chore: update to go 1.25.6 and distroless-iptables to v0.8.7 (#1699)

aramase · web-flow · commit 10fd1994b777 · 2026-02-09T14:24:36.000-05:00
diff --git a/.github/workflows/azwi-build.yaml b/.github/workflows/azwi-build.yaml
@@ -35,7 +35,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version: "1.25"
           check-latest: true
       - name: Build azwi
         run: |
diff --git a/.github/workflows/azwi-e2e.yaml b/.github/workflows/azwi-e2e.yaml
@@ -33,7 +33,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version: "1.25"
           check-latest: true
       - name: Build azwi
         run: |
diff --git a/.github/workflows/create-release-pull-request.yaml b/.github/workflows/create-release-pull-request.yaml
@@ -34,7 +34,7 @@ jobs:
           ref: "${{ github.event.inputs.based_on_branch }}"
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version: "1.25"
           check-latest: true
       - run: make release-manifest
         env:
diff --git a/.github/workflows/create-release.yaml b/.github/workflows/create-release.yaml
@@ -32,7 +32,7 @@ jobs:
           fetch-depth: 0
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version: "1.25"
           check-latest: true
       - name: Goreleaser
         uses: goreleaser/goreleaser-action@336e29918d653399e599bfca99fadc1d7ffbc9f7 # v4.3.0
diff --git a/.github/workflows/scan-vulns.yaml b/.github/workflows/scan-vulns.yaml
@@ -25,7 +25,7 @@ jobs:
 
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version: "1.25"
           check-latest: true
       - uses: golang/govulncheck-action@3a32958c2706f7048305d5a2e53633d7e37e97d0 # v1.0.2
 
@@ -41,7 +41,7 @@ jobs:
 
       - uses: actions/setup-go@0c52d547c9bc32b1aa3301fd7a9cb496313a4491 # v5.0.0
         with:
-          go-version: "1.24"
+          go-version: "1.25"
           check-latest: true
 
       - name: Check out code into the Go module directory
diff --git a/.golangci.yml b/.golangci.yml
@@ -1,6 +1,6 @@
 run:
   deadline: 20m
-  go-version: "1.24"
+  go-version: "1.25"
 
 linters:
   disable-all: true
diff --git a/.pipelines/nightly.yaml b/.pipelines/nightly.yaml
@@ -10,7 +10,10 @@ schedules:
       include:
         - main
 
-pool: staging-pool-amd64-mariner-2
+pool:
+  name: staging-pool-amd64-mariner-2
+  demands:
+  - ImageOverride -equals 1es-azlinux-3-amd64-custom-disk
 
 jobs:
   - job:
@@ -39,7 +42,8 @@ jobs:
     steps:
       - task: GoTool@0
         inputs:
-          version: "1.24.11"
+          version: "1.25.6"
+      - template: templates/prepare-deps.yaml
       - script: make test-e2e
         displayName: Webhook E2E test suite
         env:
@@ -59,8 +63,6 @@ jobs:
   - job:
     pool:
       name: staging-pool-amd64-mariner-2
-      demands:
-      - ImageOverride -equals azcu-agent-amd64-mariner-2-cgv2-img
     timeoutInMinutes: 60
     workspace:
       clean: all
@@ -88,7 +90,8 @@ jobs:
     steps:
       - task: GoTool@0
         inputs:
-          version: "1.24.11"
+          version: "1.25.6"
+      - template: templates/prepare-deps.yaml
       - script: make test-e2e
         displayName: Webhook E2E test suite
         env:
diff --git a/.pipelines/pr.yaml b/.pipelines/pr.yaml
@@ -15,7 +15,10 @@ pr:
     - '*'
     - examples/msal-go/*
 
