-20230215210743-a0c7dfc17158

go.sum

@@ -151,8 +151,8 @@ github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
 github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
 github.com/kylelemons/godebug v1.1.0 h1:RPNrshWIDI6G2gRW9EHilWtl7Z6Sb1BR0xunSBf0SNc=
 github.com/kylelemons/godebug v1.1.0/go.mod h1:9/0rRGxNHcop5bhtWyNeEfOS8JIWk580+fNqagV/RAw=
-github.com/letsencrypt/borp v0.0.0-20251118150929-89c6927051ae h1:yFuF5yRIwaandcuNMi1A4he4FMWJsGRv38rsizIaxJA=
-github.com/letsencrypt/borp v0.0.0-20251118150929-89c6927051ae/go.mod h1:gMSMCNKhxox/ccR923EJsIvHeVVYfCABGbirqa0EwuM=
+github.com/letsencrypt/borp v0.0.0-20260428182343-7962eada420f h1:ka12vhO0JLDmdER25Wrzdp3fHNi2SpCoIEGOELIR2I0=
+github.com/letsencrypt/borp v0.0.0-20260428182343-7962eada420f/go.mod h1:gMSMCNKhxox/ccR923EJsIvHeVVYfCABGbirqa0EwuM=
 github.com/letsencrypt/challtestsrv v1.4.2 h1:0ON3ldMhZyWlfVNYYpFuWRTmZNnyfiL9Hh5YzC3JVwU=
 github.com/letsencrypt/challtestsrv v1.4.2/go.mod h1:GhqMqcSoeGpYd5zX5TgwA6er/1MbWzx/o7yuuVya+Wk=
 github.com/letsencrypt/pkcs11key/v4 v4.0.1 h1:XIXFxOnQJS5QYBlMnHhnlOBVcfylh7m3fjOJmVcEV88=

sa/saro.go

@@ -350,12 +350,12 @@ func (ssa *SQLStorageAuthorityRO) GetOrder(ctx context.Context, req *sapb.OrderR
 
 	txn := func(tx db.Executor) (any, error) {
 		omObj, err := tx.Get(ctx, orderModel{}, req.Id)
+		if errors.Is(err, sql.ErrNoRows) {
+			return nil, berrors.NotFoundError("no order found for ID %d", req.Id)
+		}
 		if err != nil {
 			return nil, err
 		}
-		if omObj == nil {
-			return nil, berrors.NotFoundError("no order found for ID %d", req.Id)
-		}
 
 		order, err := modelToOrder(omObj.(*orderModel))
 		if err != nil {
@@ -537,12 +537,12 @@ func (ssa *SQLStorageAuthorityRO) GetAuthorization2(ctx context.Context, req *sa
 			ssa.lagFactorCounter.WithLabelValues("GetAuthorization2", "found").Inc()
 		}
 	}
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, berrors.NotFoundError("authorization %d not found", req.Id)
+	}
 	if err != nil {
 		return nil, err
 	}
-	if obj == nil {
-		return nil, berrors.NotFoundError("authorization %d not found", req.Id)
-	}
 	return modelToAuthzPB(*(obj.(*authzModel)))
 }
 
@@ -583,13 +583,13 @@ func (ssa *SQLStorageAuthorityRO) GetOrderAuthorizations(ctx context.Context, re
 	}
 
 	om, err := ssa.dbReadOnlyMap.Get(ctx, &orderModel{}, req.Id)
-	if err != nil {
-		return nil, err
-	}
 	// Nonexistent orders should return no error, with an empty list of authorizations
-	if om == nil {
+	if errors.Is(err, sql.ErrNoRows) {
 		return &sapb.Authorizations{}, nil
 	}
+	if err != nil {
+		return nil, err
+	}
 
 	order, err := modelToOrder(om.(*orderModel))
 	if err != nil {

vendor/github.com/letsencrypt/borp/README.md

@@ -211,7 +211,7 @@ github.com/grpc-ecosystem/grpc-gateway/v2/utilities
 # github.com/jmhodges/clock v1.2.0
 ## explicit; go 1.17
 github.com/jmhodges/clock
-# github.com/letsencrypt/borp v0.0.0-20251118150929-89c6927051ae
+# github.com/letsencrypt/borp v0.0.0-20260428182343-7962eada420f
 ## explicit; go 1.20
 github.com/letsencrypt/borp
 # github.com/letsencrypt/challtestsrv v1.4.2