Skip to content

[backport v1.6] fix: bumping Go version to 1.24.13 #4342

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
behzad-mir wants to merge 1 commit into
base: release/v1.6
Choose a base branch
from
Open

[backport v1.6] fix: bumping Go version to 1.24.13 #4342

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
21 changes: 12 additions & 9 deletions .pipelines/build/binary.steps.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,34 +10,37 @@ parameters:


steps:
- task: GoTool@0
- task: ShellScript@2
displayName: "Install msft-go"
inputs:
version: '$(GOVERSION)'
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-go.sh
env:
name: $(name)
Comment on lines +13 to +18
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

install-go.sh relies on crane, but this template no longer installs it (unlike images.jobs.yaml). As-is, binary builds will fail with crane: command not found. Add an Install crane step before Install msft-go (or otherwise guarantee crane is present).

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The Install msft-go step sets env.name from $(name), but this template already receives the intended value as ${{ parameters.target }}. Using the outer variable makes the template brittle and can break if $(name) isn’t defined in a consuming job; pass ${{ parameters.target }} to install-go.sh instead.

Suggested change
name: $(name)
name: ${{ parameters.target }}

Copilot uses AI. Check for mistakes.

- bash: |
# Ubuntu
if [[ -f /etc/debian_version ]];then
sudo apt-get update -y
if [[ $GOARCH =~ amd64 ]]; then
sudo apt-get install -y llvm clang linux-libc-dev linux-headers-generic libbpf-dev libc6-dev nftables iproute2 gcc-multilib tree
for dir in /usr/include/x86_64-linux-gnu/*; do
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
for dir in /usr/include/x86_64-linux-gnu/*; do
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
done

elif [[ $GOARCH =~ arm64 ]]; then
sudo apt-get install -y llvm clang linux-libc-dev linux-headers-generic libbpf-dev libc6-dev nftables iproute2 gcc-aarch64-linux-gnu tree
for dir in /usr/include/aarch64-linux-gnu/*; do
for dir in /usr/include/aarch64-linux-gnu/*; do
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
done
fi
# Mariner
else
sudo tdnf install -y llvm clang libbpf-devel nftables tree
for dir in /usr/include/aarch64-linux-gnu/*; do
for dir in /usr/include/aarch64-linux-gnu/*; do
if [[ -d $dir ]]; then
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
sudo ln -sfn "$dir" /usr/include/$(basename "$dir")
elif [[ -f "$dir" ]]; then
sudo ln -Tsfn "$dir" /usr/include/$(basename "$dir")
sudo ln -Tsfn "$dir" /usr/include/$(basename "$dir")
fi
done
fi
Expand Down
18 changes: 13 additions & 5 deletions .pipelines/build/images.jobs.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,9 +49,17 @@ jobs:
targetPath: $(REPO_ROOT)
artifact: '${{ job_data.templateContext.repositoryArtifact }}'

- task: GoTool@0
- task: ShellScript@2
displayName: "Install crane"
inputs:
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-crane.sh

- task: ShellScript@2
displayName: "Install msft-go"
inputs:
version: '$(GOVERSION)'
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/install-go.sh
env:
name: $(name)

- task: ShellScript@2
inputs:
Expand All @@ -76,15 +84,15 @@ jobs:
- task: ShellScript@2
displayName: "Package with DropGZ"
condition: and(
succeeded(),
succeeded(),
eq(variables.packageWithDropGZ, 'True'))
inputs:
scriptPath: $(REPO_ROOT)/.pipelines/build/scripts/dropgz.sh

- ${{ if not(contains(job_data.job, 'linux')) }}:
- task: onebranch.pipeline.signing@1
condition: and(
succeeded(),
succeeded(),
eq(variables.packageWithDropGZ, 'True'))
inputs:
command: 'sign'
Expand All @@ -94,7 +102,7 @@ jobs:

# OneBranch artifacts are stored on a Windows machine which obliterates
# Linux file permissions.
# This task is added (along with ob_extract_root_artifact in jobs that
# This task is added (along with ob_extract_root_artifact in jobs that
# download the artifact) to protect those file permissions from changing
# during image build time.
#
Expand Down
13 changes: 13 additions & 0 deletions .pipelines/build/scripts/install-crane.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,13 @@
#!/bin/bash
set -eux

# Install crane (google/go-containerregistry) for daemonless container image extraction.
# crane can pull and export image filesystems without a Docker daemon.
# Go is pre-installed in the build container, so we use go install.
# Rely on go install for supply chain security and reproducibility
if ! command -v crane &> /dev/null; then
go install github.com/google/go-containerregistry/cmd/crane@v0.21.3
sudo mv "$(go env GOPATH)/bin/crane" /usr/local/bin/crane
fi

crane version
56 changes: 56 additions & 0 deletions .pipelines/build/scripts/install-go.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,56 @@
#!/bin/bash
set -eux

Comment on lines +1 to +3
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

install-go.sh uses a crane export | tar pipeline but doesn’t enable pipefail, which can mask failures in earlier pipeline stages in other edits (and makes debugging harder). Prefer set -euo pipefail (keeping -x if desired) and adjust resolve_go_image pipelines accordingly.

