bottlerocket-os · piyush-jena · Oct 13, 2025 · Oct 10, 2025 · Oct 10, 2025 · Oct 3, 2025
diff --git a/Dockerfile b/Dockerfile
@@ -285,7 +285,7 @@ RUN \
 
 ARG HOST_ARCH
 ENV VENDOR="bottlerocket"
-ENV RUSTVER="1.88.0"
+ENV RUSTVER="1.90.0"
 
 USER builder
 WORKDIR /home/builder
@@ -495,14 +495,14 @@ ENV AWS_LC_FIPS_VER="3.0.0"
 USER root
 RUN dnf -y install golang
 
-ENV GO123VER="1.23.12"
-ENV GO124VER="1.24.6"
+ENV GO125VER="1.25.2"
+ENV GO124VER="1.24.8"
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
-FROM sdk-go-prep AS sdk-go-1.23-prep
+FROM sdk-go-prep AS sdk-go-1.25-prep
 
-ENV GOMAJOR="1.23"
+ENV GOMAJOR="1.25"
 
 USER builder
 
@@ -515,7 +515,7 @@ COPY ./patches/go-${GOMAJOR} /home/builder/patches-go
 COPY ./hashes/aws-lc /home/builder/hashes-aws-lc
 COPY ./patches/aws-lc /home/builder/patches-aws-lc
 
-RUN ./prep-go.sh --go-version=${GO123VER}
+RUN ./prep-go.sh --go-version=${GO125VER}
 
 WORKDIR /home/builder/aws-lc/build
 COPY ./configs/aws-lc/* .
@@ -546,34 +546,34 @@ COPY ./helpers/aws-lc/* .
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
-FROM sdk-go-1.23-prep AS sdk-go-1.23-aws-lc-gnu-x86_64
+FROM sdk-go-1.25-prep AS sdk-go-1.25-aws-lc-gnu-x86_64
 ENV ARCH="x86_64"
 ENV LIBC="gnu"
 ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
 RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
-FROM sdk-go-1.23-prep AS sdk-go-1.23-aws-lc-gnu-aarch64
-COPY --chown=0:0 --from=sdk-go-1.23-aws-lc-gnu-x86_64 /etc/group /etc/group
+FROM sdk-go-1.25-prep AS sdk-go-1.25-aws-lc-gnu-aarch64
+COPY --chown=0:0 --from=sdk-go-1.25-aws-lc-gnu-x86_64 /etc/group /etc/group
 ENV ARCH="aarch64"
 ENV LIBC="gnu"
 ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
 RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
-FROM sdk-go-1.23-prep AS sdk-go-1.23-aws-lc-musl-x86_64
-COPY --chown=0:0 --from=sdk-go-1.23-aws-lc-gnu-aarch64 /etc/group /etc/group
+FROM sdk-go-1.25-prep AS sdk-go-1.25-aws-lc-musl-x86_64
+COPY --chown=0:0 --from=sdk-go-1.25-aws-lc-gnu-aarch64 /etc/group /etc/group
 ENV ARCH="x86_64"
 ENV LIBC="musl"
 ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
 RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sdk-go"
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
-FROM sdk-go-1.23-prep AS sdk-go-1.23-aws-lc-musl-aarch64
-COPY --chown=0:0 --from=sdk-go-1.23-aws-lc-musl-x86_64 /etc/group /etc/group
+FROM sdk-go-1.25-prep AS sdk-go-1.25-aws-lc-musl-aarch64
+COPY --chown=0:0 --from=sdk-go-1.25-aws-lc-musl-x86_64 /etc/group /etc/group
 ENV ARCH="aarch64"
 ENV LIBC="musl"
 ENV TARGET="${ARCH}-bottlerocket-linux-${LIBC}"
@@ -616,28 +616,28 @@ RUN ./build-aws-lc.sh --arch="${ARCH}" --target="${TARGET}" --go-dir="${HOME}/sd
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
-FROM sdk-go-1.23-prep AS sdk-go-1.23
+FROM sdk-go-1.25-prep AS sdk-go-1.25
 
-COPY --from=sdk-go-1.23-aws-lc-gnu-x86_64 \
+COPY --from=sdk-go-1.25-aws-lc-gnu-x86_64 \
   /home/builder/aws-lc/build/goboringcrypto_linux_amd64.syso \
   /home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_amd64.syso
 
-COPY --from=sdk-go-1.23-aws-lc-gnu-aarch64 \
+COPY --from=sdk-go-1.25-aws-lc-gnu-aarch64 \
   /home/builder/aws-lc/build/goboringcrypto_linux_arm64.syso \
   /home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_arm64.syso
 
-COPY --from=sdk-go-1.23-aws-lc-musl-x86_64 \
+COPY --from=sdk-go-1.25-aws-lc-musl-x86_64 \
   /home/builder/aws-lc/build/goboringcrypto_linux_amd64.syso \
   /home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_musl_amd64.syso
 
-COPY --from=sdk-go-1.23-aws-lc-musl-aarch64 \
+COPY --from=sdk-go-1.25-aws-lc-musl-aarch64 \
   /home/builder/aws-lc/build/goboringcrypto_linux_arm64.syso \
   /home/builder/sdk-go/src/crypto/internal/boring/syso/goboringcrypto_linux_musl_arm64.syso
 
 COPY ./helpers/go/build-go.sh ./
 
 # Build Go - finally!
-RUN ./build-go.sh --go-version=${GO123VER}
+RUN ./build-go.sh --go-version=${GO125VER}
 
 # =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=   =^..^=
 
@@ -977,6 +977,7 @@ RUN \
     policycoreutils \
     protobuf-compiler \
     protobuf-devel \
+    python3-devel \
     python3-jinja2 \
     python3-virt-firmware \
     qemu-img \
@@ -1123,16 +1124,16 @@ COPY --chown=0:0 --from=sdk-rust \
   /usr/share/licenses/rust/
 
 # "sdk-go" has the Go toolchain and standard library builds.
-COPY --chown=0:0 --from=sdk-go-1.23 /home/builder/sdk-go/bin /usr/libexec/go-1.23/bin/
-COPY --chown=0:0 --from=sdk-go-1.23 /home/builder/sdk-go/lib /usr/libexec/go-1.23/lib/
-COPY --chown=0:0 --from=sdk-go-1.23 /home/builder/sdk-go/pkg /usr/libexec/go-1.23/pkg/
-COPY --chown=0:0 --from=sdk-go-1.23 /home/builder/sdk-go/src /usr/libexec/go-1.23/src/
-COPY --chown=0:0 --from=sdk-go-1.23 /home/builder/sdk-go/go.env /usr/libexec/go-1.23/go.env
-COPY --chown=0:0 --from=sdk-go-1.23 \
+COPY --chown=0:0 --from=sdk-go-1.25 /home/builder/sdk-go/bin /usr/libexec/go-1.25/bin/
+COPY --chown=0:0 --from=sdk-go-1.25 /home/builder/sdk-go/lib /usr/libexec/go-1.25/lib/
+COPY --chown=0:0 --from=sdk-go-1.25 /home/builder/sdk-go/pkg /usr/libexec/go-1.25/pkg/
+COPY --chown=0:0 --from=sdk-go-1.25 /home/builder/sdk-go/src /usr/libexec/go-1.25/src/
+COPY --chown=0:0 --from=sdk-go-1.25 /home/builder/sdk-go/go.env /usr/libexec/go-1.25/go.env
+COPY --chown=0:0 --from=sdk-go-1.25 \
   /home/builder/sdk-go/licenses/ \
-  /usr/share/licenses/go-1.23/
+  /usr/share/licenses/go-1.25/
 
-COPY --chown=0:0 --from=sdk-go-1.23 \
+COPY --chown=0:0 --from=sdk-go-1.25 \
   /home/builder/aws-lc/LICENSE \
   /usr/share/licenses/aws-lc/LICENSE
 
@@ -1149,7 +1150,7 @@ COPY --chown=0:0 --from=sdk-go-1.24 \
 # Create Go trees for the different glibc and musl builds of the AWS-LC syso.
 # Sync timestamps to avoid rebuilds of the Go standard library.
 RUN \
-  for v in 1.23 1.24 ; do \
+  for v in 1.24 1.25 ; do \
     find /usr/libexec/go-${v} -type f -exec touch -r /usr/libexec/go-${v}/bin/go {} \+ && \
     rsync -aq --link-dest=/usr/libexec/go-${v}/ /usr/libexec/go-${v}{,-musl}/ && \
     rm /usr/libexec/go-${v}/src/crypto/internal/boring/syso/goboringcrypto_linux_musl_{arm,amd}64.syso && \
@@ -1311,7 +1312,7 @@ USER builder
 WORKDIR /home/builder
 
 # Set the default Go major version.
-ENV GO_MAJOR="1.23"
+ENV GO_MAJOR="1.24"
 
 # In NSS 3.101, lib::pkix was enabled as the default X.509 validator.
 # This causes signature checking of secureboot artifacts to fail during build.

diff --git a/configs/rust/targets/aarch64-bottlerocket-linux-gnu.json b/configs/rust/targets/aarch64-bottlerocket-linux-gnu.json
@@ -6,6 +6,7 @@
   "dynamic-linking": true,
   "env": "gnu",
   "features": "+v8a,+outline-atomics",
+  "frame-pointer": "non-leaf",
   "has-rpath": true,
   "has-thread-local": true,
   "linker-flavor": "gnu-cc",

diff --git a/configs/rust/targets/aarch64-bottlerocket-linux-musl.json b/configs/rust/targets/aarch64-bottlerocket-linux-musl.json
@@ -6,7 +6,8 @@
   "data-layout": "e-m:e-p270:32:32-p271:32:32-p272:64:64-i8:8:32-i16:16:32-i64:64-i128:128-n32:64-S128-Fn32",
   "dynamic-linking": true,
   "env": "musl",
-  "features": "+v8a",
+  "features": "+v8a,+outline-atomics",
+  "frame-pointer": "non-leaf",
   "has-rpath": true,
   "has-thread-local": true,
   "linker-flavor": "gnu-cc",

diff --git a/configs/rust/targets/x86_64-bottlerocket-linux-gnu.json b/configs/rust/targets/x86_64-bottlerocket-linux-gnu.json
@@ -1,7 +1,6 @@
 {
   "arch": "x86_64",
   "cpu": "x86-64",
-  "crt-objects-fallback": "false",
   "crt-static-respected": true,
   "data-layout": "e-m:e-p270:32:32-p271:32:32-p272:64:64-i64:64-i128:128-f80:128-n8:16:32:64-S128",
   "dynamic-linking": true,

