From 4b9fd6ba5fdd5983a8bd114e9811402f14f6bdb1 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 14 Feb 2023 14:31:35 +0900
Subject: [PATCH 1/7] golangci-lint v1.51.1

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .github/workflows/ci.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 495f7da8b..0734a1bba 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -41,7 +41,7 @@ jobs:
       - uses: actions/checkout@v3
       - uses: golangci/golangci-lint-action@v3
         with:
-          version: v1.50.1
+          version: v1.51.1
           skip-cache: true
           args: --timeout=8m
 

From 8bf975b4fa173388e428e96f408a9f1e62836ad1 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 14 Feb 2023 15:06:44 +0900
Subject: [PATCH 2/7] lint: silence "type `HostFileConfig` is unused (unused)"

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 remotes/docker/config/hosts.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/remotes/docker/config/hosts.go b/remotes/docker/config/hosts.go
index 135b100fb..aa8ea959e 100644
--- a/remotes/docker/config/hosts.go
+++ b/remotes/docker/config/hosts.go
@@ -332,6 +332,7 @@ func parseHostsFile(baseDir string, b []byte) ([]hostConfig, error) {
 
 	// HACK: we want to keep toml parsing structures private in this package, however go-toml ignores private embedded types.
 	// so we remap it to a public type within the func body, so technically it's public, but not possible to import elsewhere.
+	//nolint:unused
 	type HostFileConfig = hostFileConfig
 
 	c := struct {

From 9b510e9a8fc4ec60bbe8500226aef88729dcbbe4 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 14 Feb 2023 15:22:24 +0900
Subject: [PATCH 3/7] lint: silence "SA1019: tar.TypeRegA has been
 deprecated... (staticheck)"

"SA1019: tar.TypeRegA has been deprecated since Go 1.11 and an alternative has been available since Go 1.1:
Use TypeReg instead. (staticcheck)"

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 archive/tar.go             | 1 +
 images/archive/importer.go | 1 +
 2 files changed, 2 insertions(+)

diff --git a/archive/tar.go b/archive/tar.go
index 0c44e123e..32edd3b3d 100644
--- a/archive/tar.go
+++ b/archive/tar.go
@@ -341,6 +341,7 @@ func createTarFile(ctx context.Context, path, extractDir string, hdr *tar.Header
 			}
 		}
 
+	//nolint:staticcheck // TypeRegA is deprecated but we may still receive an external tar with TypeRegA
 	case tar.TypeReg, tar.TypeRegA:
 		file, err := openFile(path, os.O_WRONLY|os.O_CREATE|os.O_TRUNC, hdrInfo.Mode())
 		if err != nil {
diff --git a/images/archive/importer.go b/images/archive/importer.go
index a4f6651cd..3ca88091c 100644
--- a/images/archive/importer.go
+++ b/images/archive/importer.go
@@ -95,6 +95,7 @@ func ImportIndex(ctx context.Context, store content.Store, reader io.Reader, opt
 			symlinks[hdr.Name] = path.Join(path.Dir(hdr.Name), hdr.Linkname)
 		}
 
+		//nolint:staticcheck // TypeRegA is deprecated but we may still receive an external tar with TypeRegA
 		if hdr.Typeflag != tar.TypeReg && hdr.Typeflag != tar.TypeRegA {
 			if hdr.Typeflag != tar.TypeDir {
 				log.G(ctx).WithField("file", hdr.Name).Debug("file type ignored")

From a9ac5f9cb5c49ef3c652ddc86aba2be5086ba49d Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 14 Feb 2023 15:26:08 +0900
Subject: [PATCH 4/7] lint: remove `//nolint:dupword` that are no longer needed

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 cmd/containerd-stress/density.go | 1 -
 pkg/cap/cap_linux_test.go        | 1 -
 2 files changed, 2 deletions(-)

diff --git a/cmd/containerd-stress/density.go b/cmd/containerd-stress/density.go
index 05b48c76e..756892917 100644
--- a/cmd/containerd-stress/density.go
+++ b/cmd/containerd-stress/density.go
@@ -204,7 +204,6 @@ type Stat struct {
 }
 
 func parseStat(data string) (stat Stat, err error) {
-	//nolint:dupword
 	// From proc(5), field 2 could contain space and is inside `(` and `)`.
 	// The following is an example:
 	// 89653 (gunicorn: maste) S 89630 89653 89653 0 -1 4194560 29689 28896 0 3 146 32 76 19 20 0 1 0 2971844 52965376 3920 18446744073709551615 1 1 0 0 0 0 0 16781312 137447943 0 0 0 17 1 0 0 0 0 0 0 0 0 0 0 0 0 0
diff --git a/pkg/cap/cap_linux_test.go b/pkg/cap/cap_linux_test.go
index 229302ba9..26a9142c7 100644
--- a/pkg/cap/cap_linux_test.go
+++ b/pkg/cap/cap_linux_test.go
@@ -24,7 +24,6 @@ import (
 	"github.com/stretchr/testify/assert"
 )
 
-//nolint:dupword
 const procPIDStatus = `Name:   cat
 Umask:  0022
 State:  R (running)

From d8b68e3ccc2c859f20f08041024af5be0565601b Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 14 Feb 2023 15:32:14 +0900
Subject: [PATCH 5/7] Stop using math/rand.Read and rand.Seed (deprecated in Go
 1.20)

From golangci-lint:

> SA1019: rand.Read has been deprecated since Go 1.20 because it
>shouldn't be used: For almost all use cases, crypto/rand.Read is more
>appropriate. (staticcheck)

> SA1019: rand.Seed has been deprecated since Go 1.20 and an alternative
>has been available since Go 1.0: Programs that call Seed and then expect
>a specific sequence of results from the global random source (using
>functions such as Int) can be broken when a dependency changes how
>much it consumes from the global random source. To avoid such breakages,
>programs that need a specific result sequence should use
>NewRand(NewSource(seed)) to obtain a random generator that other
>packages cannot access. (staticcheck)

See also:

- https://pkg.go.dev/math/rand@go1.20#Read
- https://pkg.go.dev/math/rand@go1.20#Seed

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 archive/compression/compression_test.go |  2 +-
 cmd/containerd/main.go                  |  3 +-
 cmd/ctr/main.go                         |  3 +-
 content/helpers.go                      |  4 +--
 content/local/store.go                  |  4 +--
 content/local/store_test.go             |  5 +--
 diff/walking/differ.go                  |  2 +-
 leases/id.go                            |  2 +-
 mount/losetup_linux.go                  |  4 +--
 pkg/cri/util/id.go                      |  2 +-
 pkg/kmutex/kmutex_test.go               | 13 +++----
 pkg/randutil/randutil.go                | 48 +++++++++++++++++++++++++
 pkg/seed/seed.go                        |  5 +++
 pkg/unpack/unpacker.go                  |  2 +-
 rootfs/apply.go                         |  2 +-
 snapshots/testsuite/helpers.go          |  4 +--
 snapshots/testsuite/testsuite.go        |  4 +--
 17 files changed, 80 insertions(+), 29 deletions(-)
 create mode 100644 pkg/randutil/randutil.go

diff --git a/archive/compression/compression_test.go b/archive/compression/compression_test.go
index 4de650335..fe1a62e35 100644
--- a/archive/compression/compression_test.go
+++ b/archive/compression/compression_test.go
@@ -20,8 +20,8 @@ import (
 	"bytes"
 	"compress/gzip"
 	"context"
+	"crypto/rand"
 	"io"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"runtime"
diff --git a/cmd/containerd/main.go b/cmd/containerd/main.go
index 887e8158a..ccd41c3c0 100644
--- a/cmd/containerd/main.go
+++ b/cmd/containerd/main.go
@@ -23,12 +23,13 @@ import (
 
 	"github.com/containerd/containerd/cmd/containerd/command"
 	"github.com/containerd/containerd/pkg/hasher"
-	"github.com/containerd/containerd/pkg/seed"
+	"github.com/containerd/containerd/pkg/seed" //nolint:staticcheck // Global math/rand seed is deprecated, but still used by external dependencies
 
 	_ "github.com/containerd/containerd/cmd/containerd/builtins"
 )
 
 func init() {
+	//nolint:staticcheck // Global math/rand seed is deprecated, but still used by external dependencies
 	seed.WithTimeAndRand()
 	crypto.RegisterHash(crypto.SHA256, hasher.NewSHA256)
 }
diff --git a/cmd/ctr/main.go b/cmd/ctr/main.go
index ca0def515..1845a73ed 100644
--- a/cmd/ctr/main.go
+++ b/cmd/ctr/main.go
@@ -23,13 +23,14 @@ import (
 
