Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

SECURITY: Upgrade Golang for STRETCH, drop support for JESSIE #277

Open
thebeline opened this issue Mar 29, 2021 · 0 comments
Open

SECURITY: Upgrade Golang for STRETCH, drop support for JESSIE #277

thebeline opened this issue Mar 29, 2021 · 0 comments

Comments

@thebeline
Copy link
Contributor

A lot has changed since golang1.9 and 1.8. These are nearly 4 years old, and there have been MANY security and performance fixes since these versions.

It is extremely advisable to upgrade the golang version for STRETCH to the latest available golang1.15 and drop support for JESSIE.

Golang only supports the two most recent releases, golang1.9 reached EOL on 2018/08/24, and golang1.8 reached EOL on 2018/02/16 (just a few months after the initial release of this project.

Debian dropped LTS for JESSIE on June 30, 2020, and will drop LTS for STRETCH on June 30, 2022 (we have plenty of time).

Raspbian's last JESSIE release was on 2017-07-05, and it's last STRETCH release was on 2019-04-08

Docker removed all Debian JESSIE packages from their official lists on Feb 16, 2018
(Removal commit: docker-library/official-images@1f144d4#diff-262b5154873802fd4abff07283ae9bd83663325957229799a17e8262a5268b27)

We advise users to install on fresh systems, which at this time would guarantee a Debian BUSTER environment, however some users may not comply, and therefore supporting STRETCH is not a terrible idea, so long as we can ensure we are using an up-to-date golang.

Unfortunately, the current official Raspbian images only ship with golang1.11, however, since we use a Docker build process, we can use the latest Docker golang image, so golang support can be handled there.

  • The Docker images for STRETCH and BUSTER both have golang1.15 images, and we should use those images.
  • We should drop support for JESSIE, as is it vanishingly likely that anyone will be using a Raspbian release from prior to 2017-08-17 (first STRETCH-based release).

This Issue would be resolved by: #270

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant