chore: update Go to v1.27 (#39068)

Only made some necessary changes:

1. remove `GOEXPERIMENT`, only use jsonv2
1. `make fmt`
* `SigningKey` and `Signature` were affected due to some bugs in the
toolchain, so rewrote them
1. remove or fix fragile magic numbers and strings
    * the outputs of image/gzip/zlib packages are different
1. update "nolint" comments for the changed lint behaviors
1. add `tls.MLKEM1024`

modules/avatar/hash.go

@@ -9,20 +9,12 @@ import (
 	"strconv"
 )
 
-// HashAvatar will generate a unique string, which ensures that when there's a
-// different unique ID while the data is the same, it will generate a different
-// output. It will generate the output according to:
-// HEX(HASH(uniqueID || - || data))
-// The hash being used is SHA256.
-// The sole purpose of the unique ID is to generate a distinct hash Such that
-// two unique IDs with the same data will have a different hash output.
-// The "-" byte is important to ensure that data cannot be modified such that
-// the first byte is a number, which could lead to a "collision" with the hash
-// of another unique ID.
+// HashAvatar generates a unique string for input ID and data.
+// Because avatar is per-user, one user deletes their avatar should not affect another user who uses the same avatar.
 func HashAvatar(uniqueID int64, data []byte) string {
 	h := sha256.New()
 	h.Write([]byte(strconv.FormatInt(uniqueID, 10)))
-	h.Write([]byte{'-'})
+	h.Write([]byte{'-'}) // make sure the bytes in data won't conflict with ID
 	h.Write(data)
 	return hex.EncodeToString(h.Sum(nil))
 }

modules/avatar/hash_test.go

@@ -4,9 +4,6 @@
 package avatar_test
 
 import (
-	"bytes"
-	"image"
-	"image/png"
 	"testing"
 
 	"gitea.dev/modules/avatar"
@@ -15,12 +12,9 @@ import (
 )
 
 func Test_HashAvatar(t *testing.T) {
-	myImage := image.NewRGBA(image.Rect(0, 0, 32, 32))
-	var buff bytes.Buffer
-	png.Encode(&buff, myImage)
-
-	assert.Equal(t, "9ddb5bac41d57e72aa876321d0c09d71090c05f94bc625303801be2f3240d2cb", avatar.HashAvatar(1, buff.Bytes()))
-	assert.Equal(t, "9a5d44e5d637b9582a976676e8f3de1dccd877c2fe3e66ca3fab1629f2f47609", avatar.HashAvatar(8, buff.Bytes()))
-	assert.Equal(t, "ed7399158672088770de6f5211ce15528ebd675e92fc4fc060c025f4b2794ccb", avatar.HashAvatar(1024, buff.Bytes()))
+	buf := []byte{1, 2}
+	assert.Equal(t, "057b0e5aa7ef2504b886951f1355b3386130992bc867cb00c16babcc441571da", avatar.HashAvatar(1, buf))
+	assert.Equal(t, "18a4a808c40d70ed532b6f19dfe7b8732eeb727e375c87a9944fde7555de285c", avatar.HashAvatar(8, buf))
+	assert.Equal(t, "5265546b79c483b2c399bba1df5746f77bba7145bb9f53b7b9c6b0fb57dc25eb", avatar.HashAvatar(1024, buf))
 	assert.Equal(t, "161178642c7d59eb25a61dddced5e6b66eae1c70880d5f148b1b497b767e72d9", avatar.HashAvatar(1024, []byte{}))
 }

modules/git/key.go

@@ -54,24 +54,16 @@ func GetSigningKey(ctx context.Context) (*SigningKey, *Signature) {
 			return nil, nil
 		}
 
