Skip to content

Commit 7b27fbc

Browse files
josvazgjosvazg
authored
CLOUDP-346332: Bump Go to 1.25.3 via flake (#2825)
* Bump Go to 1.25.3 via flake Signed-off-by: jose.vazquez <[email protected]> * Add doc on go flake support * Fix typos --------- Signed-off-by: jose.vazquez <[email protected]>
1 parent 9834d03 commit 7b27fbc

File tree

8 files changed

+176
-57
lines changed

8 files changed

+176
-57
lines changed

‎devbox.json‎

Lines changed: 2 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,6 @@
33
"yq-go": "latest",
44
"kubebuilder": "4.1.1",
55
"jq": "latest",
6-
"go": "latest",
76
"gotests": "latest",
87
"act": "latest",
98
"kubectl": "latest",
@@ -29,9 +28,9 @@
2928
"addlicense": "latest",
3029
"fd": "latest",
3130
"apple-sdk_12": {
32-
"name": "sdk_12",
3331
"version": "latest",
3432
"platforms": ["aarch64-darwin", "x86_64-darwin"]
35-
}
33+
},
34+
"path:./flakes/go": {}
3635
}
3736
}

‎devbox.lock‎

Lines changed: 2 additions & 50 deletions
Original file line numberDiff line numberDiff line change
@@ -650,56 +650,8 @@
650650
}
651651
},
652652
"github:NixOS/nixpkgs/nixpkgs-unstable": {
653-
"last_modified": "2025-10-20T04:25:18Z",
654-
"resolved": "github:NixOS/nixpkgs/87848bf0cc4f87717fc813a4575f07330c3e743c?lastModified=1760934318&narHash=sha256-%2FoUYsC0lUCBory65VK%2BUHqCCsCspbL1Vgfcf1KUYqVw%3D"
655-
},
656-
"go@latest": {
657-
"last_modified": "2025-10-07T08:41:47Z",
658-
"resolved": "github:NixOS/nixpkgs/bce5fe2bb998488d8e7e7856315f90496723793c#go",
659-
"source": "devbox-search",
660-
"version": "1.25.1",
661-
"systems": {
662-
"aarch64-darwin": {
663-
"outputs": [
664-
{
665-
"name": "out",
666-
"path": "/nix/store/mkdfnr1nkfj2kznxyag9pypbxp3wqqdv-go-1.25.1",
667-
"default": true
668-
}
669-
],
670-
"store_path": "/nix/store/mkdfnr1nkfj2kznxyag9pypbxp3wqqdv-go-1.25.1"
671-
},
672-
"aarch64-linux": {
673-
"outputs": [
674-
{
675-
"name": "out",
676-
"path": "/nix/store/0jzj8p7k9wkr4l17sgrlg3z5di27sggf-go-1.25.1",
677-
"default": true
678-
}
679-
],
680-
"store_path": "/nix/store/0jzj8p7k9wkr4l17sgrlg3z5di27sggf-go-1.25.1"
681-
},
682-
"x86_64-darwin": {
683-
"outputs": [
684-
{
685-
"name": "out",
686-
"path": "/nix/store/q2xylk8h3kbfajhw2lpdmyzyyqgqx8fl-go-1.25.1",
687-
"default": true
688-
}
689-
],
690-
"store_path": "/nix/store/q2xylk8h3kbfajhw2lpdmyzyyqgqx8fl-go-1.25.1"
691-
},
692-
"x86_64-linux": {
693-
"outputs": [
694-
{
695-
"name": "out",
696-
"path": "/nix/store/f01qkydd3c2jqwi4w6hkddkf3blp16kw-go-1.25.1",
697-
"default": true
698-
}
699-
],
700-
"store_path": "/nix/store/f01qkydd3c2jqwi4w6hkddkf3blp16kw-go-1.25.1"
701-
}
702-
}
653+
"last_modified": "2025-10-20T13:06:07Z",
654+
"resolved": "github:NixOS/nixpkgs/cb82756ecc37fa623f8cf3e88854f9bf7f64af93?lastModified=1760965567&narHash=sha256-0JDOal5P7xzzAibvD0yTE3ptyvoVOAL0rcELmDdtSKg%3D"
703655
},
704656
"golangci-lint@2": {
705657
"last_modified": "2025-10-07T08:41:47Z",