Copilot uses AI. Check for mistakes.
Copy link
Copy Markdown
Contributor Author

@behzad-mir behzad-mir Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@jpayne3506 do we need to add pipefail to prevent masking the failure here?

Copy link
Copy Markdown
Contributor

@jpayne3506 jpayne3506 Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think that is a good catch that we should add.

# Install Go by extracting it from the msft-go container image.
# The golang image reference is read directly from the source Dockerfile for the
# current image (identified by $name), keeping the pipeline in sync with the build.
#
# Priority:
# 1. MSFT_GO_IMAGE env var (explicit override)
# 2. Parsed from the source Dockerfile for $name
# 3. Hardcoded fallback digest below
#
# To update the fallback, run:
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0 --format "{{.Name}}@{{.Digest}}"
DEFAULT_IMAGE="mcr.microsoft.com/oss/go/microsoft/golang@sha256:b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2"

Comment on lines +13 to +16
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The update instructions here use golang:1.24-cbl-mariner2.0, but the PR intent is Go 1.24.13. Consider updating the comment to the full patch tag to avoid accidentally pinning a digest for a different 1.24.x patch when refreshing DEFAULT_IMAGE.

Copilot uses AI. Check for mistakes.
# Resolves the golang image from the source Dockerfile for the given $name.
# Echoes the image reference, or empty string if it cannot be determined.
resolve_go_image() {
if [[ "${name:-}" == "npm" ]]; then
# npm uses OS-specific Dockerfiles with a tag-based reference.
# The image may be field 2 (no --platform) or field 3 (with --platform),
# so extract the mcr.* token directly.
# e.g. FROM mcr.../golang:1.25.5 AS builder
# e.g. FROM --platform=linux/amd64 mcr.../golang:1.25.5 AS builder
local buildfile="${REPO_ROOT}/npm/${OS:-linux}.Dockerfile"
grep -m1 '^FROM.*golang' "${buildfile}" | grep -o 'mcr[^ ]*'
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

With set -e enabled, the npm branch will exit the script if the Dockerfile doesn’t contain a matching FROM.*golang line (the grep | grep pipeline returns non-zero), preventing the documented fallback to DEFAULT_IMAGE. Make resolve_go_image tolerant of no-match/missing files (e.g., || true and/or conditional checks) so the fallback logic actually works.

Suggested change
grep -m1 '^FROM.*golang' "${buildfile}" | grep -o 'mcr[^ ]*'
if [[ -f "${buildfile}" ]]; then
grep -m1 '^FROM.*golang' "${buildfile}" | grep -o 'mcr[^ ]*' || true
fi

Copilot uses AI. Check for mistakes.

else
# All other images use a digest-pinned reference and always have --platform,
# making the image consistently field 3: FROM --platform=X IMAGE AS alias
local buildfile
if [[ "${name:-}" == "ipv6-hp-bpf" ]]; then
buildfile="${REPO_ROOT}/bpf-prog/ipv6-hp-bpf/linux.Dockerfile"
elif [[ -n "${name:-}" ]]; then
buildfile="${REPO_ROOT}/${name}/Dockerfile"
fi

if [[ -n "${buildfile:-}" && -f "${buildfile}" ]]; then
grep -m1 '^FROM.*golang' "${buildfile}" | awk '{print $3}'
fi
fi
}

if [[ -z "${MSFT_GO_IMAGE:-}" ]]; then
MSFT_GO_IMAGE="$(resolve_go_image)"
MSFT_GO_IMAGE="${MSFT_GO_IMAGE:-$DEFAULT_IMAGE}"
fi

ARCH="${ARCH:-amd64}"

# Extract /usr/local/go from the image without needing a Docker daemon.
# crane export streams the full image filesystem; we extract just usr/local/go.
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Before extracting the new Go toolchain, consider removing any existing /usr/local/go directory. Untarring over an existing installation can leave stale files from the previous version if paths were removed/renamed upstream.

Suggested change
# crane export streams the full image filesystem; we extract just usr/local/go.
# crane export streams the full image filesystem; we extract just usr/local/go.
# Remove any existing Go installation first to avoid stale files from older versions.
sudo rm -rf /usr/local/go

Copilot uses AI. Check for mistakes.
crane export --platform "linux/${ARCH}" "$MSFT_GO_IMAGE" - | sudo tar -xf - -C / usr/local/go

echo "##vso[task.prependpath]/usr/local/go/bin"
4 changes: 2 additions & 2 deletions azure-ipam/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,8 +3,8 @@ ARG DROPGZ_VERSION=v0.0.12
ARG OS_VERSION
ARG OS

# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.23.2-cbl-mariner2.0 --format "{{.Name}}@{{.Digest}}"
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:f8613198423d5cb702961f1547f9cb061f8da1c6ca9ce8da4824eb47db663cd7 AS go
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0 --format "{{.Name}}@{{.Digest}}"
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2 AS go
Comment thread
behzad-mir marked this conversation as resolved.

