chore(build): build images with Go 1.26.6 - #536
Merged
Conversation
The dev and micro-dev stages build the shipped init binary. Both still used Go 1.26.5, which carries six stdlib findings. The vrnetlab test builder used the same pin. Go 1.26.6 fixes GO-2026-5026, GO-2026-5972, GO-2026-6089, GO-2026-6090, GO-2026-6091 and GO-2026-6218.
MaxRink
added a commit
that referenced
this pull request
Aug 19, 2026
* fix(build): retry network downloads in container builds One transient TLS failure on a mirror broke the whole arm64 initramfs build and with it CI on main. The LVM2 wget had no retry. Every network fetch now retries with backoff. apt-get uses Acquire::Retries, curl uses --retry, wget uses --tries. apk add, git clone, git fetch and go mod download use an until loop that exits non-zero once the attempts run out. Checksum and signature checks stay in place, so a retry cannot hide a corrupt artifact. A new guard test fails the build when a fetch carries no retry, or when a retry loop cannot fail. * chore(build): build images with Go 1.26.6 (#536) The dev and micro-dev stages build the shipped init binary. Both still used Go 1.26.5, which carries six stdlib findings. The vrnetlab test builder used the same pin. Go 1.26.6 fixes GO-2026-5026, GO-2026-5972, GO-2026-6089, GO-2026-6090, GO-2026-6091 and GO-2026-6218.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Stacked on #535. The base is
fix/initramfs-download-retries, so this diff shows only the toolchain bump. Merge #535 first. When #535 lands, GitHub retargets this PR tomainautomatically.#532 bumped Go to 1.26.6 in the workflows, but not in the images. The
devandmicro-devstages ofinitrd.Dockerfilebuild the shipped BOOTy init binary, and both still used 1.26.5. This is not test-only.Changed:
initrd.Dockerfiledevstage, 1.26.5-alpine to 1.26.6-alpine, builds the init for the full, slim and gobgp flavoursinitrd.Dockerfilemicro-devstage, 1.26.5-bookworm to 1.26.6-bookworm, builds the init for the micro flavourtest/e2e/clab/vrnetlab/Dockerfilebuilder, 1.26.5-alpine to 1.26.6-alpine1.26.6 is the current 1.26.x patch. I checked the Go release feed and the Docker Hub tags.
Left alone on purpose:
booty-test.Dockerfileandbooty-gobgp-test.Dockerfileuse the floatinggolang:1.26-alpine, so they already resolve to 1.26.6 and need no churn.go.moddeclares the language versiongo 1.26and carries notoolchaindirective, so it needs no change.Verified locally with docker:
--target devbuilds, reportsgo version go1.26.6 linux/amd64, and produces the init binary--target micro-devbuilds on 1.26.6 and produces the init binaryoperation not permittedon the tmpfs mount without root. That also proves the UPX-compressed binary unpacks and runs.go test .passesgovulncheck against the source, run inside each image:
golang:1.26.5-alpine, 7 findings, the six stdlib ones plus GO-2026-4736golang:1.26.6-alpine, 1 finding, GO-2026-4736 onlyGO-2026-4736 is the GoBGP denial of service. Upstream reports no fixed version and
hack/check-govulncheck.pyalready allows it.