‎flakes/go/README.md‎

Lines changed: 52 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,52 @@
1+
# Custom Go Nix Flake
2+
3+
## Why a flake?
4+
5+
Nix tends to be several minor versions behind Go's official releases.
6+
7+
This posses challenges in two situations:
8+
9+
1. When Go moves to a new major version
10+
1. When Go has a vulnerability on the current latest Nix version, fixed by a newer official release
11+
12+
For major versions it is usually fine to wait for Nix to have a major version compilation available for devbox to use. This is because, no matter how early we may want to upgrade, many go tools we depend on, such as license checking or linting or Kubernetes libraries such as `controller-runtime`, usually need some time to catch up with the major release anyways. By the time they support the new major version, there is usually a Nix compilation of the new Go release, at least in the unstable channel.
13+
14+
For minor versions, it can be more problematic. If the latest Nix available release is compromised, it might take a few days or weeks for the new version to become available in Nix. On the other hand, Go only marks a vulnerable release after releasing the fixed version.
15+
16+
In other words, we need to be able to move to the latest Go release as needed, specially to avoid vulnerabilities within the same major version.
17+
18+
## How
19+
20+
The current flake in this directory will download and install the pre-compiled binaries straight from https://go.dev/dl, that is the official Go downloads site. It only supports 2 platforms:
21+
- `x86_64-linux` for the CI and Linux developers.
22+
- `aarch64-darwin` for developers working on MacOS.
23+
24+
The flake derivation does not build anything, just unpacks and places the binaries where expected to be used by the resulting flake.
25+
26+
## Updating
27+
28+
The flake is pinned to a particular Go point release. To bump the downloaded binary you have to:
29+
30+
1. Bump the `goVersion` variable. E.g. `goVersion = "1.25.3";` -> `goVersion = "1.25.4";`
31+
2. Replace both `sha256` variable values with the correct ones for the new downloaded file.
32+
33+
One easy way to read the expected sha 256 hash to be used for each `sha-256` setting is to using `nix-prefetch-url` or `nix store prefetch-file --json` to grab the file and hash it.
34+
35+
For example:
36+
37+
```shell
38+
$ nix store prefetch-file --json https://go.dev/dl/go1.25.3.linux-amd64.tar.gz |jq -r .hash
39+
sha256-AzXzFLbnv+CMPQz6p8GduWG3uZ+yC+YrCoJsmSrRTg8=
40+
```
41+
42+
Make sure to use the correct architecture filename download to grab its corresponding sha 256 hash.
43+
44+
## Testing
45+
46+
Using `devbox shell` normally would already grab and build the flake, as referenced by devbox.json entry `"path:./flakes/go": {}`. Still if you want to test the flake build in isolation you can run (in this directory):
47+
48+
``shell
49+
nix build .
50+
```
51+
52+
On success a `result` entry in the directory soft links to the built flake.

‎flakes/go/flake.lock‎

Lines changed: 61 additions & 0 deletions
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎flakes/go/flake.nix‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
{
2+
description = "A dev shell with a custom-fetched Go 1.25.3";
3+
4+
inputs = {
5+
nixpkgs.url = "github:NixOS/nixpkgs/nixpkgs-unstable";
6+
flake-utils.url = "github:numtide/flake-utils";
7+
};
8+
9+
outputs = { self, nixpkgs, flake-utils }:
10+
flake-utils.lib.eachDefaultSystem (system:
11+
let
12+
pkgs = nixpkgs.legacyPackages.${system};
13+
14+
goVersion = "1.25.3";
15+
16+
go-src =
17+
if pkgs.stdenv.isLinux && pkgs.stdenv.hostPlatform.system == "x86_64-linux" then {
18+
url = "https://go.dev/dl/go${goVersion}.linux-amd64.tar.gz";
19+
sha256 = "sha256-AzXzFLbnv+CMPQz6p8GduWG3uZ+yC+YrCoJsmSrRTg8=";
20+
}
21+
else if pkgs.stdenv.isDarwin && pkgs.stdenv.hostPlatform.system == "aarch64-darwin" then {
22+
url = "https://go.dev/dl/go${goVersion}.darwin-arm64.tar.gz";
23+
sha256 = "sha256-fAg+PSwA3r/rL3fZpMAKGqyXETuJuczEKpBIevNDc4I=";
24+
}
25+
else throw "This flake does not support system: ${pkgs.stdenv.hostPlatform.system}";
26+
27+
go_1_25_3 = pkgs.stdenv.mkDerivation {
28+
pname = "go-custom";
29+
version = goVersion;
30+
31+
src = pkgs.fetchurl {
32+
inherit (go-src) url sha256;
33+
};
34+
35+
dontBuild = true;
36+
37+
installPhase = ''
38+
mkdir -p $out
39+
cp -a ./* $out/
40+
'';
41+
};
42+
43+
in
44+
{
45+
packages.go_1_25_3 = go_1_25_3;
46+
packages.default = go_1_25_3;
47+
48+
devShells.default = pkgs.mkShell {
49+
packages = [
50+
go_1_25_3
51+
];
52+
};
53+
}
54+
);
55+
}

‎go.mod‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,8 @@
11
module github.com/mongodb/mongodb-atlas-kubernetes/v2
22

3-
go 1.25.0
3+
go 1.25
44

5-
toolchain go1.25.1
5+
toolchain go1.25.3
66

77
require (
88
cloud.google.com/go/kms v1.23.2

‎tools/openapi2crd/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ module tools/openapi2crd
22

33
go 1.25
44

5-
toolchain go1.25.1
5+
toolchain go1.25.3
66

77
require (
88
github.com/getkin/kin-openapi v0.131.0

‎tools/toolbox/go.mod‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ module toolbox
22

33
go 1.25
44

5-
toolchain go1.25.1
5+
toolchain go1.25.3
66

77
tool github.com/daixiang0/gci
88

0 commit comments

Comments
 (0)