mirror of
https://github.com/xcat2/xcat-dep.git
synced 2026-09-12 04:26:25 +00:00
Daniel Hilst
c05311b362
Closes the reproducibility/supply-chain gap left as a TODO: the Ubuntu goconserver
build resolved all transitive modules live from the network via 'go mod tidy', so the
compiled binary was not reproducible and the graph was unverified.
Commit goconserver/gomod/go.{mod,sum}, generated with the build's own pinned toolchain
(go 1.25.12) at REF=6166fe5, with the etcd backend removed (its coreos/bbolt dep, now
go.etcd.io/bbolt, breaks 'go mod tidy') and kr/pty replaced by creack/pty -- exactly the
steps the build performs. sbuild.pl now overlays the committed pair into the cloned tree
and builds with GOFLAGS=-mod=mod, so modules are downloaded but PINNED + integrity-checked
by go.sum; no 'go mod tidy'. Verified on xcat-master-ub: both entrypoints (goconserver.go,
cmd/congo.go) compile CGO-free against the committed go.sum. gomod/README.md documents
regeneration. Mirrors the EL branch's pinning model (its go.sum is generated with a
different Go, so a fresh Ubuntu-toolchain pair is used rather than copying it).
Signed-off-by: Daniel Hilst <392820+dhilst@users.noreply.github.com>
Pinned go.mod / go.sum for the goconserver build
These pin the Go module graph for goconserver at the commit built by ../sbuild.pl
(REF=6166fe5ec1c5b3c20475e322a9f0e8e93c87e45f). sbuild.pl overlays them into the freshly
cloned upstream tree and compiles with GOFLAGS=-mod=mod, so modules are downloaded from the Go
proxy but pinned and integrity-checked by go.sum — the build is reproducible, with no
go mod tidy at build time (which would float transitive versions from the network).
Generated with the same pinned toolchain the build uses (GO_PIN in ../sbuild.pl, currently
go 1.25.12), so go.mod's go directive matches — do not copy the EL branch's gomod/ (it is
generated with a different Go and pins slightly different minor versions).
Regenerate (when bumping REF or GO_PIN, or a dependency)
On a host with network, using the pinned toolchain:
REF=6166fe5ec1c5b3c20475e322a9f0e8e93c87e45f
git clone https://github.com/xcat2/goconserver gcsrc && cd gcsrc
git checkout "$REF"
rm -rf storage/etcd.go storage/etcd/ # the build drops the broken etcd backend
[ -f go.mod ] || go mod init github.com/xcat2/goconserver # only if upstream ships no go.mod
go mod edit -replace github.com/kr/pty=github.com/creack/pty@v1.1.21
go mod tidy
cp go.mod go.sum <this dir>
Notes:
kr/pty → creack/ptyfixes console fork (pty.StartsetsCttyin a way Go ≥1.15 rejects).- The etcd removal is required: goconserver's etcd storage backend drags in
github.com/coreos/bbolt, which now declares its module path asgo.etcd.io/bbolt, sogo mod tidyaborts on it. The build removesstorage/etcd*anyway (CGO-free static console server), so the pinned graph omits it.