-pool: staging-pool-amd64-mariner-2
+pool:
+  name: staging-pool-amd64-mariner-2
+  demands:
+  - ImageOverride -equals 1es-azlinux-3-amd64-custom-disk
 
 jobs:
   - job: lint
@@ -25,7 +28,8 @@ jobs:
     steps:
       - task: GoTool@0
         inputs:
-          version: "1.24.11"
+          version: "1.25.6"
+      - template: templates/prepare-deps.yaml
       - script: make lint
         displayName: golangci-lint
       - script: make helm-lint
@@ -51,14 +55,16 @@ jobs:
     steps:
       - task: GoTool@0
         inputs:
-          version: "1.24.11"
+          version: "1.25.6"
+      - template: templates/prepare-deps.yaml
       - script: make test
         displayName: Unit test
   - job: shellcheck
     timeoutInMinutes: 5
     workspace:
       clean: all
     steps:
+      - template: templates/prepare-deps.yaml
       - script: make shellcheck
         displayName: shellcheck
   - job:
@@ -89,7 +95,8 @@ jobs:
     steps:
       - task: GoTool@0
         inputs:
-          version: "1.24.11"
+          version: "1.25.6"
+      - template: templates/prepare-deps.yaml
       - script: echo "##vso[task.setvariable variable=CLUSTER_NAME]azwi-e2e-$(openssl rand -hex 2)"
         displayName: Set CLUSTER_NAME
         condition: ne(variables.LOCAL_ONLY, 'true')
@@ -110,8 +117,6 @@ jobs:
     timeoutInMinutes: 60
     pool:
       name: staging-pool-amd64-mariner-2
-      demands:
-      - ImageOverride -equals azcu-agent-amd64-mariner-2-cgv2-img
     dependsOn:
     - lint
     - shellcheck
@@ -143,7 +148,8 @@ jobs:
     steps:
       - task: GoTool@0
         inputs:
-          version: "1.24.11"
+          version: "1.25.6"
+      - template: templates/prepare-deps.yaml
       - script: echo "##vso[task.setvariable variable=CLUSTER_NAME]azwi-e2e-$(openssl rand -hex 2)"
         displayName: Set CLUSTER_NAME
         condition: ne(variables.LOCAL_ONLY, 'true')
diff --git a/.pipelines/templates/prepare-deps.yaml b/.pipelines/templates/prepare-deps.yaml
@@ -0,0 +1,10 @@
+steps:
+- bash: |
+    for i in {1..10}; do
+      if sudo tdnf install -y kernel-headers make gcc glibc-devel binutils; then
+        exit 0
+      fi
+      echo "waiting until rpm lock is free"
+      sleep 5
+    done
+    exit 1
diff --git a/docker/proxy-init.Dockerfile b/docker/proxy-init.Dockerfile
@@ -1,4 +1,4 @@
-FROM registry.k8s.io/build-image/distroless-iptables:v0.8.6
+FROM registry.k8s.io/build-image/distroless-iptables:v0.8.7
 
 COPY ./init/init-iptables.sh /bin/
 RUN chmod +x /bin/init-iptables.sh
diff --git a/docker/proxy.Dockerfile b/docker/proxy.Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-bookworm@sha256:3b7a6e64a0b4804551d553dae580d1fc46dd56fe68be5db3b373c0a38baa514e as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.6-bookworm@sha256:7ee2dbc1bae8e4c4d0256aed778a1a9e40fdd8a0c04b87b40cb5f4670774f5b4 as builder
 
 ARG LDFLAGS
 
@@ -16,7 +16,7 @@ COPY pkg/ pkg/
 
 # Build
 ARG TARGETARCH
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -ldflags "${LDFLAGS:--X github.com/Azure/azure-workload-identity/pkg/version.BuildVersion=latest}" -o proxy main.go
+RUN MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -ldflags "${LDFLAGS:--X github.com/Azure/azure-workload-identity/pkg/version.BuildVersion=latest}" -o proxy main.go
 
 FROM --platform=${TARGETPLATFORM:-linux/amd64} mcr.microsoft.com/cbl-mariner/distroless/minimal:2.0-nonroot
 WORKDIR /
diff --git a/docker/webhook.Dockerfile b/docker/webhook.Dockerfile
@@ -1,5 +1,5 @@
 # Build the manager binary
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-bookworm@sha256:3b7a6e64a0b4804551d553dae580d1fc46dd56fe68be5db3b373c0a38baa514e as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.6-bookworm@sha256:7ee2dbc1bae8e4c4d0256aed778a1a9e40fdd8a0c04b87b40cb5f4670774f5b4 as builder
 
