[BEAM-14456] Use Go 1.18.2 to build 2.39 Container Bootloaders

• Type: Bug
• Status: Resolved
• Priority: P2
• Resolution: Fixed
• Affects Version/s: 2.39.0
• Fix Version/s: 2.39.0
• Component/s: sdk-go, sdk-java-core, sdk-py-core
• Assignee: Robert Burke
• Reporter: Robert Burke
• Created: 10/May/22 21:07
• Updated: 12/May/22 14:30
• Resolved: 12/May/22 14:29

Description

It's been noted that by using older Go releases to compile Go containers we run the risk of the bootloaders using vulnerable versions.

This issue is to close the gap for 2.39, while a separate one is to document the policy of keeping the release artifacts built with the latest Go version.

While it's unlikely to be an attack vector, it's prudent that we keep these gaps as closed as we're able.

Issue Links

• links to: GitHub Pull Request #17606