golang: bump golang 1.19.12 -> 1.20.7

[mfrw]

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

• The toolchain has been rebuilt successfully (or no changes were made to it)
• The toolchain/worker package manifests are up-to-date
• Any updated packages successfully build (or no packages were changed)
• Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
• Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
• All package sources are available
• cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
• LICENSE-MAP files are up-to-date (./SPECS/LICENSES-AND-NOTICES/data/licenses.json, ./SPECS/LICENSES-AND-NOTICES/LICENSES-MAP.md, ./SPECS/LICENSES-AND-NOTICES/LICENSE-EXCEPTIONS.PHOTON)
• All source files have up-to-date hashes in the *.signatures.json files
• sudo make go-tidy-all and sudo make go-test-coverage pass
• Documentation has been updated to match any changes to the build system
• Ready to merge

---

Summary

What does the PR accomplish, why was it needed?
This touches moby-* and golang:

• Golang bumped to 1.20.7. Note that for go versions >= 1.20, the minimum compiler required is 1.17.
  First the go1.4 bootstrap compiler is built.
  The result of 1.4 compiler is used to build a 1.19.12 compiler.
  The 1.19.12 compiler is used to build the actual 1.20.7 compiler.
  Since go builds fairly quickly, the overhead of this is ~2-3 minutes on a reasonable machine.

• moby-engine & moby-cli -> bumped to 20.10.25 (which contain the fix http: invalid host header.
  If we build moby-enginne & moby-cli with 1.19.12 compiler, it still does not work.

• moby-runc bumped to 1.1.9

• moby-containerd bumped to 1.6.22

Change Log

• golang: bump version 1.19.12 -> 1.20.7
• golang: fix compile process for go >= 1.20
• golang: add comment on how the compiler builds post go >= 1.20
• golang: cgmanifest: update entry
• moby-engine: bump version 20.10.24 -> 20.10.25
• moby-engine: cgmanifest: update entry
• moby-cli: bump version 20.10.24 -> 20.10.25
• moby-cli: cgmanifest: update entry
• moby-containerd: bump version 1.6.18 -> 1.6.22
• moby-containerd: cgmanifest: add entry
• moby-runc: bump version 1.1.5 -> 1.1.9
• moby-runc: cgmanifest: update entry

Does this affect the toolchain?

NO

Associated issues

Fixes:

• Running Docker containers no longer works with version 2.0.20230805 it seems #5980
• Related Workitem/Bug: 45821789
• Closes: moby-engine: introduce patch to fix http: invalid Host header #5936
• Supersedes: Upgrade golang to 1.19.12 to address CVE-2023-29409 #5946

Links to CVEs

• NA

Test Methodology

• Local Build and verification

Pipeline Build:

• ARM: FullBuild
• AMD: FullBuild

PS: I used the new containerized-build feature for this and a big kudos to @neha170 for this feature
/cc @christopherco

[kanikanema]

Awesome! This is a super important fix.
Changes are well described and look good to me. Thanks for patiently figuring out the root cause and testing it with all the dependent changes.

There is one comment that I did want clarification:

"If we build moby-enginne & moby-cli with 1.19.12 compiler, it still does not work."

I understand the golang upgrade to "permit invalid host header patch"
I am assuming the moby* upgrades still rely on this behaviour; what exactly do the moby* upgrades get us w.r.t. this fix?

[mfrw]

There is one comment that I did want clarification:

"If we build moby-engine & moby-cli with 1.19.12 compiler, it still does not work."

The moby-* folks tested with go1.20.6 here. There are a few bits that are missing in go1.19.12 w.r.t go1.20.7 apart from the included patch, which is why it does not work.

I understand the golang upgrade to "permit invalid host header patch" I am assuming the moby* upgrades still rely on this behavior; what exactly do the moby* upgrades get us w.r.t. this fix?

The moby-* upgrades do not rely on this patch. The patch permit invalid host header patch is a backport of a fix that the go team admitted as a regression and has been cherry-picked on the release branch but not released. It is related to the same general issue, but is not the one that enables moby. Since we are upgrading go might as well take this patch proactively.

[anphel31]

Great work Falak, thanks!

[kanikanema]

LGTM.