calico-tinygo: bump TinyGo 0.34.0 -> 0.39.0 (Go 1.25.11)#860
Open
dimitri-nicolo wants to merge 3 commits into
Open
calico-tinygo: bump TinyGo 0.34.0 -> 0.39.0 (Go 1.25.11)#860dimitri-nicolo wants to merge 3 commits into
dimitri-nicolo wants to merge 3 commits into
Conversation
dimitri-nicolo
force-pushed
the
bump-calico-tinygo-0.39.0
branch
from
July 4, 2026 03:31
dc0c69d to
fb436b3
Compare
There was a problem hiding this comment.
Pull request overview
This PR updates the calico/tinygo toolchain image to TinyGo 0.39.0 (Go 1.25.11) by switching the build to base directly on tinygo/tinygo, and adds a ctype/wctype compatibility archive to keep downstream wasm linking working with prebuilt archives that still reference musl ctype symbols.
Changes:
- Switch
calico/tinygoimage construction to useFROM tinygo/tinygo:${TINYGO_VERSION}and pass the TinyGo version fromversions.yamlvia a Makefile build-arg. - Replace explicit Go/TinyGo tarball download+checksum logic with upstream-image pinning, and document the new pinning model.
- Add
libctypecompat.ato the image and update CI fixture build flags to link it via-extldflags.
Reviewed changes
Copilot reviewed 6 out of 7 changed files in this pull request and generated 4 comments.
Show a summary per file
| File | Description |
|---|---|
| images/Makefile | Passes TinyGo version from versions.yaml as a Docker build-arg for the image build. |
| images/calico-tinygo/versions.yaml | Updates the TinyGo pin to 0.39.0 and rewrites pinning rationale/documentation. |
| images/calico-tinygo/Dockerfile | Re-bases on upstream tinygo/tinygo, installs required tools, and bakes in the ctype compat archive. |
| images/calico-tinygo/ctypecompat/regen.sh | Adds a regeneration script to rebuild libctypecompat.a from an older image’s libc.a. |
| images/calico-tinygo/ctypecompat/README.md | Documents why the shim exists and how consumers should link it. |
| .semaphore/semaphore.yml | Updates the fixture build to pass -extldflags=$CALICO_TINYGO_CTYPE_COMPAT during wasm linking. |
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
TinyGo 0.39 is the first release with Go 1.25 support, needed by downstream gateway/coraza-wasm so it can adopt golang.org/x/net v0.55.0 (CVE-2026-25680), which declares `go 1.25.0`. Under the previous TinyGo 0.34 (a Go 1.23-class toolchain) that module fails to build. TinyGo >= 0.38's release binary is dynamically linked against a newer libstdc++/glibc than AlmaLinux 9 provides: the linux-arm64 binary needs GLIBCXX_3.4.30 and GLIBC_2.36/2.38, but EL9 ships glibc 2.34 + libstdc++ 3.4.29 and has no runtime libstdc++.so.6 with 3.4.30 (gcc-toolset ships only static libs). Rather than graft a newer libstdc++ onto the EL9 base (glibc-skew dead end), base the image on the upstream tinygo/tinygo image, which already carries a matching go + tinygo + libstdc++ on both amd64 and arm64. This also removes the need to download and checksum the Go and TinyGo tarballs -- the base image tag (from versions.yaml, passed via the TINYGO_VERSION build-arg) is now the single reproducible pin.
dimitri-nicolo
force-pushed
the
bump-calico-tinygo-0.39.0
branch
from
July 6, 2026 22:30
fb436b3 to
d756fe8
Compare
dimitri-nicolo
force-pushed
the
bump-calico-tinygo-0.39.0
branch
from
July 7, 2026 00:09
d756fe8 to
4503c0a
Compare
Comment on lines
+176
to
+180
| # ghcr.io/webassembly/wabt does not exist -- wabt only publishes | ||
| # binary tarballs, never a container image, on any registry. | ||
| # Fetch wasm-objdump directly instead. | ||
| curl -sfL "https://github.com/WebAssembly/wabt/releases/download/1.0.36/wabt-1.0.36-ubuntu-20.04.tar.gz" \ | ||
| | tar xz -C /tmp --strip-components=2 wabt-1.0.36/bin/wasm-objdump |
Comment on lines
+18
to
+20
| ARG TINYGO_VERSION | ||
| FROM calico/tinygo@sha256:9ff0bed2e3598f695a2fc6222be901eb0f3a0153549b82d28aa640c8487e1854 AS ctypecompat | ||
| RUN set -eux; \ |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Bumps the
calico/tinygotoolchain image from TinyGo 0.34.0 (Go 1.23.12) to TinyGo 0.39.0 (Go 1.25.11).Why
TinyGo 0.39 is the first release with Go 1.25 support, needed by downstream
gateway/coraza-wasminprojectcalico/calicoso it can adoptgolang.org/x/net v0.55.0(CVE-2026-25680), which declaresgo 1.25.0. Under TinyGo 0.34 (a Go 1.23-class toolchain) that module fails to build withrequires go version 1.19 through 1.23, got go1.25.The bundled Go is bumped 1.23.12 → 1.25.11 in lockstep — TinyGo 0.39's host
goinvocation is capped at 1.25.x.Checksums
TinyGo tarball sha256s verified against the upstream release assets; Go sha256s against the go.dev release manifest. Validated by building the image locally (
docker build --build-arg TARGETARCH=amd64):sha256sum -cpasses for both Go and TinyGo, andgo version/tinygo versionreportgo1.25.11/tinygo 0.39.0.Downstream note
TinyGo 0.38 rewrote how it builds its bundled wasi-libc (
builder/wasilibc.go) and dropped the muslctype/*.csources. Consumers that link prebuilt wasm archives referencing ctype externs (coraza-wasm'sgo-re2/nottinygcarchives) must supply those symbols themselves — handled ingateway/coraza-wasm/tools/ctypecompat/in the calico PR that consumes this image.