# skopeo inspect docker://mcr.microsoft.com/cbl-mariner/base/core:2.0 --format "{{.Name}}@{{.Digest}}"
FROM --platform=linux/${ARCH} mcr.microsoft.com/cbl-mariner/base/core@sha256:a490e0b0869dc570ae29782c2bc17643aaaad1be102aca83ce0b96e0d0d2d328 AS mariner-core
Expand Down
4 changes: 2 additions & 2 deletions bpf-prog/ipv6-hp-bpf/linux.Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
ARG ARCH
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.23.2 --format "{{.Name}}@{{.Digest}}"
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:86c5b00bbed2a6e7157052d78bf4b45c0bf26545ed6e8fd7dbad51ac9415f534 AS builder
# skopeo inspect docker://mcr.microsoft.com/oss/go/microsoft/golang:1.24 --format "{{.Name}}@{{.Digest}}"
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:f3e556c9de4dd93be774dc0fa2ce3cfa76f7744d0bacada92d1624f04ce69461 AS builder
Comment on lines +2 to +3
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This Dockerfile now pins a digest, but the guidance comment uses the floating golang:1.24 tag. Since the PR’s goal is a specific Go patch (1.24.13) for CVE remediation, update the comment (and, if needed, the pinned digest) to reference the exact patch tag so future updates remain deterministic.

Copilot uses AI. Check for mistakes.
ARG VERSION
ARG DEBUG
ARG OS
Expand Down
2 changes: 1 addition & 1 deletion build/images.mk
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
# Source images
export GO_IMG ?= mcr.microsoft.com/oss/go/microsoft/golang:1.23-cbl-mariner2.0
export GO_IMG ?= mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The PR description/title says Go is being bumped to 1.24.13, but GO_IMG is set to ...:1.24-cbl-mariner2.0 here. Using the floating 1.24 tag can silently move to later patch versions and makes the intended CVE remediation version ambiguous; set this to the full patch tag (e.g., 1.24.13-cbl-mariner2.0) to match the PR intent.

Copilot uses AI. Check for mistakes.
export MARINER_CORE_IMG ?= mcr.microsoft.com/cbl-mariner/base/core:2.0
export MARINER_DISTROLESS_IMG ?= mcr.microsoft.com/cbl-mariner/distroless/minimal:2.0
export WIN_HPC_IMG ?= mcr.microsoft.com/oss/kubernetes/windows-host-process-containers-base-image:v1.0.0
Expand Down
4 changes: 2 additions & 2 deletions cni/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,8 +5,8 @@ ARG DROPGZ_VERSION=v0.0.12
ARG OS_VERSION
ARG OS

# mcr.microsoft.com/oss/go/microsoft/golang:1.23-cbl-mariner2.0
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:1d8a3fc8df13298bab0d6ea34f49ded3641fd60985c7968518717e965edaef99 AS go
# mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2 AS go
Comment thread
behzad-mir marked this conversation as resolved.
Comment thread
behzad-mir marked this conversation as resolved.
Comment on lines +8 to +9
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Same as cns/Dockerfile: the comment/tag reference is ...:1.24-cbl-mariner2.0 while the PR intent is Go 1.24.13. Updating the comment to the full patch tag would keep the documented source of the pinned digest accurate/reproducible.

Copilot uses AI. Check for mistakes.

# mcr.microsoft.com/cbl-mariner/base/core:2.0
FROM --platform=linux/${ARCH} mcr.microsoft.com/cbl-mariner/base/core@sha256:61b8c8e5c769784be2137cba8612c3a0f0c1752a66276b3b1b5306014a1e20e0 AS mariner-core
Expand Down
4 changes: 2 additions & 2 deletions cns/Dockerfile
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -4,8 +4,8 @@ ARG ARCH
ARG OS_VERSION
ARG OS

# mcr.microsoft.com/oss/go/microsoft/golang:1.23-cbl-mariner2.0
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:1d8a3fc8df13298bab0d6ea34f49ded3641fd60985c7968518717e965edaef99 AS go
# mcr.microsoft.com/oss/go/microsoft/golang:1.24-cbl-mariner2.0
FROM --platform=linux/${ARCH} mcr.microsoft.com/oss/go/microsoft/golang@sha256:b05a9bbf50a8ccfdd0ebe9f673ef29dca7c1d5e209434b35a560a4e8ae5f72b2 AS go
Comment thread
behzad-mir marked this conversation as resolved.
Comment thread
behzad-mir marked this conversation as resolved.
Comment on lines +7 to +8
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The comment/tag reference was updated to ...:1.24-cbl-mariner2.0, but the PR claims the bump is to Go 1.24.13. Consider updating this comment to the full patch tag used to obtain the digest (so future skopeo inspect commands are reproducible and match the CVE-fix version).

Copilot uses AI. Check for mistakes.

# mcr.microsoft.com/cbl-mariner/base/core:2.0
FROM mcr.microsoft.com/cbl-mariner/base/core@sha256:61b8c8e5c769784be2137cba8612c3a0f0c1752a66276b3b1b5306014a1e20e0 AS mariner-core
Expand Down
Loading