[Tracking] Migrate gnmi containers and Go modules to Debian Trixie

[sigabrtv1-ui]

Overview

This issue tracks the migration of gnmi-related containers and Go modules from Debian Bookworm to Debian Trixie (Go 1.24).

Motivation

Debian Trixie ships Go 1.24 (vs Bookworm's Go 1.19). The migration enables:

• Staying on a supported Debian release
• Access to Go 1.21–1.24 language features and improvements
• Up-to-date stdlib security patches (crypto, TLS, etc.)

Scope

1. sonic-gnmi (first, unblocks everything)

• Bump go directive: 1.19 → 1.23
• Remove unnecessary stdlib version pins (x/crypto, x/sys, grpc, protobuf)
• Add openconfig/goyang pin to maintain compat with pinned ygot v0.7.1
• Drop redundant fsnotify CloseWrite vendor patch (natively supported in fsnotify v1.5+)
• PR: [go] Bump go version to 1.23, remove stdlib version pins sonic-gnmi#611

2. sonic-mgmt-common

• Add go 1.21 directive (currently has go 1.19)
• Run go mod tidy for consistency
• PR: [go] Bump go version to 1.21 for Debian Trixie compatibility sonic-mgmt-common#208

3. sonic-buildimage

• Migrate docker-sonic-gnmi, docker-gnmi-sidecar, docker-gnmi-watchdog to Trixie base image
• Switch from SONIC_BOOKWORM_DOCKERS → SONIC_TRIXIE_DOCKERS
• Bump submodule SHAs once above PRs merge
• PR: [gnmi] Migrate gnmi, telemetry, and watchdog containers to Debian Trixie #25957

Order

sonic-mgmt-common (#208) → sonic-gnmi (#611) → sonic-buildimage (#25957)

Deferred

• ygot/goyang upgrade: ygot v0.7.1 is pinned because sonic-mgmt-common/translib/ocbinds uses YANG-generated code against the old API. Regenerating from YANG models is a separate effort.
• slave.mk SONIC_TRIXIE_DOCKERS path handling: Multi-env build path vars not yet wired. Follows same gap in Brcm containers migrate to trixie #25942.

References

• Add base, config-engine, and swss-shared layers for Trixie #25184 — Add Trixie base layers (config-engine, swss-shared)
• Brcm containers migrate to trixie #25942 — Brcm containers migrate to Trixie

[sigabrtv1-ui]

Additional findings from local build verification

goyang pin (sonic-gnmi PR #611)

When removing the openconfig/ygot v0.7.1 and openconfig/gnmi pins, go mod tidy upgraded openconfig/goyang from v0.0.0-20200309174518 → v1.6.0. This breaks ygot v0.7.1 because goyang v1.6.0 removed yang.MaxNumber, yang.MinNumber, and yang.Number.Kind which the old ygot relies on.

As a result, PR #611 adds a new explicit pin for goyang to keep it compatible with the pinned ygot:

github.com/openconfig/goyang => github.com/openconfig/goyang v0.0.0-20200309174518-a00bece872fc

This is a necessary side effect of keeping the ygot pin. Removing all three (gnmi, ygot, goyang) is the correct long-term fix but requires regenerating translib/ocbinds from YANG models — deferred to the ygot upgrade project.

---

fsnotify patch removal (sonic-gnmi PR #611)

patches/0004-CloseWrite-event-support.patch added CloseWrite and MovedTo event support to fsnotify. These events are natively supported since fsnotify v1.5.0. After removing the stdlib version pins, go mod tidy naturally upgraded fsnotify from v1.4.7 → v1.6.0, which made the patch fail to apply (offset/line number mismatch).

Since the functionality is already upstream, the patch application was removed from the Makefile. No code behavior change.

---

Submodule update dependency / merge ordering concern

This is worth flagging for reviewers of PR #25957 (sonic-buildimage):

PR #25957 updates the container rules to use Trixie base images but does not yet bump the sonic-gnmi or sonic-mgmt-common submodule SHAs. The submodule SHA bump can only happen after PRs #611 (sonic-gnmi) and #208 (sonic-mgmt-common) are merged upstream.

This creates a dependency that some reviewers may not want to accept:

• PR [gnmi] Migrate gnmi, telemetry, and watchdog containers to Debian Trixie #25957 can be merged (it only changes .mk and Dockerfile.j2 files)
• But the actual end-to-end trixie build of the gnmi docker will not work until the submodule SHAs are bumped in a follow-up commit
• Reviewers who want the submodule bump included may choose to hold [gnmi] Migrate gnmi, telemetry, and watchdog containers to Debian Trixie #25957 until [docker-syncd-*-rpc]: Remove sysctl setting which is not used anymore #611 and Add VFAT support in initramfs #208 land

Recommended merge order:

sonic-mgmt-common #208  →  sonic-gnmi #611  →  sonic-buildimage submodule bump  →  sonic-buildimage #25957

Or if reviewers are comfortable with staged merges:

sonic-mgmt-common #208  →  sonic-gnmi #611  →  sonic-buildimage #25957 + submodule bump (single PR)