 	"github.com/containerd/containerd/cmd/ctr/app"
 	"github.com/containerd/containerd/pkg/hasher"
-	"github.com/containerd/containerd/pkg/seed"
+	"github.com/containerd/containerd/pkg/seed" //nolint:staticcheck // Global math/rand seed is deprecated, but still used by external dependencies
 	"github.com/urfave/cli"
 )
 
 var pluginCmds = []cli.Command{}
 
 func init() {
+	//nolint:staticcheck // Global math/rand seed is deprecated, but still used by external dependencies
 	seed.WithTimeAndRand()
 	crypto.RegisterHash(crypto.SHA256, hasher.NewSHA256)
 }
diff --git a/content/helpers.go b/content/helpers.go
index f74d72a93..5404109a6 100644
--- a/content/helpers.go
+++ b/content/helpers.go
@@ -21,12 +21,12 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"math/rand"
 	"sync"
 	"time"
 
 	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/pkg/randutil"
 	"github.com/opencontainers/go-digest"
 	ocispec "github.com/opencontainers/image-spec/specs-go/v1"
 )
@@ -123,7 +123,7 @@ func OpenWriter(ctx context.Context, cs Ingester, opts ...WriterOpt) (Writer, er
 			// error or abort. Requires asserting for an ingest manager
 
 			select {
-			case <-time.After(time.Millisecond * time.Duration(rand.Intn(retry))):
+			case <-time.After(time.Millisecond * time.Duration(randutil.Intn(retry))):
 				if retry < 2048 {
 					retry = retry << 1
 				}
diff --git a/content/local/store.go b/content/local/store.go
index 27aff14a4..baae3565b 100644
--- a/content/local/store.go
+++ b/content/local/store.go
@@ -20,7 +20,6 @@ import (
 	"context"
 	"fmt"
 	"io"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"strconv"
@@ -32,6 +31,7 @@ import (
 	"github.com/containerd/containerd/errdefs"
 	"github.com/containerd/containerd/filters"
 	"github.com/containerd/containerd/log"
+	"github.com/containerd/containerd/pkg/randutil"
 	"github.com/sirupsen/logrus"
 
 	"github.com/opencontainers/go-digest"
@@ -473,7 +473,7 @@ func (s *store) Writer(ctx context.Context, opts ...content.WriterOpt) (content.
 			lockErr = nil
 			break
 		}
-		time.Sleep(time.Millisecond * time.Duration(rand.Intn(1<<count)))
+		time.Sleep(time.Millisecond * time.Duration(randutil.Intn(1<<count)))
 	}
 
 	if lockErr != nil {
diff --git a/content/local/store_test.go b/content/local/store_test.go
index 35cb143ed..48ad54a0b 100644
--- a/content/local/store_test.go
+++ b/content/local/store_test.go
@@ -20,10 +20,10 @@ import (
 	"bufio"
 	"bytes"
 	"context"
+	"crypto/rand"
 	_ "crypto/sha256" // required for digest package
 	"fmt"
 	"io"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"reflect"
@@ -35,6 +35,7 @@ import (
 	"github.com/containerd/containerd/content"
 	"github.com/containerd/containerd/content/testsuite"
 	"github.com/containerd/containerd/errdefs"
+	"github.com/containerd/containerd/pkg/randutil"
 	"github.com/containerd/containerd/pkg/testutil"
 
 	"github.com/opencontainers/go-digest"
@@ -268,7 +269,7 @@ func generateBlobs(t checker, nblobs, maxsize int64) map[digest.Digest][]byte {
 	blobs := map[digest.Digest][]byte{}
 
 	for i := int64(0); i < nblobs; i++ {
-		p := make([]byte, rand.Int63n(maxsize))
+		p := make([]byte, randutil.Int63n(maxsize))
 
 		if _, err := rand.Read(p); err != nil {
 			t.Fatal(err)
diff --git a/diff/walking/differ.go b/diff/walking/differ.go
index 8d40a461f..784d41139 100644
--- a/diff/walking/differ.go
+++ b/diff/walking/differ.go
@@ -18,11 +18,11 @@ package walking
 
 import (
 	"context"
+	"crypto/rand"
 	"encoding/base64"
 	"errors"
 	"fmt"
 	"io"
-	"math/rand"
 	"time"
 
