feat: bump Go to 1.22.4

Also ignore kspp checks which were updated in main, but we'll keep things same in release-1.7. Signed-off-by: Andrey Smirnov <[email protected]> Signed-off-by: Noel Georgi <[email protected]>
siderolabs · Jun 18, 2024 · c58ed7f · c58ed7f
1 parent ab5d66b
commit c58ed7f
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 2 deletions.
diff --git a/Pkgfile b/Pkgfile
@@ -3,7 +3,7 @@
 format: v1alpha2
 
 vars:
-  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.7.0-2-g345db93
+  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.7.0-3-g6c94771
 
   # renovate: datasource=github-releases depName=containernetworking/plugins
   cni_version: v1.4.1

diff --git a/kernel/build/scripts/filter-hardened-check.py b/kernel/build/scripts/filter-hardened-check.py
@@ -30,6 +30,10 @@
     'CONFIG_CFI_PERMISSIVE', # SideroLabs toolchain uses gcc, investigae more, see https://github.com/siderolabs/pkgs/issues/91
     'CONFIG_SPECULATION_MITIGATIONS', # Renamed in the kernel to 'CONFIG_CPU_MITIGATIONS'
     'CONFIG_EFI_DISABLE_PCI_DMA', # enabling this breaks boot with no visible error messages to debug (https://github.com/siderolabs/talos/issues/8743)
+    'CONFIG_RANDOM_KMALLOC_CACHES', # fixed in main, backwards compat in release-1.7
+    'CONFIG_SLAB_MERGE_DEFAULT', # fixed in main, backwards compat in release-1.7
+    'CONFIG_PAGE_TABLE_CHECK', # fixed in main, backwards compat in release-1.7
+    'CONFIG_PAGE_TABLE_CHECK_ENFORCED', # fixed in main, backwards compat in release-1.7
 }
 
 """
@@ -38,8 +42,11 @@
 IGNORE_VIOLATIONS_BY_ARCH = {
     'arm64': {
         'CONFIG_ARM64_BTI_KERNEL', # can't seem to enable this, probably because we're using gcc, see https://github.com/siderolabs/pkgs/issues/918
+        'CONFIG_UNWIND_PATCH_PAC_INTO_SCS', # this is a Clang feature, we use gcc
+    },
+    'amd64': {
+        'CONFIG_X86_USER_SHADOW_STACK', # fixed in main, backwards compat in release-1.7
     },
-    'amd64': {},
 }
 
 def main():