Upgrade to go1.21.0 (#4450)

Also the go compiler version is now always reported with a patch version
so we can remove the whole go_version_full/go_version distinction in the
Makefile.

Fixed up the compiler tarball URL to match what is now present on the
Go downloads page.

Signed-off-by: Andrew Harding <azdagron@gmail.com>

.github/workflows/pr_build.yaml

@@ -3,7 +3,7 @@ on:
   pull_request: {}
   workflow_dispatch: {}
 env:
-  GO_VERSION: 1.20.5
+  GO_VERSION: 1.21.0
 permissions:
   contents: read
 

.github/workflows/release_build.yaml

@@ -4,7 +4,7 @@ on:
     tags:
       - 'v[0-9].[0-9]+.[0-9]+'
 env:
-  GO_VERSION: 1.20.5
+  GO_VERSION: 1.21.0
 jobs:
   cache-deps:
     name: cache-deps (linux)

.go-version

@@ -1 +1 @@
-1.20.5
+1.21.0

Makefile

@@ -122,17 +122,16 @@ binaries := spire-server spire-agent oidc-discovery-provider
 
 build_dir := $(DIR)/.build/$(os1)-$(arch1)
 
-go_version_full := $(shell cat .go-version)
-go_version := $(go_version_full:.0=)
+go_version := $(shell cat .go-version)
 go_dir := $(build_dir)/go/$(go_version)
 
 ifeq ($(os1),windows)
 	go_bin_dir = $(go_dir)/go/bin
-	go_url = https://storage.googleapis.com/golang/go$(go_version).$(os1)-$(arch2).zip
+	go_url = https://go.dev/dl/go$(go_version).$(os1)-$(arch2).zip
 	exe=".exe"
 else
 	go_bin_dir = $(go_dir)/bin
-	go_url = https://storage.googleapis.com/golang/go$(go_version).$(os1)-$(arch2).tar.gz
+	go_url = https://go.dev/dl/go$(go_version).$(os1)-$(arch2).tar.gz
 	exe=
 endif
 
@@ -355,7 +354,7 @@ $1: $3 container-builder
 	@echo Building docker image $2 $(PLATFORM)…
 	$(E)docker buildx build \
 		--platform $(PLATFORMS) \
-		--build-arg goversion=$(go_version_full) \
+		--build-arg goversion=$(go_version) \
 		--target $2 \
 		-o type=oci,dest=$2-image.tar \
 		-f $3 \
@@ -386,7 +385,7 @@ define windows_image_rule
 $1: $3
 	@echo Building docker image $2…
 	$(E)docker build \
-		--build-arg goversion=$(go_version_full) \
+		--build-arg goversion=$(go_version) \
 		--target $2 \
 		-t $2 -t $2:latest-local \
 		-f $3 \

go.mod

@@ -1,6 +1,6 @@
 module github.com/spiffe/spire
 
-go 1.20
+go 1.21
 
 require (
 	cloud.google.com/go/iam v1.1.1

pkg/agent/plugin/workloadattestor/k8s/k8s_test.go

@@ -230,7 +230,7 @@ func (s *Suite) TestAttestOverSecurePortViaClientAuth() {
 	s.writeCert(certPath, clientCert)
 
 	s.clock.Add(defaultReloadInterval)
-	s.requireAttestFailure(p, codes.Internal, "tls: bad certificate")
+	s.requireAttestFailure(p, codes.Internal, "remote error: tls")
 }
 
 func (s *Suite) TestAttestOverSecurePortViaAnonymousAuth() {