Policy of which go versions to support

[orpheuslummis]

Which golang versions to target?

Currently running make test on go1.13.8 linux/amd64 which is the default on Ubuntu LTS 20.04 runs into errors https://gist.github.com/orpheuslummis/c075369a5eec72418c347c1a22246648

Some points from Andy, Shahzah, and Orpheus

• Linux distribution versions don't necessarily mean the most recent "stable" persay. It's which ever version was stable and the devs could package at the time of their distribution package releases. You could end up waiting years this way to bump up a version that might be fine to use. (Shahzad)
• Updating or building tools like go is pretty straightforward for devs regardless of the distribution
• Better assurity if a single version is picked (documented / broadcasted all over our build instructions) and support 'minimum' that version or above in Go's case. This way regardless of what distribution / OS / Container they build on, the version is always adhered to, since our CI will also use that version we can guarantee our builds won't fail using that version.
• There are many reasons as to why a dev would want to compile against specific versions - often it is for very inconvenient reasons (such as working for a very slow/fast moving org with ridged standards, or poor internal package management)
• There is an issue with the policy of always using the most latest go toolchain: it's vague, tomorrow a new unstable version comes and people might hop on using that version without us "gauranteeing" a build without errors.
• Go 1 has a compatibility guarantee ensuring that further versions of the Go 1 line are backwards compatible

Possibilities:

• Have a rule that will tell the user they are on a behind version of go or any other tool for that matter if they try to build with an older version that we expect (but for this we need to as a team have a consensus about the version we use).
• Having features but don't run by default, e.g. v1.18 fuzz tests

Implications:

• Having CI system and tests run for each (major) golang version we support

[orpheuslummis]

https://go.dev/doc/devel/release

Each major Go release is supported until there are two newer major releases. For example, Go 1.5 was supported until the Go 1.7 release, and Go 1.6 was supported until the Go 1.8 release. We fix critical problems, including critical security problems, in supported releases as needed by issuing minor revisions (for example, Go 1.6.1, Go 1.6.2, and so on).

Supported releases are the current one and the previous one. Using an older version opens up a surface area of unresolved security and critical problems.