GO toolchain 1.24

[qiumjie1]

The main branch is already using GO toolchain 1.24. Is this going to be included in the upcoming release v3.6.0? The importance of using 1.24 is that its cryptographic Module uses FIPS 140-3 approved algorithms.

[jmhbnz]

Hi @qiumjie1 - Thanks for your question, our release-3.6 branch currently uses go 1.23 https://github.com/etcd-io/etcd/blob/release-3.6/.go-version.

I believe this will still be the case at the point we release v3.6.0 (expected within the next month) as all of our release candidates are based on go 1.23 which is still within our go version policy:https://github.com/etcd-io/etcd/blob/main/Documentation/contributor-guide/dependency_management.md#golang-versions

Future patch releases of v3.6 will include a bump to go 1.24 once go 1.25 has been released.

[qiumjie1]

Thanks for the response. Do you have a rough estimate of when the toolchain will be upgraded to 1.24?

[jmhbnz]

Around August/September when go 1.25 is released, refer: https://go.dev/wiki/Go-Release-Cycle

At that point main for etcd will be updated to go 1.25 and the next patch release for each stable release branch will likely bump to go 1.24 to ensure they stay on a supported release of go.

[qiumjie1]

GO 1.23 does not use FIPS approved cryptographic modules. Do you have any advise on what we can do to make ETCD FIPS compliant before the toolchain is upgraded to GO 1.24? We build ETCD binary from the source.

[jmhbnz]

etcd is a community project and to the best of my knowledge producing certified FIPS compliant releases is not something the community has or will specifically focus on any time soon. However multiple commercial software vendors provide etcd certified as compliant for FIPS environments so you could certainly explore that route.

If you are building from source you're most welcome to bump to go 1.24 yourself in a fork of release-3.5 or release-3.6 branch if your work needs to be completed prior to the timeline I mentioned earlier. The suggested steps for bumping a minor release of go are listed here: https://github.com/etcd-io/etcd/blob/main/Documentation/contributor-guide/dependency_management.md#golang-versions