Go version used in Clair

[Iain Duncan]

Hi,
We're just looking to upgrade Clair to the latest version.  We use the go-toolset (https://catalog.redhat.com/software/containers/rhel8/go-toolset/5b9c810add19c70b45cbd666?container-tabs=overview) provided by RedHat to install and then use the Clair and claircore packages within our application.
The go-toolset has a tendency to be a little behind the latest version of Go but both Clair and Claircore have started using Go 1.20 features quite quickly after its release and have bumped their go.mod entries to 1.20.  This means that we cannot run Clair within a go-toolset container.

For future Go updates would it be possible to wait until the go-toolset version has caught up with the Go releases before moving the version of Go required up?

Thanks,

Iain

[Hank Donnay]

Hello,

As a project, we don't have an official version policy. So far, we've
kept support for in-support upstream versions whenever possible.

In this case, the reason for the quick move to 1.20 was to work around a
bug in `debug/elf` (see 292f70ab1a, https://go.dev/issue/33121).
Since the version in the `go.mod` file doesn't preclude using earlier
toolchains, we used 1.20 features to force the issue.

With the RHEL release cycle determining the Go toolchain verison shipped
in `go-toolset` and the two projects' release cycles being out of sync,
we're not going to commit, as an upstream, to keeping it buildable on
the Red Hat `go-toolset`.

--
hank

[Iain Duncan]

Thanks for the info Hank.  I understand that it is hard to commit to keeping in sync with another projects release cycle.  Sadly moving forward it is going to be one that our team have to manage as we won't be able to pick up the Clair updates until go-toolset releases at the required versions are available.  Hopefully there won't be too many more critical bug fixes that require an urgent jump forward for Clair!

Cheers,

Iain