bug: Build with a supported Go version and make static binaries #6

Blocker: yes. Fix this before the server-monitoring work starts. The blocker is the old Go version and its vulnerabilities. The glibc item is not a blocker, because FlyWP does not support Ubuntu 20.04.

Defect

• The v0.1.1 fly-linux-amd64 release binary is dynamically linked. The amd64 runner compiled it natively. Thus, cgo was on (CGO_ENABLED=1).
• This binary needs GLIBC_2.34 or later on the host.
• The arm64 binary is static, because the build cross-compiled it.
• The release build used go1.22.12. This Go version gets no more security fixes.
• govulncheck -mode=binary found 15 known vulnerabilities in the standard library of the v0.1.1 amd64 binary. They are in net/http, crypto/tls, crypto/x509 and net/url.
• go.mod declares go 1.22.0.
• The release workflow (.github/workflows/build.yml) uses Go 1.22. If go.mod declares a newer version, Go 1.22 downloads exactly that version, for example go1.27.0. It does not download the latest patch release.
• The module files are not tidy. fatih/color and yaml.v2 are direct imports, but go.mod marks them // indirect.
• The dependencies are old:
  • cobra 1.8.1 (latest: 1.10.2)
  • fatih/color 1.17.0 (latest: 1.19.0)
  • x/sys 0.18.0 (latest: 0.48.0)
• The release binaries contain debug information.

Cost

• The amd64 binary depends on the glibc version of the host, but the arm64 binary does not. FlyWP does not support Ubuntu 20.04. Thus, this dependency has no effect on supported servers at this time.
• Monitoring, HTTPS events and self-update will use net/http and crypto/tls. With this toolchain, they use code with known vulnerabilities.
• The binaries are larger than necessary.

Benefit of the fix

• The amd64 and arm64 binaries are both static. They do not depend on the glibc version of the host.
• The TLS and HTTP code has the latest security fixes.
• The dependency list in go.mod is correct.

Fix

1. In build.sh, use CGO_ENABLED=0 go build -trimpath -ldflags "-s -w -X …".
2. In go.mod, set a supported Go version. The current stable versions are Go 1.27.1 and Go 1.26.8.
3. Update the dependencies. Then, run go mod tidy.
4. In .github/workflows/build.yml, set go-version to the minor version in go.mod, for example '1.27'. Add check-latest: true. Then, each release uses the latest patch release of that version.

Caution

CAUTION: DO NOT CHANGE THE NAMES OR THE CONTENTS OF THE RELEASE ASSETS. IF YOU CHANGE THEM, THE INSTALLED CLIS CANNOT RUN fly update.

• This issue changes build.sh and the release workflow.
• Each asset must keep the name fly-linux-<arch>.tar.gz. Each asset must contain a binary with the name fly-linux-<arch>.
• Refer to enhancement(ci): add checks for pull requests and replace the archived release actions #7 for the full rules.

Completion checks

• file shows that the two binaries are statically linked.
• govulncheck finds no vulnerabilities in the source or in the binary.
• go mod tidy makes no change.
• go version -m on the release binary shows the latest patch release of the Go version in go.mod.