mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 12:36:23 +00:00
Daniel Hilst
c05311b362
Closes the reproducibility/supply-chain gap left as a TODO: the Ubuntu goconserver
build resolved all transitive modules live from the network via 'go mod tidy', so the
compiled binary was not reproducible and the graph was unverified.
Commit goconserver/gomod/go.{mod,sum}, generated with the build's own pinned toolchain
(go 1.25.12) at REF=6166fe5, with the etcd backend removed (its coreos/bbolt dep, now
go.etcd.io/bbolt, breaks 'go mod tidy') and kr/pty replaced by creack/pty -- exactly the
steps the build performs. sbuild.pl now overlays the committed pair into the cloned tree
and builds with GOFLAGS=-mod=mod, so modules are downloaded but PINNED + integrity-checked
by go.sum; no 'go mod tidy'. Verified on xcat-master-ub: both entrypoints (goconserver.go,
cmd/congo.go) compile CGO-free against the committed go.sum. gomod/README.md documents
regeneration. Mirrors the EL branch's pinning model (its go.sum is generated with a
different Go, so a fresh Ubuntu-toolchain pair is used rather than copying it).
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
28 lines
777 B
Modula-2
28 lines
777 B
Modula-2
module github.com/xcat2/goconserver
|
|
|
|
go 1.25.12
|
|
|
|
replace github.com/kr/pty => github.com/creack/pty v1.1.21
|
|
|
|
require (
|
|
github.com/golang/protobuf v1.5.4
|
|
github.com/gorilla/mux v1.8.1
|
|
github.com/kr/pty v0.0.0-00010101000000-000000000000
|
|
github.com/sirupsen/logrus v1.9.4
|
|
github.com/spf13/cobra v1.10.2
|
|
github.com/spf13/pflag v1.0.10
|
|
golang.org/x/crypto v0.55.0
|
|
golang.org/x/net v0.57.0
|
|
google.golang.org/grpc v1.83.0
|
|
gopkg.in/yaml.v2 v2.4.0
|
|
)
|
|
|
|
require (
|
|
github.com/inconshreveable/mousetrap v1.1.0 // indirect
|
|
golang.org/x/sys v0.47.0 // indirect
|
|
golang.org/x/term v0.45.0 // indirect
|
|
golang.org/x/text v0.41.0 // indirect
|
|
google.golang.org/genproto/googleapis/rpc v0.0.0-20260526163538-3dc84a4a5aaa // indirect
|
|
google.golang.org/protobuf v1.36.11 // indirect
|
|
)
|