upgrade to go1.23.1 (#1796)

Signed-off-by: cpanato <[email protected]>

.github/workflows/validate-release.yml

@@ -33,9 +33,9 @@ jobs:
     steps:
       - name: Check Signature
         run: |
-          cosign verify ghcr.io/gythialy/golang-cross:v1.22.6-0@sha256:34ba9945085680b8966b78929e3520478ec9ea38a315fa13d8d5e0ce6355d0d2 \
+          cosign verify ghcr.io/gythialy/golang-cross:v1.23.1-0@sha256:08c0c74e318141737b9da97e3b110417a5d898eef617802706b725ef926497ff \
           --certificate-oidc-issuer https://token.actions.githubusercontent.com \
-          --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.6-0"
+          --certificate-identity "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.23.1-0"
         env:
           TUF_ROOT: /tmp
 
@@ -44,7 +44,7 @@ jobs:
     needs:
       - check-signature
     container:
-      image: ghcr.io/gythialy/golang-cross:v1.22.6-0@sha256:34ba9945085680b8966b78929e3520478ec9ea38a315fa13d8d5e0ce6355d0d2
+      image: ghcr.io/gythialy/golang-cross:v1.23.1-0@sha256:08c0c74e318141737b9da97e3b110417a5d898eef617802706b725ef926497ff
 
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7

.github/workflows/verify.yml

@@ -69,9 +69,8 @@ jobs:
 
       - name: golangci-lint
         uses: golangci/golangci-lint-action@aaa42aa0628b4ae2578232a66b541047968fac86 # v6.1.0
-        timeout-minutes: 10
         with:
-          version: v1.59
+          version: v1.60
 
   oidc-config:
     name: oidc-config

.golangci.yml

@@ -15,31 +15,36 @@
 
 linters:
   enable:
-  - unused
-  - errcheck
-  - gofmt
-  - goimports
-  - gosec
-  - gocritic
-  - misspell
-  - revive
+    - unused
+    - errcheck
+    - gofmt
+    - goimports
+    - gosec
+    - gocritic
+    - misspell
+    - revive
+linters-settings:
+  gosec:
+    excludes:
+      - G115  # integer overflow conversion int -> uint32
+      - G602  # slice index out of range
 output:
   uniq-by-line: false
 issues:
   exclude-rules:
-  - path: _test\.go
-    linters:
-    - errcheck
-    - gosec
-  # the following section is due to the legacy API being deprecated
-  - path: pkg/server/legacy_server.go
-    linters:
-    - staticcheck
-    text: SA1019
-  - path: pkg/ca/tinkca/signer.go
-    linters:
-    - staticcheck
-    text: SA1019
+    - path: _test\.go
+      linters:
+        - errcheck
+        - gosec
+    # the following section is due to the legacy API being deprecated
+    - path: pkg/server/legacy_server.go
+      linters:
+        - staticcheck
+      text: SA1019
+    - path: pkg/ca/tinkca/signer.go
+      linters:
+        - staticcheck
+      text: SA1019
   max-issues-per-linter: 0
   max-same-issues: 0
 run:

Dockerfile

@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.22.6@sha256:2bd56f00ff47baf33e64eae7996b65846c7cb5e0a46e0a882ef179fd89654afa AS builder
+FROM golang:1.23.1@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e AS builder
 ENV APP_ROOT=/opt/app-root
 ENV GOPATH=$APP_ROOT
 
@@ -28,7 +28,7 @@ RUN go build -o server main.go
 RUN CGO_ENABLED=1 go build -gcflags "all=-N -l" -o server_debug main.go
 
 # Multi-Stage production build
-FROM golang:1.22.6@sha256:2bd56f00ff47baf33e64eae7996b65846c7cb5e0a46e0a882ef179fd89654afa AS deploy
+FROM golang:1.23.1@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e AS deploy
 
 # Retrieve the binary from the previous stage
 COPY --from=builder /opt/app-root/src/server /usr/local/bin/fulcio-server

Dockerfile.ctfe_init

@@ -13,7 +13,7 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-FROM golang:1.22.6@sha256:2bd56f00ff47baf33e64eae7996b65846c7cb5e0a46e0a882ef179fd89654afa AS builder
+FROM golang:1.23.1@sha256:4a3c2bcd243d3dbb7b15237eecb0792db3614900037998c2cd6a579c46888c1e AS builder
 
 WORKDIR /root/
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/sigstore/fulcio
 
-go 1.22.6
+go 1.23.1
 
 require (
 	chainguard.dev/go-grpc-kit v0.17.5

pkg/ca/googleca/v1/googleca.go

@@ -86,7 +86,7 @@ func getPubKeyFormat(pemBytes []byte) (privatecapb.PublicKey_KeyFormat, error) {
 	block, _ := pem.Decode(pemBytes)
 	pub, err := x509.ParsePKIXPublicKey(block.Bytes)
 	if err != nil {
-		return 0, fmt.Errorf("failed to parse public key: " + err.Error())
+		return 0, fmt.Errorf("failed to parse public key: %w", err)
 	}
 	switch pub := pub.(type) {
 	case *rsa.PublicKey, *ecdsa.PublicKey:

release/cloudbuild.yaml

@@ -38,13 +38,13 @@ steps:
       - TUF_ROOT=/tmp
     args:
       - 'verify'
-      - 'ghcr.io/gythialy/golang-cross:v1.22.6-0@sha256:34ba9945085680b8966b78929e3520478ec9ea38a315fa13d8d5e0ce6355d0d2'
+      - 'ghcr.io/gythialy/golang-cross:v1.23.1-0@sha256:08c0c74e318141737b9da97e3b110417a5d898eef617802706b725ef926497ff'
       - '--certificate-oidc-issuer'
       - "https://token.actions.githubusercontent.com"
       - '--certificate-identity'
-      - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.22.6-0"
+      - "https://github.com/gythialy/golang-cross/.github/workflows/release-golang-cross.yml@refs/tags/v1.23.1-0"
 
-  - name: ghcr.io/gythialy/golang-cross:v1.22.6-0@sha256:34ba9945085680b8966b78929e3520478ec9ea38a315fa13d8d5e0ce6355d0d2
+  - name: ghcr.io/gythialy/golang-cross:v1.23.1-0@sha256:08c0c74e318141737b9da97e3b110417a5d898eef617802706b725ef926497ff
     entrypoint: /bin/sh
     dir: "go/src/sigstore/fulcio"
     env:
@@ -67,7 +67,7 @@ steps:
         gcloud auth configure-docker \
         && make release
 
-  - name: ghcr.io/gythialy/golang-cross:v1.22.6-0@sha256:34ba9945085680b8966b78929e3520478ec9ea38a315fa13d8d5e0ce6355d0d2
+  - name: ghcr.io/gythialy/golang-cross:v1.23.1-0@sha256:08c0c74e318141737b9da97e3b110417a5d898eef617802706b725ef926497ff
     entrypoint: 'bash'
     dir: "go/src/sigstore/fulcio"
     env: