build: upgrade Go to 1.23.11, add s390x performance patches

* [ ] Adjust the Pebble tests to run in new version.
* [ ] Update [our `go` fork](https://github.com/cockroachdb/go) with a new branch containing our patches. Create a new branch `cockroach-go$GO_VERSION` and take note of the commit ID.
* [ ] Update `build/teamcity/internal/release/build-and-publish-patched-go/commit.txt` with the commit ID in the `go` fork.
* [ ] Update `build/teamcity/internal/release/build-and-publish-patched-go/impl.sh` with the new `GOVERS` and adjust SHA256 sums as necessary.
* [ ] Adjust `GO_FIPS_COMMIT` for the FIPS Go toolchain ([source](./teamcity/internal/release/build-and-publish-patched-go/impl-fips.sh)).
* [ ] Run the `Internal / Cockroach / Build / Toolchains / Publish Patched Go for Mac` build configuration in TeamCity with your latest version of the script above. Note the job depends on another job `Build and Publish Patched Go`. That job prints out the SHA256 of all tarballs, which you will need to copy-paste into `WORKSPACE` (see below). `Publish Patched Go for Mac` is an extra step that publishes the *signed* `go` binaries for macOS. That job also prints out the SHA256 of the Mac tarballs in particular.
* [ ] Adjust `--@io_bazel_rules_go//go/toolchain:sdk_version` in [.bazelrc](../.bazelrc).
* [ ] Bump the version in `WORKSPACE` under `go_download_sdk`. You may need to bump [rules_go](https://github.com/bazelbuild/rules_go/releases). Also edit the filenames listed in `sdks` and update all the hashes to match what you built in the step above.
* [ ] Bump the version in `WORKSPACE` under `go_download_sdk` for the FIPS version of Go (`go_sdk_fips`).
* [ ] Upgrade golang.org/x packages; these are maintained by the Go project and it's reasonable to upgrade them when doing our Go upgrade. Run `grep -e '^\tgolang.org/x' go.mod | grep -v vcs | grep -v image | grep -v typeparams | cut -w -f2 | sed 's/$/@latest/' | xargs go get`. (Note: we don't upgrade certain libraries that are not linked into CRDB, hence the `grep -v`.)
* [ ] Run `./dev generate bazel --mirror`, then `bazel fetch @distdir//:archives` to ensure you've updated all hashes to the correct value.
* [ ] Bump the go version in `go.mod`.
* [ ] Bump the default installed version of Go in `bootstrap-debian.sh` ([source](./bootstrap/bootstrap-debian.sh)).
* [ ] Replace other mentions of the older version of go (grep for `golang:<old_version>` and `go<old_version>`).

Release justification: Consume security fixes to go toolchain as well as s390x performance fixes
Epic: none
Part of: DEVINF-1535
Release note: Upgrade to Go 1.23.11

Author: rickystewart

.bazelrc

@@ -100,7 +100,7 @@ build:crosslinuxfips '--workspace_status_command=./build/bazelutil/stamp.sh -t x
 build:crosslinuxfips --config=crosslinuxfipsbase
 build:crosslinuxfipsbase --platforms=//build/toolchains:cross_linux
 build:crosslinuxfipsbase --config=cross
-build:crosslinuxfipsbase --@io_bazel_rules_go//go/toolchain:sdk_version=1.23.7fips
+build:crosslinuxfipsbase --@io_bazel_rules_go//go/toolchain:sdk_version=1.23.11fips
 build:crosswindows '--workspace_status_command=./build/bazelutil/stamp.sh -t x86_64-w64-mingw32'
 build:crosswindows --config=crosswindowsbase
 build:crosswindowsbase --platforms=//build/toolchains:cross_windows

