In T256877 we 've identified that the golang images that kask is built on rely on golang 1.11 packages that have been installed from stretch-backports. That has been by design and has worked well up to now, but stretch-backports is being retired as stretch moves from oldstable to LTS.
kask's blubber.yaml relevant parts pasted below for easier reference.
base: docker-registry.wikimedia.org/wikimedia-stretch:latest lives: in: /go/src/gerrit.wikimedia.org/r/mediawiki/services/kask variants: build: base: docker-registry.wikimedia.org/golang:1.11.5-1 apt: packages: - make - golang-github-gocql-gocql-dev - golang-gopkg-yaml.v2-dev - golang-github-prometheus-client-golang-dev - golang-golang-x-tools - golint
The apt packages all exist in buster and with security support.
The base image is the one used to store the end artifact and for kask should not matter much as it is a golang app.
However the golang image that is used to build kask is still stretch based and we should obtain a buster one before moving forward with it.
We could just bump the image without changing the name, but that could lead to issues and it's probably better we follow a path similar to our python, nodejs images (e.g. https://dockerregistry.toolforge.org/buster-nodejs10-slim/tags/)