 	"github.com/containerd/containerd/archive"
diff --git a/leases/id.go b/leases/id.go
index 8781a1d72..8f5dc93f3 100644
--- a/leases/id.go
+++ b/leases/id.go
@@ -17,9 +17,9 @@
 package leases
 
 import (
+	"crypto/rand"
 	"encoding/base64"
 	"fmt"
-	"math/rand"
 	"time"
 )
 
diff --git a/mount/losetup_linux.go b/mount/losetup_linux.go
index 700d1773a..567ebb4e9 100644
--- a/mount/losetup_linux.go
+++ b/mount/losetup_linux.go
@@ -19,11 +19,11 @@ package mount
 import (
 	"errors"
 	"fmt"
-	"math/rand"
 	"os"
 	"strings"
 	"time"
 
+	"github.com/containerd/containerd/pkg/randutil"
 	"golang.org/x/sys/unix"
 )
 
@@ -152,7 +152,7 @@ func setupLoop(backingFile string, param LoopParams) (*os.File, error) {
 			// with EBUSY when trying to set it up.
 			if strings.Contains(err.Error(), ebusyString) {
 				// Fallback a bit to avoid live lock
-				time.Sleep(time.Millisecond * time.Duration(rand.Intn(retry*10)))
+				time.Sleep(time.Millisecond * time.Duration(randutil.Intn(retry*10)))
 				continue
 			}
 			return nil, err
diff --git a/pkg/cri/util/id.go b/pkg/cri/util/id.go
index 90f762ba7..194bab264 100644
--- a/pkg/cri/util/id.go
+++ b/pkg/cri/util/id.go
@@ -17,8 +17,8 @@
 package util
 
 import (
+	"crypto/rand"
 	"encoding/hex"
-	"math/rand"
 )
 
 // GenerateID generates a random unique id.
diff --git a/pkg/kmutex/kmutex_test.go b/pkg/kmutex/kmutex_test.go
index a6fd751ee..6bfff477a 100644
--- a/pkg/kmutex/kmutex_test.go
+++ b/pkg/kmutex/kmutex_test.go
@@ -18,21 +18,16 @@ package kmutex
 
 import (
 	"context"
-	"math/rand"
 	"runtime"
 	"strconv"
 	"sync"
 	"testing"
 	"time"
 
-	"github.com/containerd/containerd/pkg/seed"
+	"github.com/containerd/containerd/pkg/randutil"
 	"github.com/stretchr/testify/assert"
 )
 
-func init() {
-	seed.WithTimeAndRand()
-}
-
 func TestBasic(t *testing.T) {
 	t.Parallel()
 
@@ -60,7 +55,7 @@ func TestBasic(t *testing.T) {
 				waitLock = true
 				break
 			}
-			time.Sleep(time.Duration(rand.Int63n(100)) * time.Millisecond)
+			time.Sleep(time.Duration(randutil.Int63n(100)) * time.Millisecond)
 		}
 		assert.Equal(t, waitLock, true)
 	}
@@ -130,7 +125,7 @@ func TestMultileAcquireOnKeys(t *testing.T) {
 			for i := 0; i < nloops; i++ {
 				km.Lock(ctx, key)
 
-				time.Sleep(time.Duration(rand.Int63n(100)) * time.Nanosecond)
+				time.Sleep(time.Duration(randutil.Int63n(100)) * time.Nanosecond)
 
 				km.Unlock(key)
 			}
@@ -161,7 +156,7 @@ func TestMultiAcquireOnSameKey(t *testing.T) {
 			for i := 0; i < nloops; i++ {
 				km.Lock(ctx, key)
 
-				time.Sleep(time.Duration(rand.Int63n(100)) * time.Nanosecond)
+				time.Sleep(time.Duration(randutil.Int63n(100)) * time.Nanosecond)
 
 				km.Unlock(key)
 			}
diff --git a/pkg/randutil/randutil.go b/pkg/randutil/randutil.go
new file mode 100644
index 000000000..f4b657d7d
--- /dev/null
+++ b/pkg/randutil/randutil.go
@@ -0,0 +1,48 @@
+/*
+   Copyright The containerd Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+*/
+
+// Package randutil provides utilities for [cyrpto/rand].
+package randutil
+
+import (
+	"crypto/rand"
+	"math"
+	"math/big"
+)
+
+// Int63n is similar to [math/rand.Int63n] but uses [crypto/rand.Reader] under the hood.
+func Int63n(n int64) int64 {
+	b, err := rand.Int(rand.Reader, big.NewInt(n))
+	if err != nil {
+		panic(err)
+	}
+	return b.Int64()
+}
+
+// Int63 is similar to [math/rand.Int63] but uses [crypto/rand.Reader] under the hood.
+func Int63() int64 {
+	return Int63n(math.MaxInt64)
+}
+
+// Intn is similar to [math/rand.Intn] but uses [crypto/rand.Reader] under the hood.
+func Intn(n int) int {
+	return int(Int63n(int64(n)))
+}
+
+// Int is similar to [math/rand.Int] but uses [crypto/rand.Reader] under the hood.
+func Int() int {
+	return int(Int63())
+}
diff --git a/pkg/seed/seed.go b/pkg/seed/seed.go
index 4a5829a8e..b8442a88e 100644
--- a/pkg/seed/seed.go
+++ b/pkg/seed/seed.go
@@ -14,6 +14,9 @@
    limitations under the License.
 */
 
+// Package seed provides an initializer for the global [math/rand] seed.
+//
+// Deprecated: Do not rely on the global seed.
 package seed
 
 import (
@@ -23,6 +26,8 @@ import (
 
 // WithTimeAndRand seeds the global math rand generator with nanoseconds
 // XOR'ed with a crypto component if available for uniqueness.
+//
+// Deprecated: Do not rely on the global seed.
 func WithTimeAndRand() {
 	var (
 		b [4]byte
diff --git a/pkg/unpack/unpacker.go b/pkg/unpack/unpacker.go
index 8d72da5ef..3c766403a 100644
--- a/pkg/unpack/unpacker.go
+++ b/pkg/unpack/unpacker.go
@@ -18,11 +18,11 @@ package unpack
 
 import (
 	"context"
+	"crypto/rand"
 	"encoding/base64"
 	"encoding/json"
 	"errors"
 	"fmt"
-	"math/rand"
 	"strconv"
 	"sync"
 	"sync/atomic"
diff --git a/rootfs/apply.go b/rootfs/apply.go
index b3f388e64..35eae6d63 100644
--- a/rootfs/apply.go
+++ b/rootfs/apply.go
@@ -18,9 +18,9 @@ package rootfs
 
 import (
 	"context"
+	"crypto/rand"
 	"encoding/base64"
 	"fmt"
-	"math/rand"
 	"time"
 
 	"github.com/containerd/containerd/diff"
diff --git a/snapshots/testsuite/helpers.go b/snapshots/testsuite/helpers.go
index c327b7706..4315db8ff 100644
--- a/snapshots/testsuite/helpers.go
+++ b/snapshots/testsuite/helpers.go
@@ -19,10 +19,10 @@ package testsuite
 import (
 	"context"
 	"fmt"
-	"math/rand"
 	"os"
 
 	"github.com/containerd/containerd/mount"
+	"github.com/containerd/containerd/pkg/randutil"
 	"github.com/containerd/containerd/snapshots"
 	"github.com/containerd/continuity/fs/fstest"
 )
@@ -49,7 +49,7 @@ func applyToMounts(m []mount.Mount, work string, a fstest.Applier) (err error) {
 // createSnapshot creates a new snapshot in the snapshotter
 // given an applier to run on top of the given parent.
 func createSnapshot(ctx context.Context, sn snapshots.Snapshotter, parent, work string, a fstest.Applier) (string, error) {
-	n := fmt.Sprintf("%p-%d", a, rand.Int())
+	n := fmt.Sprintf("%p-%d", a, randutil.Int())
 	prepare := fmt.Sprintf("%s-prepare", n)
 
 	m, err := sn.Prepare(ctx, prepare, parent, opt)
diff --git a/snapshots/testsuite/testsuite.go b/snapshots/testsuite/testsuite.go
index cf793d1cd..aa84c3945 100644
--- a/snapshots/testsuite/testsuite.go
+++ b/snapshots/testsuite/testsuite.go
@@ -21,7 +21,6 @@ import (
 	//nolint:revive // go-digest needs the blank import. See https://github.com/opencontainers/go-digest#usage.
 	_ "crypto/sha256"
 	"fmt"
-	"math/rand"
 	"os"
 	"path/filepath"
 	"sort"
@@ -32,6 +31,7 @@ import (
 	"github.com/containerd/containerd/log/logtest"
 	"github.com/containerd/containerd/mount"
 	"github.com/containerd/containerd/namespaces"
+	"github.com/containerd/containerd/pkg/randutil"
 	"github.com/containerd/containerd/pkg/testutil"
 	"github.com/containerd/containerd/snapshots"
 	"github.com/containerd/continuity/fs/fstest"
@@ -847,7 +847,7 @@ func checkFileFromLowerLayer(ctx context.Context, t *testing.T, snapshotter snap
 }
 
 func closeTwice(ctx context.Context, t *testing.T, snapshotter snapshots.Snapshotter, work string) {
-	n := fmt.Sprintf("closeTwice-%d", rand.Int())
+	n := fmt.Sprintf("closeTwice-%d", randutil.Int())
 	prepare := fmt.Sprintf("%s-prepare", n)
 
 	// do some dummy ops to modify the snapshotter internal state

From 281f89a9dcccefc9cac831bb4c9343f516e117d8 Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Tue, 14 Feb 2023 14:09:46 +0900
Subject: [PATCH 6/7] go.mod: go 1.19

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 go.mod                    | 2 +-
 integration/client/go.mod | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/go.mod b/go.mod
index 2b1240f3f..e409cb6c6 100644
--- a/go.mod
+++ b/go.mod
@@ -1,6 +1,6 @@
 module github.com/containerd/containerd
 
-go 1.18
+go 1.19
 
 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1
diff --git a/integration/client/go.mod b/integration/client/go.mod
index 8546a63c7..b93857e6a 100644
--- a/integration/client/go.mod
+++ b/integration/client/go.mod
@@ -1,6 +1,6 @@
 module github.com/containerd/containerd/integration/client
 
-go 1.18
+go 1.19
 
 require (
 	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230106234847-43070de90fa1

From 90d004ae8cda70cab9c7fb1aeddb0d36fc57eece Mon Sep 17 00:00:00 2001
From: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
Date: Thu, 16 Feb 2023 02:04:08 +0900
Subject: [PATCH 7/7] Go 1.20.1

Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
---
 .github/workflows/build-test-images.yml | 2 +-
 .github/workflows/ci.yml                | 4 ++--
 .github/workflows/codeql.yml            | 2 +-
 .github/workflows/fuzz.yml              | 2 ++
 .github/workflows/images.yml            | 2 +-
 .github/workflows/nightly.yml           | 2 +-
 .github/workflows/release.yml           | 2 +-
 BUILDING.md                             | 2 +-
 Vagrantfile                             | 2 +-
 contrib/Dockerfile.test                 | 2 +-
 script/setup/prepare_env_windows.ps1    | 2 +-
 11 files changed, 13 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/build-test-images.yml b/.github/workflows/build-test-images.yml
index 6bb3d1a4e..429ecaadc 100644
--- a/.github/workflows/build-test-images.yml
+++ b/.github/workflows/build-test-images.yml
@@ -43,7 +43,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.19.6"
+          go-version: "1.20.1"
 
       - uses: actions/checkout@v3
         with:
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 0734a1bba..0aebecf49 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,7 +12,7 @@ on:
 env:
   # Go version we currently use to build containerd across all CI.
   # Note: don't forget to update `Binaries` step, as it contains the matrix of all supported Go versions.
-  GO_VERSION: "1.19.6"
+  GO_VERSION: "1.20.1"
 
 permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
@@ -207,7 +207,7 @@ jobs:
     strategy:
       matrix:
         os: [ubuntu-20.04, macos-12, windows-2019, windows-2022]
-        go-version: ["1.19.6", "1.18.10"]
+        go-version: ["1.20.1", "1.19.6"]
     steps:
       - uses: actions/setup-go@v3
         with:
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
index 1cc241697..2b4a9540a 100644
--- a/.github/workflows/codeql.yml
+++ b/.github/workflows/codeql.yml
@@ -34,7 +34,7 @@ jobs:
 
       - uses: actions/setup-go@v3
         with:
-          go-version: 1.19.6
+          go-version: 1.20.1
 
       # Initializes the CodeQL tools for scanning.
       - name: Initialize CodeQL
diff --git a/.github/workflows/fuzz.yml b/.github/workflows/fuzz.yml
index 74cebb16f..7c84dd60d 100644
--- a/.github/workflows/fuzz.yml
+++ b/.github/workflows/fuzz.yml
@@ -42,6 +42,8 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
+          # FIXME: go-fuzz fails with Go 1.20: `cgo_unix_cgo_res.cgo2.c:(.text+0x32): undefined reference to `__res_search'`
+          # https://github.com/containerd/containerd/pull/8103#issuecomment-1429256152
           go-version: 1.18
       - uses: actions/checkout@v3
       - run: script/go-test-fuzz.sh
diff --git a/.github/workflows/images.yml b/.github/workflows/images.yml
index cf9dc3cdd..f9d69a8f6 100644
--- a/.github/workflows/images.yml
+++ b/.github/workflows/images.yml
@@ -28,7 +28,7 @@ jobs:
     steps:
       - uses: actions/setup-go@v3
         with:
-          go-version: "1.19.6"
+          go-version: "1.20.1"
 
       - uses: actions/checkout@v3
         with:
diff --git a/.github/workflows/nightly.yml b/.github/workflows/nightly.yml
index ee5c2b5d5..3636cdb66 100644
--- a/.github/workflows/nightly.yml
+++ b/.github/workflows/nightly.yml
@@ -7,7 +7,7 @@ on:
       - ".github/workflows/nightly.yml"
 
 env:
-  GO_VERSION: "1.19.6"
+  GO_VERSION: "1.20.1"
 
 permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 86056184b..9a618bdd2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,7 +13,7 @@ on:
 name: Release
 
 env:
-  GO_VERSION: "1.19.6"
+  GO_VERSION: "1.20.1"
 
 permissions: # added using https://github.com/step-security/secure-workflows
   contents: read
diff --git a/BUILDING.md b/BUILDING.md
index cbb9fbfe5..ad3b374a1 100644
--- a/BUILDING.md
+++ b/BUILDING.md
@@ -14,7 +14,7 @@ This doc includes:
 
 To build the `containerd` daemon, and the `ctr` simple test client, the following build system dependencies are required:
 
-* Go 1.18.x or above
+* Go 1.19.x or above
 * Protoc 3.x compiler and headers (download at the [Google protobuf releases page](https://github.com/protocolbuffers/protobuf/releases))
 * Btrfs headers and libraries for your distribution. Note that building the btrfs driver can be disabled via the build tag `no_btrfs`, removing this dependency.
 
diff --git a/Vagrantfile b/Vagrantfile
index 171565bad..08cbc4a07 100644
--- a/Vagrantfile
+++ b/Vagrantfile
@@ -101,7 +101,7 @@ EOF
   config.vm.provision "install-golang", type: "shell", run: "once" do |sh|
     sh.upload_path = "/tmp/vagrant-install-golang"
     sh.env = {
-        'GO_VERSION': ENV['GO_VERSION'] || "1.19.6",
+        'GO_VERSION': ENV['GO_VERSION'] || "1.20.1",
     }
     sh.inline = <<~SHELL
         #!/usr/bin/env bash
diff --git a/contrib/Dockerfile.test b/contrib/Dockerfile.test
index 6c8cc3d8e..e356417bb 100644
--- a/contrib/Dockerfile.test
+++ b/contrib/Dockerfile.test
@@ -29,7 +29,7 @@
 #   docker run --privileged containerd-test
 # ------------------------------------------------------------------------------
 
-ARG GOLANG_VERSION=1.19.6
+ARG GOLANG_VERSION=1.20.1
 ARG GOLANG_IMAGE=golang
 
 FROM ${GOLANG_IMAGE}:${GOLANG_VERSION} AS golang
diff --git a/script/setup/prepare_env_windows.ps1 b/script/setup/prepare_env_windows.ps1
index 7a1c78ea9..83a663bbc 100644
--- a/script/setup/prepare_env_windows.ps1
+++ b/script/setup/prepare_env_windows.ps1
@@ -5,7 +5,7 @@
 # lived test environment.
 Set-MpPreference -DisableRealtimeMonitoring:$true
 
-$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.19.6"; make = ""; nssm = "" }
+$PACKAGES= @{ mingw = "10.2.0"; git = ""; golang = "1.20.1"; make = ""; nssm = "" }
 
 Write-Host "Downloading chocolatey package"
 curl.exe -L "https://packages.chocolatey.org/chocolatey.0.10.15.nupkg" -o 'c:\choco.zip'