WORKSPACE

@@ -167,15 +167,15 @@ load(
 go_download_sdk(
     name = "go_sdk",
     sdks = {
-        "darwin_amd64": ("go1.23.7.darwin-amd64.tar.gz", "d26ec0c7ce5975a334b1c343de8eb7aa8777fac278440cc2204b76eab867b3ef"),
-        "darwin_arm64": ("go1.23.7.darwin-arm64.tar.gz", "3c1ab410d0828951cddde4959b72ef33aedbce8e3c8aa9c76cc4a094043fef43"),
-        "linux_amd64": ("go1.23.7.linux-amd64.tar.gz", "b69a06004491883f176b0ec600a7efbb3ec9450561653d8f509fc10d43176492"),
-        "linux_arm64": ("go1.23.7.linux-arm64.tar.gz", "4b0922c371650ec1fda259f41abc98412abf149b8d358daa5e5bc7c553bc6e52"),
-        "linux_s390x": ("go1.23.7.linux-s390x.tar.gz", "25f0cb7d7683cd9df1e194852a1856ac905be5c001759bab7862dad7aedc626d"),
-        "windows_amd64": ("go1.23.7.windows-amd64.tar.gz", "265efcbe685b3737f317c52e13eaa444bc205ad6a5e676f59d229ec4dc5821d1"),
+        "darwin_amd64": ("go1.23.11.darwin-amd64.tar.gz", "7139176cc006fc2f798fd5527a9c601dffe281c2cf63080934a318d3c424f3fd"),
+        "darwin_arm64": ("go1.23.11.darwin-arm64.tar.gz", "efc9a6724b17624a0888ef407398ac82da4eb4d6da3717532645fade19ffa709"),
+        "linux_amd64": ("go1.23.11.linux-amd64.tar.gz", "5f38c94984ff94d551e2c7fb8afac1d9e3bd9c3276d6f2b8dae1c07a2da7007d"),
+        "linux_arm64": ("go1.23.11.linux-arm64.tar.gz", "69e5e5aca3e105c0cfa8ed024117e54c9c23b9848d470a95d3df946ae63a9fc3"),
+        "linux_s390x": ("go1.23.11.linux-s390x.tar.gz", "5beff97b93c78389cbdef2321ee8a0bcafdba25056168674dd12fb07882069c3"),
+        "windows_amd64": ("go1.23.11.windows-amd64.tar.gz", "d20428242b278d1bc1761d9f8cdc052b468e3e03bd6f7c01cfc507475231e02a"),
     },
-    urls = ["https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/{}"],
-    version = "1.23.7",
+    urls = ["https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/{}"],
+    version = "1.23.11",
 )
 
 # To point to a local SDK path, use the following instead. We'll call the
@@ -659,8 +659,8 @@ go_download_sdk(
     # able to provide additional diagnostic information such as the expected version of OpenSSL.
     experiments = ["boringcrypto"],
     sdks = {
-        "linux_amd64": ("go1.23.7fips.linux-amd64.tar.gz", "f7bb32b36090ba9e632a7ee9fa414214c79a2d1b0be609ac12975b448d973961"),
+        "linux_amd64": ("go1.23.11fips.linux-amd64.tar.gz", "23f69e799bdcf8244e23d21692b5bf49a3beb8e8a5493e3a1052f65705be2474"),
     },
-    urls = ["https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/{}"],
-    version = "1.23.7fips",
+    urls = ["https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/{}"],
+    version = "1.23.11fips",
 )

build/bazelutil/distdir_files.bzl

@@ -1208,13 +1208,13 @@ DISTDIR_FILES = {
     "https://storage.googleapis.com/public-bazel-artifacts/c-deps/20241202-211651/libproj_foreign.macos.20241202-211651.tar.gz": "b0a672f24748c24c941884c04413fd8e20afd6bca95e0451f3cfb15dd2cc1eb9",
     "https://storage.googleapis.com/public-bazel-artifacts/c-deps/20241202-211651/libproj_foreign.macosarm.20241202-211651.tar.gz": "a35706bf0112e9652d6e41501113ee0f0f392b67e495979c867f71f17cf6ce7e",
     "https://storage.googleapis.com/public-bazel-artifacts/c-deps/20241202-211651/libproj_foreign.windows.20241202-211651.tar.gz": "a33b64a784e856dbb3c84a52075227c48f0ff52a858639c3737a8911201d0c65",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/go1.23.7.darwin-amd64.tar.gz": "d26ec0c7ce5975a334b1c343de8eb7aa8777fac278440cc2204b76eab867b3ef",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/go1.23.7.darwin-arm64.tar.gz": "3c1ab410d0828951cddde4959b72ef33aedbce8e3c8aa9c76cc4a094043fef43",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/go1.23.7.linux-amd64.tar.gz": "b69a06004491883f176b0ec600a7efbb3ec9450561653d8f509fc10d43176492",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/go1.23.7.linux-arm64.tar.gz": "4b0922c371650ec1fda259f41abc98412abf149b8d358daa5e5bc7c553bc6e52",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/go1.23.7.linux-s390x.tar.gz": "25f0cb7d7683cd9df1e194852a1856ac905be5c001759bab7862dad7aedc626d",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/go1.23.7.windows-amd64.tar.gz": "265efcbe685b3737f317c52e13eaa444bc205ad6a5e676f59d229ec4dc5821d1",
-    "https://storage.googleapis.com/public-bazel-artifacts/go/20250714-192942/go1.23.7fips.linux-amd64.tar.gz": "f7bb32b36090ba9e632a7ee9fa414214c79a2d1b0be609ac12975b448d973961",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/go1.23.11.darwin-amd64.tar.gz": "7139176cc006fc2f798fd5527a9c601dffe281c2cf63080934a318d3c424f3fd",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/go1.23.11.darwin-arm64.tar.gz": "efc9a6724b17624a0888ef407398ac82da4eb4d6da3717532645fade19ffa709",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/go1.23.11.linux-amd64.tar.gz": "5f38c94984ff94d551e2c7fb8afac1d9e3bd9c3276d6f2b8dae1c07a2da7007d",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/go1.23.11.linux-arm64.tar.gz": "69e5e5aca3e105c0cfa8ed024117e54c9c23b9848d470a95d3df946ae63a9fc3",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/go1.23.11.linux-s390x.tar.gz": "5beff97b93c78389cbdef2321ee8a0bcafdba25056168674dd12fb07882069c3",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/go1.23.11.windows-amd64.tar.gz": "d20428242b278d1bc1761d9f8cdc052b468e3e03bd6f7c01cfc507475231e02a",
+    "https://storage.googleapis.com/public-bazel-artifacts/go/20250728-204441/go1.23.11fips.linux-amd64.tar.gz": "23f69e799bdcf8244e23d21692b5bf49a3beb8e8a5493e3a1052f65705be2474",
     "https://storage.googleapis.com/public-bazel-artifacts/java/railroad/rr-1.63-java8.zip": "d2791cd7a44ea5be862f33f5a9b3d40aaad9858455828ebade7007ad7113fb41",
     "https://storage.googleapis.com/public-bazel-artifacts/js/rules_jest-v0.18.4.tar.gz": "d3bb833f74b8ad054e6bff5e41606ff10a62880cc99e4d480f4bdfa70add1ba7",
     "https://storage.googleapis.com/public-bazel-artifacts/js/rules_js-v1.42.3.tar.gz": "2cfb3875e1231cefd3fada6774f2c0c5a99db0070e0e48ea398acbff7c6c765b",

