ci: build gotip into boulder-tools (#8801)

This installs `gotip` alongside the numbered $GO_VERSION. When running
tests with BOULDER_CONFIG_DIR=test/config-next, startservers.py now
invokes:

    make GO=gotip

This commit also changes our Makefile to accomodate overriding the name
of the Go binary.

The `boulder-mtca` subcommand, `mtca` package, and `genmtpki` package
are all gated on the [build constraint] go1.27, which is satisfied when
running under gotip as of the time of writing. These packages don't yet
add support for mldsa keys, which will come in a followup PR.

Alternatives considered: I considered having tag_and_upload treat
`gotip` as a special token and build a separate container with `gotip`
in it. This wound up messy for various reasons. Probably the chief
reason not to do it is that it explodes our CI matrix further. By
deciding that we use gotip exactly when
BOULDER_CONFIG_DIR=test/config-next, we can keep the matrix somewhat
under control.

Fixes #8787

[build constraint]: https://pkg.go.dev/cmd/go#hdr-Build_constraints

Author: jsha

.github/workflows/boulder-ci.yml

@@ -36,7 +36,7 @@ jobs:
       matrix:
         # Add additional docker image tags here and all tests will be run with the additional image.
         BOULDER_TOOLS_TAG:
-          - go1.26.3_2026-05-22
+          - go1.26.3_2026-06-15
         # Tests command definitions. Use the entire "docker compose" command you want to run.
         tests:
           # Run ./test.sh --help for a description of each of the flags.

Makefile

@@ -7,6 +7,8 @@ VERSION ?= 1.0.0
 EPOCH ?= 1
 MAINTAINER ?= "Community"
 
+GO ?= go
+
 # TODO(#8410): Remove pardot-test-srv when we've fully migrated to
 # salesforce-test-srv.
 CMDS = admin boulder ceremony ct-test-srv salesforce-test-srv pardot-test-srv chall-test-srv zendesk-test-srv
@@ -44,7 +46,7 @@ bin/pardot-test-srv: bin/salesforce-test-srv
 
 build_cmds: | $(OBJDIR)
 	echo $(OBJECTS)
-	GOBIN=$(OBJDIR) go install -mod=vendor $(GO_BUILD_FLAGS) ./...
+	GOBIN=$(OBJDIR) $(GO) install -mod=vendor $(GO_BUILD_FLAGS) ./...
 
 # Building a .deb requires `fpm` from https://github.com/jordansissel/fpm
 # which you can install with `gem install fpm`.

cmd/boulder-mtca/main.go

@@ -1,3 +1,5 @@
+//go:build go1.27
+
 package notmain
 
 import (

cmd/boulder/main.go

@@ -7,8 +7,6 @@ import (
 
 	_ "github.com/letsencrypt/boulder/cmd/bad-key-revoker"
 	_ "github.com/letsencrypt/boulder/cmd/boulder-ca"
-	_ "github.com/letsencrypt/boulder/cmd/boulder-mtca"
-	_ "github.com/letsencrypt/boulder/cmd/boulder-mtpublisher"
 	_ "github.com/letsencrypt/boulder/cmd/boulder-observer"
 	_ "github.com/letsencrypt/boulder/cmd/boulder-publisher"
 	_ "github.com/letsencrypt/boulder/cmd/boulder-ra"

cmd/boulder/main_next.go

@@ -0,0 +1,8 @@
+//go:build go1.27
+
+package main
+
+import (
+	_ "github.com/letsencrypt/boulder/cmd/boulder-mtca"
+	_ "github.com/letsencrypt/boulder/cmd/boulder-mtpublisher"
+)

mtca/mtca.go

@@ -1,3 +1,5 @@
+//go:build go1.27
+
 package mtca
 
 import (

test/boulder-tools/Dockerfile

@@ -10,6 +10,12 @@ ENV PATH=/usr/local/go/bin:/usr/local/protoc/bin:$PATH
 ENV GOBIN=/usr/local/bin/
 RUN curl "https://dl.google.com/go/go${GO_VERSION}.$(echo $TARGETPLATFORM | sed 's|\/|-|').tar.gz" |\
     tar -C /usr/local -xz
+# Regardless of GO_VERSION, also install gotip from the latest main.
+# This is temporary until Go 1.27 is released, to give us access to the
+# crypto/mldsa package. See startservers.py and test/certs/generate.sh
+# for uses of gotip.
+RUN /usr/local/go/bin/go install golang.org/dl/gotip@latest
+RUN gotip download
 RUN go install github.com/rubenv/sql-migrate/sql-migrate@v1.1.2
 RUN go install google.golang.org/protobuf/cmd/protoc-gen-go@v1.36.5
 RUN go install google.golang.org/grpc/cmd/protoc-gen-go-grpc@v1.5.1
@@ -46,6 +52,8 @@ RUN sed -i '/$RepeatedMsgReduction on/s/^/#/' /etc/rsyslog.conf
 
 COPY --from=godeps /usr/local/bin/* /usr/local/bin/
 COPY --from=godeps /usr/local/go/ /usr/local/go/
+# Downloaded packages from gotip
+COPY --from=godeps /root/sdk/ /root/sdk/
 COPY --from=rustdeps /usr/local/cargo/bin/typos /usr/local/bin/typos
 
 ENV PATH=/usr/local/go/bin:/usr/local/protoc/bin:$PATH

test/certs/generate.sh

@@ -61,9 +61,7 @@ ipki() (
 webpki() (
   # Because it invokes the ceremony tool, webpki.go expects to be invoked with
   # the root of the boulder repo as the current working directory.
-  # This function executes in a subshell, so this cd does not affect the parent
-  # script.
-  make build
+  GOBIN=$PWD/bin/ go install ./cmd/ceremony
   mkdir -p ./test/certs/webpki
   go run ./test/certs/webpki.go
 )
@@ -81,5 +79,5 @@ fi
 if ! [ -d test/certs/mtpki ]; then
   echo "Generating mtpki/..."
   mkdir -p test/certs/mtpki
-  go run ./test/certs/genmtpki/genmtpki.go
+  gotip run ./test/certs/genmtpki/genmtpki.go
 fi

test/certs/genmtpki/genmtpki.go

@@ -1,3 +1,5 @@
+//go:build go1.27
+
 package main
 
 import (