Define supported Go versions

[kzys]

The SDK currently doesn't have a policy regarding supported Go versions. We have been supporting Go 1.11 for a while even Go team doesn't support the version.

Right now, the motivation tends to come from dependencies. If they are having vulnerabilities and we want to upgrade them, we tend to realize that newer dependencies don't support older Go versions.

We probably should have a version supporting policy upfront, instead of deciding case-by-case basis. If supporting old Go versions have some value, we may be okay to ask our dependencies to support them.

[kzys]

Go versions in the world right now

Go upstream

Each major Go release is supported until there are two newer major releases. For example, Go 1.5 was supported until the Go 1.7 release, and Go 1.6 was supported until the Go 1.8 release. We fix critical problems, including critical security problems, in supported releases as needed by issuing minor revisions (for example, Go 1.6.1, Go 1.6.2, and so on).

Right now, there are Go 1.19 and 1.18. Go versions <= 1.17 are no longer supported.

Linux distributions

• Amazon Linux 2: Go 1.18
• Debian 11
  • 1.15 as https://packages.debian.org/bullseye/golang/golang
  • 1.18 as https://packages.debian.org/bullseye-backports/golang/golang
• Ubuntu 18.04 LTS
  • 1.13 as https://packages.ubuntu.com/bionic/devel/golang-1.13
• Ubuntu 20.04 LTS
  • 1.14 as https://packages.ubuntu.com/focal/devel/golang-1.14
  • 1.16 as https://packages.ubuntu.com/focal-updates/devel/golang-1.16
• Ubuntu 22.04 LTS
  • 1.18 as https://packages.ubuntu.com/jammy/golang-1.18

Amazon-owned Go packages

https://github.com/aws/aws-sdk-go-v2

The v2 SDK requires a minimum version of Go 1.15.

https://github.com/aws/aws-sdk-go

If you are using Go 1.5 without vendoring enabled, (GO15VENDOREXPERIMENT=1), you will need to use ... when retrieving the SDK to get its dependencies.

[ginglis13]

Seeing this on other recent PRs (e.g. #440). Looks like our dependency ltag does not support Go <= 1.15:

GO111MODULE=off GOBIN=/home/runner/work/firecracker-go-sdk/firecracker-go-sdk/testdata \
go get github.com/kunalkushwaha/ltag
# github.com/kunalkushwaha/ltag
Error: ../../../go/src/github.com/kunalkushwaha/ltag/bash.go:25:15: undefined: os.ReadFile
Error: ../../../go/src/github.com/kunalkushwaha/ltag/dockerfile.go:23:15: undefined: os.ReadFile
Error: ../../../go/src/github.com/kunalkushwaha/ltag/golang.go:23:15: undefined: os.ReadFile
Error: ../../../go/src/github.com/kunalkushwaha/ltag/makefile.go:15:15: undefined: os.ReadFile
make: *** [Makefile:125: testdata/ltag] Error 2
Error: Process completed with exit code 2.

os.ReadFile was added in Go 1.16

latest releases of ltag show upgrades to Go 1.17 and 1.18: https://github.com/kunalkushwaha/ltag/releases

[Joffref]

Maybe, version of the ltag binary must be setted using go get github.com/kunalkushwaha/ltag@version in the Makefile to provides two versions, one for 1.15 <= and one for 1.16 >= ?

[austinvazquez]

To me the way is to drop support for Go <= v1.16. v1.17 just ended support in August 2022 and users may still be in transition.

Also we should pin the dependency versions for reproducible builds but that is a separate issue.

[Kern--]

As @kzys mentioned, that would require users on Debian 11 or Ubuntu 20.04 to download go outside of their normal package managers. Debian 11 just went stable last year and is supported for 4 more years, and Ubuntu 20.04 is still supported for 2 years.

I don't think it's unreasonable to say we will only support go versions that are still supported upstream, but I don't think that's the only consideration.

[austinvazquez]

That's fair I wasn't viewing support from the linux distribution pov. Now I'm conflicted again. I want to consider those users, but 4 more years of Go 1.15 support 👀

[Joffref]

I agree with @Kern-- as a Firecracker go SDK user these "feature" is quite important to me as I'm working in constrained environments.

Plus, as you said @austinvazquez pin the dependency versions is definitely a separate issue except if you introduce a range of supported Go versions as it is the case now.

[kzys]

I've updated my comment above. Dropping Go 1.15 and 1.17 support may be a bummer for Ubuntu 18.04 LTS users, but other distros seem fine.

#364 (comment)