Update to go v1.24.0

[michel-laterman]

What is the problem this PR solves?

Update to go v1.24.0, change golang.org/x/crypto/pbkdf2 to crypto/pbkdf2

Design Checklist

• I have ensured my design is stateless and will work when multiple fleet-server instances are behind a load balancer.
• I have or intend to scale test my changes, ensuring it will work reliably with 100K+ agents connected.
• I have included fail safe mechanisms to limit the load on fleet-server: rate limiting, circuit breakers, caching, load shedding, etc.

Checklist

• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in ./changelog/fragments using the changelog tool

[v1v]

We just merged a fix for the 1.23.6 using the native support for aarch64 when running the golang-crossbuild. I wonder whether we can keep this open for a bit, and get some validations so artifacts are in a good shape with the change.

[simitt]

We just merged a fix for the 1.23.6 using the native support for aarch64 when running the golang-crossbuild. I wonder whether we can keep this open for a bit, and get some validations so artifacts are in a good shape with the change.

@v1v how long would you suggest to wait and observe? This is currently blocking FIPS related work and we should aim for not loosing too much time.

[v1v]

how long would you suggest to wait and observe?

I don't know; I'd expect if people didn't see any misbehaviour in the DRA artifacts , we are safe to merge, however I'm not familiar with the testing strategy in this project for the generated DRA artifacts.

As far as I see DRA artefacts for fleet-server@main have not been generated for already 3 weeks:

• https://github.com/elastic/fleet-server/commits/e8a0bb4d313b820d8d82ff9725901a18f68d240f is the last commit

Why? I don't know, this is new to me

@dliappis helped me to understand that DRA artefacts are not generated because the main build is broken!

This build was the latest successful build.

However, c83472b is when things stopped working:

[v1v]

Update here!
I've just found that I wrongly assumed fleet-server uses the golang-crossbuild for the packaging, but it's not. It uses the native go build commands:

• fleet-server/Makefile

  Lines 260 to 267 in 2c04d3d

  	.PHONY: $(PLATFORM_TARGETS)
  	$(PLATFORM_TARGETS): release-%:
  	$(eval $@_OS := $(firstword $(subst /, ,$(lastword $(subst release-, ,$@)))))
  	$(eval $@_GO_ARCH := $(lastword $(subst /, ,$(lastword $(subst release-, ,$@)))))
  	$(eval $@_ARCH := $(TARGET_ARCH_$($@_GO_ARCH)))
  	$(eval $@_BUILDMODE:= $(BUILDMODE_$($@_OS)_$($@_GO_ARCH)))
  	GOOS=$($@_OS) GOARCH=$($@_GO_ARCH) ${GOFIPSEXPERIMENT} go build -tags=${GOBUILDTAGS} -gcflags="${GCFLAGS}" -ldflags="${LDFLAGS}" $($@_BUILDMODE) -o build/binaries/fleet-server-$(VERSION)-$($@_OS)-$($@_ARCH)$(FIPSSUFFIX)/fleet-server .
  	@$(MAKE) OS=$($@_OS) ARCH=$($@_ARCH) package-target

There are some references for the golang-crossbuild in the dockerimage:

• https://github.com/elastic/fleet-server/blob/main/Dockerfile.build#L3

Therefore, this is unblocked from my side and sorry for being to cautious here!

[jlind23]

This PR is failing with

gvm: error: unknown version 1.24
--
  | .buildkite/scripts/common.sh: line 48: go: command not found

But according to the latest from andrewkroh/gvm@cb99f14 1.24.0 should be available 🤔

[jlind23]

buildkite test it

[jlind23]

@michel-laterman shouldn't we go straight to 1.24.1 then?

[jlind23]

Removing my approval as CI is legitimately broken.

Dismiss as CI is failing

[elastic-sonarqube]

Quality Gate passed

Issues
0 New issues
0 Fixed issues
0 Accepted issues

Measures
0 Security Hotspots
57.1% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube