Stop bumping go directive unless necessitated by other dependencies

[kaovilai]

This repo by itself should not be enforcing minimum on other repositories importing it. Stop spreading "minimum virus"

toolchain version used will be defined outside of go.mod ideally, such as by installing a newer compatible go toolchain to ci/cd/development env.

Failing that, toolchain directive should be used instead of go directive for bumping versions to not cascade minimum versions to importing dependencies.

toolchain directive, in contrast to the go directive, applies only to the current module (the one defined by the go.mod file). It suggests the toolchain to be used when in that very module, and doesn't propagate to other modules.

High profile repos that have removed/reduced minimum go patch version per user requests

• deps: Remove Go minor version from go.mods grpc/grpc-go#7831 motivation

Being proactive to prevent following from reoccuring

• deps: Remove Go patch version from go.mods kopia/kopia#4292
• Do not set minimum go toolchain version in release branches. vmware-tanzu/velero#8397
• Bump github.com/vmware-tanzu/velero from 1.14.0 to 1.15.0 kubevirt/kubevirt-velero-plugin#292 (comment)
• Stop bumping go directive unless necessitated by other dependencies sdk#147

[kaovilai]

@kaovilai ➜ /workspaces/apko (main) $ go mod graph | grep [email protected]
chainguard.dev/apko [email protected]
chainguard.dev/[email protected] [email protected]
chainguard.dev/[email protected] [email protected]
[email protected] [email protected]
k8s.io/[email protected] [email protected]
sigs.k8s.io/[email protected] [email protected]

Nothing in this repo necessitated 1.23.1. In fact, it is shown that the lowest required by other deps is 1.23.1 as required by chainguard.dev/[email protected]

[xnox]

Often there are CVEs in the standard library and the only way to enforce remediation of them in any builds is to bump the version number.

At Chainguard, we do no support building binaries with known CVEs.

[kaovilai]

The standard libraries used to build are based on toolchain setting. go directive is the wrong way to go because it affects importing modules.

golang/go#70853 (comment)

Please see https://go.dev/doc/toolchain#:~:text=Go%20toolchain%20selection%C2%B6

go mod's go directive is the wrong way to go.

If your ci system lacks ability to specify the correct go version to use outside of go.mod file (my preference), use toolchain directive instead please.

[kaovilai]

You do not have to build binaries with known CVEs AND force importing dependencies (those outside of chainguard) to have higher minimum versions.

Everyone including the importing modules can fix standard library CVEs through go cli updates etc WITHOUT commiting change to go.mod file.