diff --git a/hashes/go-1.23 b/hashes/go-1.23
diff --git a/hashes/go-1.24 b/hashes/go-1.24
@@ -1,2 +1,2 @@
-# https://go.dev/dl/go1.24.6.src.tar.gz
-SHA512 (go1.24.6.src.tar.gz) = 65f535c722f4a0f6111c9ed829677621e456a5bc969ccb99009da1ade096b2b1a648a44ccfa913543677c220baeaf1afe634ba8ba165d9474ac9433ac249c914
+# https://go.dev/dl/go1.24.8.src.tar.gz
+SHA512 (go1.24.8.src.tar.gz) = 3233c75223b310d14ccb1846e192d0d4867e8ecc1091c9853bc536f5051cdfb8682ae2f86b5caec77b1f3cbfaf5864c9231fb3a756471ff77d7a904e79bb3f15
diff --git a/hashes/go-1.25 b/hashes/go-1.25
@@ -0,0 +1,2 @@
+# https://go.dev/dl/go1.25.2.src.tar.gz
+SHA512 (go1.25.2.src.tar.gz) = 2700ceca314bb78b8ff97aa8703442b60eceb3acbad46b7959739bb0399174f27af372c7f72cd1adb83997adacbf43e2e2572e85fa5cf2a18271d0ef1ee0b8b4
diff --git a/hashes/rust b/hashes/rust
@@ -1,15 +1,15 @@
-# https://static.rust-lang.org/dist/rustc-1.88.0-src.tar.xz
-SHA512 (rustc-1.88.0-src.tar.xz) = e6c62af2953f49462b2369e9551b12f2bec114577f90e3e76049636da4279b1e7f4d53bc6896f5d0d4715d90ef6d29dacff529a45690ffac6af62ad64600db40
-### See https://raw.githubusercontent.com/rust-lang/rust/1.88.0/src/stage0 for what to use below. ###
-# https://static.rust-lang.org/dist/2025-05-15/rust-std-1.87.0-x86_64-unknown-linux-gnu.tar.xz
-SHA512 (rust-std-1.87.0-x86_64-unknown-linux-gnu.tar.xz) = c45196829834b35b438dad3d258a47aa6dcbdd9860a97758c78cfdbe2eccfa11ef874efbf4744e6b18acb36aafab176a692b536d7e7eec41afd2fbd2d5bad14c
-# https://static.rust-lang.org/dist/2025-05-15/rustc-1.87.0-x86_64-unknown-linux-gnu.tar.xz
-SHA512 (rustc-1.87.0-x86_64-unknown-linux-gnu.tar.xz) = a97436e605f5fc8ac37d50ed72caf10e33a5d344e86610039258060405cae2a895e001217fc53669d74e7eed1869eafd5dcc02242746b7421485e0ac3b55d0f3
-# https://static.rust-lang.org/dist/2025-05-15/cargo-1.87.0-x86_64-unknown-linux-gnu.tar.xz
-SHA512 (cargo-1.87.0-x86_64-unknown-linux-gnu.tar.xz) = 780e09200481259ba1ea721da2653db9549e5e108a6aad010137704c06ac054386919a3beef41b64f39a1a26f332713556a775fedec3493418390455449e91b9
-# https://static.rust-lang.org/dist/2025-05-15/rust-std-1.87.0-aarch64-unknown-linux-gnu.tar.xz
-SHA512 (rust-std-1.87.0-aarch64-unknown-linux-gnu.tar.xz) = 61ead3966ece5ff7b614fb5806f65abb754b9608cef03752cbe18dbdf1ab39498ccfb80d78f4d78d4b9115a9b6c776139664ecbc04a074fb0af6f8989f98472f
-# https://static.rust-lang.org/dist/2025-05-15/rustc-1.87.0-aarch64-unknown-linux-gnu.tar.xz
-SHA512 (rustc-1.87.0-aarch64-unknown-linux-gnu.tar.xz) = c0cabdc54ff7019e113ba8882352b86b021dbc15a93e74156a15932e1d65136847d449a34652195a67739ac47dd99d7d950cf4122457f7bde446ffd62a7db876
-# https://static.rust-lang.org/dist/2025-05-15/cargo-1.87.0-aarch64-unknown-linux-gnu.tar.xz
-SHA512 (cargo-1.87.0-aarch64-unknown-linux-gnu.tar.xz) = 27cf77e277038ffa8e09927a22dfca8db9d3a3fc2e6ca84a80bd99891b17f842f1d05b2fa9a3362094d2ca705e636511251838da06a802cf34d265e378be2e96
+# https://static.rust-lang.org/dist/rustc-1.90.0-src.tar.xz
+SHA512 (rustc-1.90.0-src.tar.xz) = fb0798b4c7450754db2fcbb641202909d209c6db2d9181d7df7282217b8320dc52f5e9853de9d7bdb79177f1f920389450cab07674dea5fb5501eaab5816662a
+### See https://raw.githubusercontent.com/rust-lang/rust/1.90.0/src/stage0 for what to use below. ###
+# https://static.rust-lang.org/dist/2025-08-07/rust-std-1.89.0-x86_64-unknown-linux-gnu.tar.xz
+SHA512 (rust-std-1.89.0-x86_64-unknown-linux-gnu.tar.xz) = 691afd3d11b7c447f00c21d0b1ef95d6b08b30031d1c059d9a8c978b886573e2aed7d9bc9ae5777702f3fa085eb4129031c6036101bd0ac3f4a230e518a01f3c
+# https://static.rust-lang.org/dist/2025-08-07/rustc-1.89.0-x86_64-unknown-linux-gnu.tar.xz
+SHA512 (rustc-1.89.0-x86_64-unknown-linux-gnu.tar.xz) = 2d2cbeb29b6bab7c6ca0ad8fe3f33ded9844a4c285e3d773b4d74a560fe26b0cbaaa037a25c0bcb73f646dfe8ae4d29acffb42e3d0ca28fa9782d33834b78748
+# https://static.rust-lang.org/dist/2025-08-07/cargo-1.89.0-x86_64-unknown-linux-gnu.tar.xz
+SHA512 (cargo-1.89.0-x86_64-unknown-linux-gnu.tar.xz) = 9595d0138412fd462603cbb96854ea5bd2a9159a36eb7e2f047efb7a3b180873b82a3726979448dfcc92b1f4d0b98014cb0a4644e668ef2aebc3589b2453ac60
+# https://static.rust-lang.org/dist/2025-08-07/rust-std-1.89.0-aarch64-unknown-linux-gnu.tar.xz
+SHA512 (rust-std-1.89.0-aarch64-unknown-linux-gnu.tar.xz) = 82de82906fd8069ec5805e09c9e819ab7ceff8a0957443b568187d00e76d0a8552f5c4daba62a3ffd74470f64ebcd77c154728d8a37934fc58a234a293177313
+# https://static.rust-lang.org/dist/2025-08-07/rustc-1.89.0-aarch64-unknown-linux-gnu.tar.xz
+SHA512 (rustc-1.89.0-aarch64-unknown-linux-gnu.tar.xz) = 0ca24793dbb9c18c8680d4422e8f5ccc5fff836debe56d2189870ddc4d8ad957d1d92f377f6225f8b981ea67670aac900e26343d342a4c044ba9f0d0826826b0
+# https://static.rust-lang.org/dist/2025-08-07/cargo-1.89.0-aarch64-unknown-linux-gnu.tar.xz
+SHA512 (cargo-1.89.0-aarch64-unknown-linux-gnu.tar.xz) = c6c560baa9ebdf942624614f6ff48089fcbd0863fa97f442d0da343db29d43fbe5592b23d059f6e1217e08cb2abde76a91e9dbd8d494ba50a9b8bf577119acd2
Original file line number	Diff line number	Diff line change
		@@ -0,0 +1,2 @@
		# https://go.dev/dl/go1.25.2.src.tar.gz
		SHA512 (go1.25.2.src.tar.gz) = 2700ceca314bb78b8ff97aa8703442b60eceb3acbad46b7959739bb0399174f27af372c7f72cd1adb83997adacbf43e2e2572e85fa5cf2a18271d0ef1ee0b8b4