-		return &SigningKey{
-				KeyID:  strings.TrimSpace(signingKey),
-				Format: strings.TrimSpace(format),
-			}, &Signature{
-				Name:  strings.TrimSpace(signingName),
-				Email: strings.TrimSpace(signingEmail),
-			}
+		sigKey := &SigningKey{KeyID: strings.TrimSpace(signingKey), Format: strings.TrimSpace(format)}
+		sig := &Signature{Name: strings.TrimSpace(signingName), Email: strings.TrimSpace(signingEmail)}
+		return sigKey, sig
 	}
 
 	if setting.Repository.Signing.SigningKey == "" {
 		return nil, nil
 	}
 
-	return &SigningKey{
-			KeyID:  setting.Repository.Signing.SigningKey,
-			Format: setting.Repository.Signing.SigningFormat,
-		}, &Signature{
-			Name:  setting.Repository.Signing.SigningName,
-			Email: setting.Repository.Signing.SigningEmail,
-		}
+	sigKey := &SigningKey{KeyID: setting.Repository.Signing.SigningKey, Format: setting.Repository.Signing.SigningFormat}
+	sig := &Signature{Name: setting.Repository.Signing.SigningName, Email: setting.Repository.Signing.SigningEmail}
+	return sigKey, sig
 }

modules/json/jsonlegacy.go

@@ -1,25 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-//go:build !goexperiment.jsonv2
-
-package json
-
-import (
-	"encoding/json" //nolint:depguard // this package wraps it
-	"io"
-)
-
-func getDefaultJSONHandler() Interface {
-	return jsonV1{}
-}
-
-func MarshalKeepOptionalEmpty(v any) ([]byte, error) {
-	return DefaultJSONHandler.Marshal(v)
-}
-
-func NewDecoderCaseInsensitive(reader io.Reader) Decoder {
-	return DefaultJSONHandler.NewDecoder(reader)
-}
-
-type Value = json.RawMessage

modules/json/jsonv1.go

@@ -1,38 +0,0 @@
-// Copyright 2025 The Gitea Authors. All rights reserved.
-// SPDX-License-Identifier: MIT
-
-package json
-
-import (
-	"bytes"
-	"encoding/json" //nolint:depguard // this package wraps it
-	"io"
-)
-
-type jsonV1 struct{}
-
-var _ Interface = jsonV1{}
-
-func (jsonV1) Marshal(v any) ([]byte, error) {
-	return json.Marshal(v)
-}
-
-func (jsonV1) MarshalWrite(w io.Writer, v any) error {
-	return json.NewEncoder(w).Encode(v)
-}
-
-func (jsonV1) Unmarshal(data []byte, v any) error {
-	return json.Unmarshal(data, v)
-}
-
-func (jsonV1) NewEncoder(writer io.Writer) Encoder {
-	return json.NewEncoder(writer)
-}
-
-func (jsonV1) NewDecoder(reader io.Reader) Decoder {
-	return json.NewDecoder(reader)
-}
-
-func (jsonV1) Indent(dst *bytes.Buffer, src []byte, prefix, indent string) error {
-	return json.Indent(dst, src, prefix, indent)
-}

modules/json/jsonv2.go

@@ -1,8 +1,6 @@
 // Copyright 2025 The Gitea Authors. All rights reserved.
 // SPDX-License-Identifier: MIT
 
-//go:build goexperiment.jsonv2
-
 package json
 
 import (
@@ -13,8 +11,6 @@ import (
 	"io"
 )
 
-// JSONv2 implements Interface via encoding/json/v2
-// Requires GOEXPERIMENT=jsonv2 to be set at build time
 type JSONv2 struct {
 	marshalOptions                  jsonv2.Options
 	marshalKeepOptionalEmptyOptions jsonv2.Options

modules/packages/alpine/metadata_test.go

@@ -95,8 +95,8 @@ func TestParsePackage(t *testing.T) {
 		p, err := ParsePackage(data)
 		assert.NoError(t, err)
 		assert.NotNil(t, p)
-
-		assert.Equal(t, "Q1SRYURM5+uQDqfHSwTnNIOIuuDVQ=", p.FileMetadata.Checksum)
+		// FIXME: the logic is strange in ParsePackage, need to figure out how to calculate the checksum correctly
+		assert.Equal(t, "Q1GfcV5dUrPr1xIRekqPYGehdxjL8=", p.FileMetadata.Checksum)
 	})
 
 	t.Run("TooManyDependencyEntries", func(t *testing.T) {

modules/setting/config_env.go

@@ -125,7 +125,7 @@ func EnvironmentToConfig(cfg ConfigProvider, envs []string) (changed bool) {
 		}
 
 		// use environment value as config value, or read the file content as value if the key indicates a file
-		keyValue := envValue //nolint:staticcheck // false positive
+		keyValue := envValue
 		if useFileValue {
 			fileContent, err := os.ReadFile(envValue)
 			if err != nil {