finish off Go 1.22 upgrade

This patch cleans up some stragglers in the CircleCI config that were
still running on 1.19.

We also change `go.mod` to include the patch portion of the Go version.
Including `x.y.z`, not just `x.y` is what the Go 1.22 tooling (and, I
believe 1.21) does and expects. If we don't include the patch version,
various third party tools like GitHub's CodeQL can break (see
github/codeql#15647 for the last time I ran
into this). This go.mod version change is actually what led me to the
other missing CircleCI version bumps as changing go.mod broke those
CircleCI jobs.

Along the way, we also have to install go 1.22 into the separate linting
job in CircleCI. We couldn't use the CircleCI go 1.22 image because it
wasn't able to `apt-get update` successfully (something about `partial`
not being right). We then had to use the `BASH_ENV` hack in there to set
the `PATH` correctly. The `golang-1.22` dpkg doesn't add its `go` to the
`PATH`, so we need to adjust `PATH` ourselves. And then we have to use
that specific BASH_ENV hack, because CircleCI's `environment` directives
doesn't know what the value of `PATH` is, so attempting something like
`environment: "${PATH}:/usr/lib/go-1.22/bin"` gets you a `PATH` with
only the Go 1.22 binaries.

I've made AUT-158 to consolidate our go linting stuff and avoid some of
these problems. Some (not all) of the rationale for AUT-158 will be
mooted by a move to GitHub Actions.

Along the way, I also ran `go mod tidy` which correctly noted that the
the google/uuid dep is now a direct dep. Hilariously, this is the change
I did first.

.circleci/config.yml

@@ -12,9 +12,13 @@ jobs:
     steps:
       - run:
           name: install dependencies
+          # TODO(AUT-158): installing Go differently for tests than linting is bad
           command: |
+            echo "deb http://deb.debian.org/debian/ bookworm-backports main" > /etc/apt/sources.list.d/bookworm-backports.list
+            echo "deb-src http://deb.debian.org/debian/ bookworm-backports main" >> /etc/apt/sources.list.d/bookworm-backports.list
             apt-get update
-            apt-get install -y golang build-essential git ca-certificates libltdl-dev
+            apt-get install -y golang-1.22 build-essential git ca-certificates libltdl-dev
+            echo 'export PATH="${PATH}:/usr/lib/go-1.22/bin"' >> $BASH_ENV
       - checkout
       - run:
           name: check crypto11 not used in signers
@@ -38,7 +42,7 @@ jobs:
           command: |
             make vet
             make -C tools/autograph-monitor vet
-            make -C verifier/contentsignature vet 
+            make -C verifier/contentsignature vet
       - run:
           name: run staticcheck
           command: |
@@ -50,7 +54,7 @@ jobs:
   unit-test:
     # based on the official golang image with more docker stuff
     docker:
-      - image: cimg/go:1.19
+      - image: cimg/go:1.22
         auth:
           username: $DOCKER_USER
           password: $DOCKER_PASS
@@ -80,7 +84,7 @@ jobs:
   build-integrationtest-verify:
     # based on the official golang image with more docker stuff
     docker:
-      - image: cimg/go:1.19
+      - image: cimg/go:1.22
         auth:
           username: $DOCKER_USER
           password: $DOCKER_PASS

go.mod

@@ -1,13 +1,14 @@
 module github.com/mozilla-services/autograph
 
-go 1.22
+go 1.22.5
 
 require (
 	github.com/DataDog/datadog-go v3.7.2+incompatible
 	github.com/ThalesIgnite/crypto11 v0.1.0
 	github.com/aws/aws-lambda-go v1.27.0
 	github.com/aws/aws-sdk-go v1.42.15
 	github.com/golang/mock v1.6.0
+	github.com/google/uuid v1.6.0
 	github.com/gorilla/mux v1.8.0
 	github.com/hashicorp/golang-lru v0.5.4
 	github.com/lib/pq v1.10.4
@@ -40,7 +41,6 @@ require (
 	github.com/golang/glog v0.0.0-20160126235308-23def4e6c14b // indirect
 	github.com/golang/groupcache v0.0.0-20190702054246-869f871628b6 // indirect
 	github.com/golang/protobuf v1.3.2 // indirect
-	github.com/google/uuid v1.6.0 // indirect
 	github.com/googleapis/gax-go/v2 v2.0.5 // indirect
 	github.com/goware/prefixer v0.0.0-20160118172347-395022866408 // indirect
 	github.com/howeyc/gopass v0.0.0-20170109162249-bf9dde6d0d2c // indirect