build/bootstrap/bootstrap-debian.sh

@@ -45,9 +45,9 @@ sudo tar -C /usr --strip-components=1 -zxf /tmp/cmake.tgz && rm /tmp/cmake.tgz
 
 # Install Go.
 trap 'rm -f /tmp/go.tgz' EXIT
-curl -fsSL https://dl.google.com/go/go1.23.7.linux-amd64.tar.gz >/tmp/go.tgz
+curl -fsSL https://dl.google.com/go/go1.23.11.linux-amd64.tar.gz >/tmp/go.tgz
 sha256sum -c - <<EOF
-4741525e69841f2e22f9992af25df0c1112b07501f61f741c12c6389fcb119f3  /tmp/go.tgz
+80899df77459e0b551d2eb8800ad6eb47023b99cccbf8129e7b5786770b948c5  /tmp/go.tgz
 EOF
 sudo tar -C /usr/local -zxf /tmp/go.tgz && rm /tmp/go.tgz
 

build/teamcity/internal/release/build-and-publish-patched-go/commit.txt

@@ -1 +1 @@
-4eca4292cae8f25b834db7001ff25284b1f9ccfa
+1885f636683f838d9dab4a27c196bea2eb065c02

build/teamcity/internal/release/build-and-publish-patched-go/impl.sh

@@ -9,12 +9,12 @@
 set -xeuo pipefail
 
 # When updating to a new Go version, update all of these variables.
-GOVERS=1.23.7
+GOVERS=1.23.11
 GOCOMMIT=$(grep -v ^# /bootstrap/commit.txt | head -n1)
 # We use this for bootstrapping (this is NOT re-published). Note the version
 # matches the version we're publishing, although it doesn't technically have to.
 GOLINUXLINK=https://go.dev/dl/go$GOVERS.linux-amd64.tar.gz
-LINUXSHASUM=4741525e69841f2e22f9992af25df0c1112b07501f61f741c12c6389fcb119f3
+LINUXSHASUM=80899df77459e0b551d2eb8800ad6eb47023b99cccbf8129e7b5786770b948c5
 
 apt-get update
 DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends \

go.mod

@@ -1,6 +1,6 @@
 module github.com/cockroachdb/cockroach
 
-go 1.23.7
+go 1.23.11
 
 // golang.org/x/* packages are maintained and curated by the go project, just
 // without the backwards compatibility promises the standard library, and thus

pkg/cmd/roachtest/tests/cdc.go

@@ -4143,7 +4143,7 @@ const createMSKTopicBinPath = "/tmp/create-msk-topic"
 var setupMskTopicScript = fmt.Sprintf(`
 #!/bin/bash
 set -e -o pipefail
-wget https://go.dev/dl/go1.23.7.linux-amd64.tar.gz -O /tmp/go.tar.gz
+wget https://go.dev/dl/go1.23.11.linux-amd64.tar.gz -O /tmp/go.tar.gz
 sudo rm -rf /usr/local/go
 sudo tar -C /usr/local -xzf /tmp/go.tar.gz
 echo export PATH=$PATH:/usr/local/go/bin >> ~/.profile