 ARG LDFLAGS
 
@@ -17,7 +17,7 @@ COPY pkg/ pkg/
 
 # Build
 ARG TARGETARCH
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -ldflags "${LDFLAGS:--X github.com/Azure/azure-workload-identity/pkg/version.BuildVersion=latest}" -o manager main.go
+RUN MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -ldflags "${LDFLAGS:--X github.com/Azure/azure-workload-identity/pkg/version.BuildVersion=latest}" -o manager main.go
 
 FROM --platform=${TARGETPLATFORM:-linux/amd64} mcr.microsoft.com/cbl-mariner/distroless/minimal:2.0-nonroot
 WORKDIR /
diff --git a/examples/msal-go/Dockerfile b/examples/msal-go/Dockerfile
@@ -1,4 +1,4 @@
-FROM mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-bookworm@sha256:3b7a6e64a0b4804551d553dae580d1fc46dd56fe68be5db3b373c0a38baa514e as builder
+FROM mcr.microsoft.com/oss/go/microsoft/golang:1.25.6-bookworm@sha256:7ee2dbc1bae8e4c4d0256aed778a1a9e40fdd8a0c04b87b40cb5f4670774f5b4 as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -14,7 +14,7 @@ COPY token_credential.go token_credential.go
 
 # Build
 ARG TARGETARCH
-RUN CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o msalgo .
+RUN MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOOS=linux GOARCH=${TARGETARCH} GO111MODULE=on go build -a -o msalgo .
 
 FROM --platform=${TARGETPLATFORM:-linux/amd64} mcr.microsoft.com/cbl-mariner/distroless/minimal:2.0-nonroot
 WORKDIR /
diff --git a/examples/msal-go/go.mod b/examples/msal-go/go.mod
@@ -1,6 +1,6 @@
 module github.com/Azure/azure-workload-identity/example/msal-go
 
-go 1.24.11
+go 1.25.6
 
 require (
 	github.com/Azure/azure-sdk-for-go/sdk/azcore v1.16.0
diff --git a/examples/msal-go/windows.Dockerfile b/examples/msal-go/windows.Dockerfile
@@ -1,7 +1,7 @@
 ARG SERVERCORE_CACHE=gcr.io/k8s-staging-e2e-test-images/windows-servercore-cache:1.0-linux-amd64-${OS_VERSION:-1809}
 ARG BASEIMAGE=mcr.microsoft.com/windows/nanoserver:${OS_VERSION:-1809}
 
-FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.24.11-bookworm@sha256:3b7a6e64a0b4804551d553dae580d1fc46dd56fe68be5db3b373c0a38baa514e as builder
+FROM --platform=linux/amd64 mcr.microsoft.com/oss/go/microsoft/golang:1.25.6-bookworm@sha256:7ee2dbc1bae8e4c4d0256aed778a1a9e40fdd8a0c04b87b40cb5f4670774f5b4 as builder
 
 WORKDIR /workspace
 # Copy the Go Modules manifests
@@ -16,7 +16,7 @@ COPY main.go main.go
 COPY token_credential.go token_credential.go
 
 # Build
-RUN CGO_ENABLED=0 GOOS=windows GO111MODULE=on go build -a -o msalgo.exe .
+RUN MS_GO_NOSYSTEMCRYPTO=1 CGO_ENABLED=0 GOOS=windows GO111MODULE=on go build -a -o msalgo.exe .
 
