feat: bump Go to 1.22.4

Also ignore kspp checks which were updated in main, but we'll keep
things same in release-1.7.

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
Signed-off-by: Noel Georgi <git@frezbo.dev>

Pkgfile

@@ -3,7 +3,7 @@
 format: v1alpha2
 
 vars:
-  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.7.0-2-g345db93
+  TOOLS_IMAGE: ghcr.io/siderolabs/tools:v1.7.0-3-g6c94771
 
   # renovate: datasource=github-releases depName=containernetworking/plugins
   cni_version: v1.4.1

kernel/build/scripts/filter-hardened-check.py

@@ -30,6 +30,10 @@
     'CONFIG_CFI_PERMISSIVE', # SideroLabs toolchain uses gcc, investigae more, see https://github.com/siderolabs/pkgs/issues/91
     'CONFIG_SPECULATION_MITIGATIONS', # Renamed in the kernel to 'CONFIG_CPU_MITIGATIONS'
     'CONFIG_EFI_DISABLE_PCI_DMA', # enabling this breaks boot with no visible error messages to debug (https://github.com/siderolabs/talos/issues/8743)
+    'CONFIG_RANDOM_KMALLOC_CACHES', # fixed in main, backwards compat in release-1.7
+    'CONFIG_SLAB_MERGE_DEFAULT', # fixed in main, backwards compat in release-1.7
+    'CONFIG_PAGE_TABLE_CHECK', # fixed in main, backwards compat in release-1.7
+    'CONFIG_PAGE_TABLE_CHECK_ENFORCED', # fixed in main, backwards compat in release-1.7
 }
 
 """
@@ -38,8 +42,11 @@
 IGNORE_VIOLATIONS_BY_ARCH = {
     'arm64': {
         'CONFIG_ARM64_BTI_KERNEL', # can't seem to enable this, probably because we're using gcc, see https://github.com/siderolabs/pkgs/issues/918
+        'CONFIG_UNWIND_PATCH_PAC_INTO_SCS', # this is a Clang feature, we use gcc
+    },
+    'amd64': {
+        'CONFIG_X86_USER_SHADOW_STACK', # fixed in main, backwards compat in release-1.7
     },
-    'amd64': {},
 }
 
 def main():