Verify sha256sum for kubelet, vagrant zip and go binary

[manuelbuil]

Proposed Changes

Verify the sha256sum for both Kubelet, vagrant zip and go binary.

It also updates the GO version

Types of Changes

Security imrpovement

Verification

Testing

Linked Issues

#13886

User-Facing Change

Further Comments

[cwayne18]

I think we're meant to pin the sha directly in-file, pulling it along with the artifacts wouldnt stop a trivy-esque attack

cc @macedogm

That said it kubectl is compromised it's basically game over isn't it

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 22.32%. Comparing base (f1deb4e) to head (921ed20).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #13889      +/-   ##
==========================================
- Coverage   22.38%   22.32%   -0.06%     
==========================================
  Files         193      193              
  Lines       15631    15631              
==========================================
- Hits         3499     3490       -9     
- Misses      11650    11661      +11     
+ Partials      482      480       -2     

Flag	Coverage Δ
unittests	22.32% <ø> (-0.06%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[manuelbuil]

I think we're meant to pin the sha directly in-file, pulling it along with the artifacts wouldnt stop a trivy-esque attack

cc @macedogm

That said it kubectl is compromised it's basically game over isn't it

Do you have an example of how it should look like? I have used this approach in many other PRs

[cwayne18]

Something along these lines:

k3s-io/klipper-helm#121

[farazkh-srti]

@cwayne18 can sha also be compromised for these upstream binaries? is that the reason behind pinning in-file?