mirror of https://github.com/xcat2/xcat-dep.git synced 2026-09-12 12:36:23 +00:00

Files

T

Daniel Hilst a5432f28ef fix(goconserver): build inside a mock chroot, deps pinned by go.sum (no vendor tree) (PR #62 review #2 )

Completes @viniciusferrao's concern #2. Previously goconserver was built on the HOST with a runtime
`go mod tidy` against a clone of mutable `master` -- non-reproducible and non-hermetic.

- Rewrite goconserver/mockbuild.pl to build the rpm INSIDE a mock chroot via an SRPM: %build compiles
  in-chroot (BuildRequires: golang, GOTOOLCHAIN=local, CGO_ENABLED=0).
- Commit only the pinned module manifest goconserver/gomod/{go.mod,go.sum} (97 lines; go.mod carries
  the kr/pty -> creack/pty replace). The in-chroot build downloads the modules from the Go proxy
  (mock networking enabled) but is reproducible because go.sum integrity-checks every module -- no
  `go mod tidy`, and no committed vendor tree.
- goconserver is a CGO-free static binary and el8/el9 chroots ship too old a Go for 0.3.3, so always
  COMPILE in the el10 chroot for the arch; the Release still carries the target's dist tag (4.el<rel>),
  so every EL repo gets an identical, portable static binary. Verified on the build host: statically
  linked, no shared-lib deps, correct el<rel> tag while built in the el10 chroot.

Combined with the immutable-SHA pin + --release-suffix (40feffc), goconserver is now reproducible,
built in mock, and advances its NVR per CD run.

Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>

2026-08-10 13:16:53 -03:00

go.mod

fix(goconserver): build inside a mock chroot, deps pinned by go.sum (no vendor tree) (PR #62 review #2 )

2026-08-10 13:16:53 -03:00

go.sum

fix(goconserver): build inside a mock chroot, deps pinned by go.sum (no vendor tree) (PR #62 review #2 )

2026-08-10 13:16:53 -03:00

README.md

fix(goconserver): build inside a mock chroot, deps pinned by go.sum (no vendor tree) (PR #62 review #2 )

2026-08-10 13:16:53 -03:00

README.md

Pinned Go module manifest for goconserver

go.mod + go.sum pin goconserver's Go dependencies so the rpm build is reproducible without vendoring the whole dependency tree. The build runs inside a mock chroot (network enabled) and downloads the modules from the Go proxy at build time; go.sum integrity-checks every module, so the result is deterministic even though the deps are not committed.

Generated from xcat2/goconserver @ 6166fe5ec1c5b3c20475e322a9f0e8e93c87e45f (the pin in mockbuild-all.pl / goconserver/mockbuild.pl), with the archived github.com/kr/pty replaced by github.com/creack/pty@v1.1.21 and the etcd storage backend removed (xCAT uses file storage only).
To regenerate after bumping the goconserver pin: clone at the new SHA, remove storage/etcd*, go mod init github.com/xcat2/goconserver, go mod edit -replace github.com/kr/pty=github.com/creack/pty@v1.1.21, go mod tidy, then copy go.mod/go.sum here. (No go mod vendor needed.)