Build gosu with a supported version of GO

[jhawkins1]

Go 1.18.x is deprecated and is not receiving functional or vulnerability fixes. Are there plans to update gosu to be built with a supported version of GO (1.20 and 1.21 are the current supported releases as of the date of this issue). If not, I would like to request via this issue that gosu change to build with a newer GO.

[tianon]

If there is a functional or security change in a newer release of Go that's actually relevant to gosu's tiny code paths, I'd be happy to update, but I haven't seen one yet. 😅

(see also https://github.com/tianon/gosu/blob/master/SECURITY.md)

[jhawkins1]

gosu is being pulled in by our usage of the standard Cassandra Image as part of our SaaS solution.

We have a requirement that End-of-Life Software cannot be used. We are getting flagged by gosu due to its usage of a deprecated (EOLed) version of GO. So, either we work with the gosu project to update; get Cassandra to do a custom build and not pull gosu directly from gosu releases, or we fork Cassandra Image build to do custom build ourselves. I was hoping we could work with you or convince you to do an update of gosu itself to avoid the complexities of the other paths. Others that use gosu in an environment where EOL software is forbidden are going to have this same issue :)

[tianon]

Well, gosu is definitely not EOL. 😅

It's also kind of a huge stretch for any tooling to claim that you're "using" Go 1.18 just because your build of gosu happens to have been compiled against it, especially when compiling it against a newer version does absolutely nothing for any possible supported or unsupported usage of the tool -- effectively it just updates a string inside the binary from the text "1.18" to the text "1.21". 🙈

If I were in your position, I'd be pushing back on that tooling for making such strong and generally unsound/incorrect assumptions about what "EOL" means, especially in the context of the compiler version of pre-built published binaries (this applies to binaries from Debian or Ubuntu or Red Hat every bit as much as binaries downloaded from the releases pages of projects on GitHub). 😇

[erickpeirson]

@jhawkins1 We've encountered the same issues using the official Redis images. For a while we forked gosu and addressed these issues ourselves, but that recently hit the end of viability so we've simply removed gosu from the images entirely.

This may be useful (if less than satisfying) context: #131

[petiepooo]

If I were in your position, I'd be pushing back on that tooling for making such strong and generally unsound/incorrect assumptions about what "EOL" means...

Have you tried pushing back against government security bureaucracies? They're managed by people who can't spell EOL, but are convinced it's bad because it ends with L...

[petiepooo]

Take for example Redmine 5.1.1, the latest version released as of this posting. Going to the docker hub page for the app shows a total of 117 vulnerabilities, including 2 critical and 28 high, all of which are attributed to stdlib 1.18.2, which is pulled in as a dependency because someone wanted what gosu provides.

Is it easier to push back against the dozens of tool makers, research every one of those 30 listed as critical and high, plus 11 of the 16 medium, to definitively prove it isn't applicable (or take your word for it), patch gosu ourselves, possibly forking it and releasing as a more current alternative, and ask dependent projects to use my fork instead of yours, or ask that you please take the half-day it would take you to update your build environment and rebuild using a currently supported version of go?

I know you don't owe us freeloaders anything, but when a high majority of flagged issues can all be traced back to "I haven't seen a real vulnerability yet and I can't be bothered to update my build environment," then yes, this project gets classified as abandonware.

Hence this. If your goal to reduce the number of projects that depend on gosu, it's working quite well.

[dev-nulled]

Similar ask, for a Golang version update to 1.21. We are having to fork or remove gosu from the Redis packages because of the EOL versions of Golang and some of the dependencies it is bringing into images. Your code is lovely - the issue is Golang.

An update to the version gosu is building against would be a godsend.

[AlexanderYastrebov]

effectively it just updates a string inside the binary from the text

This is not true, go compiler and runtime updates incorporate a lot of performance improvements and bug fixes (not necessary vulnerabilities).

Official go policy only supports last two major versions https://go.dev/doc/devel/release#policy and encourages to update it periodically. Go1.18 is therefore not supported anymore. In practice this means that you can not open go issues for the application, the go team will ask to upgrade runtime and then come back if the issue persists.

[AlexanderYastrebov]

Another reason for upgrade is to simplify build process, e.g. golang/go#56426 was fixed in go1.20

gosu/Dockerfile

Lines 12 to 15 in b73cc93

	# https://github.com/golang/go/issues/56426
	RUN set -eux; \
	wget -O /tmp/go-mips.patch 'https://github.com/golang/go/commit/2c7c98c3ad719aa9d6d2594827a6894ff9950042.patch'; \
	patch --strip=1 --directory=/usr/local/go --input=/tmp/go-mips.patch

[dev-nulled]

@tianon Thank you. The update is huge and much appreciated.

[DrJJ]

@tianon any idea when 1.18 with go 1.20.5 will be released?

The Infosec team from one of our large customers is freaking out about the official redis image being flagged critical by Google GKE Security Posture. The redis image is using gosu 1.17.

I understand that this Critical is a false positive, but try to explain that to a large Enterprise, that they do not have to worry about that docker image being flagged Critical by Google.

[liozzazhang]

it's not a big deal to rebuild Gosu with a higher Go version, right? Any warm discussion here implies Gosu is a really powerful and wildly-used tool. we'll all appreciate it if the team can upgrade the underlying Go version. @tianon or could you guide us on how to rebuild it by ourselves? Any comments will be appreciated.