 FROM --platform=linux/amd64 ${SERVERCORE_CACHE} as core
 
diff --git a/go.mod b/go.mod
@@ -1,6 +1,6 @@
 module github.com/Azure/azure-workload-identity
 
-go 1.24.11
+go 1.25.6
 
 require (
 	github.com/Azure/aad-pod-identity v1.8.17
@@ -25,8 +25,8 @@ require (
 	go.opentelemetry.io/otel v1.28.0
 	go.opentelemetry.io/otel/exporters/prometheus v0.46.0
 	go.opentelemetry.io/otel/metric v1.28.0
+	gopkg.in/go-jose/go-jose.v2 v2.6.3
 	gopkg.in/ini.v1 v1.62.1
-	gopkg.in/square/go-jose.v2 v2.6.0
 	k8s.io/api v0.31.14
 	k8s.io/apimachinery v0.31.14
 	k8s.io/client-go v0.31.14
diff --git a/go.sum b/go.sum
@@ -314,12 +314,12 @@ gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntN
 gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
 gopkg.in/evanphx/json-patch.v4 v4.12.0 h1:n6jtcsulIzXPJaxegRbvFNNrZDjbij7ny3gmSPG+6V4=
 gopkg.in/evanphx/json-patch.v4 v4.12.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
+gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
+gopkg.in/go-jose/go-jose.v2 v2.6.3/go.mod h1:zzZDPkNNw/c9IE7Z9jr11mBZQhKQTMzoEEIoEdZlFBI=
 gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
 gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
 gopkg.in/ini.v1 v1.62.1 h1:Idt4Iidq1iKKmhakQtqAIvBBL53JTyuNIX+wR/rmkp4=
 gopkg.in/ini.v1 v1.62.1/go.mod h1:pNLf8WUiyNEtQjuu5G5vTm06TEv9tsIgeAvK8hOrP4k=
-gopkg.in/square/go-jose.v2 v2.6.0 h1:NGk74WTnPKBNUhNzQX7PYcTLUjoq7mzKk2OKbvwk2iI=
-gopkg.in/square/go-jose.v2 v2.6.0/go.mod h1:M9dMgbHiYLoDGQrXy7OpJDJWiKiU//h+vD76mk0e1AI=
 gopkg.in/yaml.v2 v2.2.8/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.3.0/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
diff --git a/pkg/cmd/jwks/root.go b/pkg/cmd/jwks/root.go
@@ -12,7 +12,7 @@ import (
 
 	"github.com/pkg/errors"
 	"github.com/spf13/cobra"
-	jose "gopkg.in/square/go-jose.v2"
+	jose "gopkg.in/go-jose/go-jose.v2"
 	"k8s.io/client-go/util/keyutil"
 	"monis.app/mlog"
 )
diff --git a/scripts/ci-e2e.sh b/scripts/ci-e2e.sh
@@ -39,7 +39,9 @@ create_cluster() {
     fi
 
     if [[ "${REGISTRY}" =~ \.azurecr\.io ]]; then
-      az acr login --name "${REGISTRY}"
+      # Extract just the registry hostname (e.g., upstream.azurecr.io from upstream.azurecr.io/azure-workload-identity)
+      ACR_NAME="${REGISTRY%%/*}"
+      az acr login --name "${ACR_NAME}" --debug
     fi
 
     # build webhook manager and msal-go-e2e images
@@ -61,6 +63,7 @@ cleanup() {
 trap cleanup EXIT
 
 main() {
+  az --version || sudo tdnf install -y azure-cli
   az login -i > /dev/null && echo "Using machine identity for az commands" || echo "Using pre-existing credential for az commands"
   az account set --subscription "${AZURE_SUBSCRIPTION_ID}" > /dev/null
 
diff --git a/test/e2e/go.mod b/test/e2e/go.mod
@@ -1,6 +1,6 @@
 module github.com/Azure/azure-workload-identity/test/e2e
 
-go 1.24.11
+go 1.25.6
 
 replace (
 	k8s.io/api => k8s.io/api v0.31.1

Original file line number	Diff line number	Diff line change
`@@ -1,4 +1,4 @@`
`1`		`-FROM registry.k8s.io/build-image/distroless-iptables:v0.8.6`
	`1`	`+FROM registry.k8s.io/build-image/distroless-iptables:v0.8.7`
`2`	`2`
`3`	`3`	`COPY ./init/init-iptables.sh /bin/`
`4`	`4`	`RUN chmod +x /bin/init-iptables.sh`