M121: docker: rename vendor.mod to go.mod for OSV scanning Grep-on-Borg's OpenSourceMetadataSignal and OSV-Scalibr only discover Go module dependencies from files named go.mod. On cos/release-R121, upstream Moby stores its Go module manifest as vendor.mod (and vendor.sum), causing third_party/docker to be skipped by the Go dependency CVE scanner. Rename vendor.mod and vendor.sum to go.mod and go.sum and update the helper scripts in hack/ to use go.mod directly while keeping hack/with-go-mod.sh's GO111MODULE=on wrapper for the ebuild build. BUG=b/536013518 TEST=./hack/vendor.sh vendor && GO111MODULE=off ./hack/with-go-mod.sh go list -mod=vendor ./cmd/dockerd ./cmd/docker-proxy RELEASE_NOTE=None cos-patch: bug Change-Id: I5ac2be91634ccd5365cb7086f415578c22ab9ecc
diff --git a/.gitattributes b/.gitattributes index 4f15441..9dd7ef0 100644 --- a/.gitattributes +++ b/.gitattributes
@@ -1,3 +1 @@ Dockerfile* linguist-language=Dockerfile -vendor.mod linguist-language=Go-Module -vendor.sum linguist-language=Go-Checksums
diff --git a/vendor.mod b/go.mod similarity index 97% rename from vendor.mod rename to go.mod index 2f2cd1d..7228525 100644 --- a/vendor.mod +++ b/go.mod
@@ -1,7 +1,3 @@ -// 'vendor.mod' enables use of 'go mod vendor' to managed 'vendor/' directory. -// There is no 'go.mod' file, as that would imply opting in for all the rules -// around SemVer, which this repo cannot abide by as it uses CalVer. - module github.com/docker/docker go 1.23.0
diff --git a/vendor.sum b/go.sum similarity index 100% rename from vendor.sum rename to go.sum
diff --git a/hack/buildkit-ref b/hack/buildkit-ref index 280bb0e..c57e993 100755 --- a/hack/buildkit-ref +++ b/hack/buildkit-ref
@@ -7,9 +7,9 @@ buildkit_pkg=github.com/moby/buildkit -# get buildkit version from vendor.mod -buildkit_ref=$(./hack/with-go-mod.sh go list -mod=mod -modfile=vendor.mod -u -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' "$buildkit_pkg") -buildkit_repo=$(./hack/with-go-mod.sh go list -mod=mod -modfile=vendor.mod -u -m -f '{{if .Replace}}{{.Replace.Path}}{{else}}{{.Path}}{{end}}' "$buildkit_pkg") +# get buildkit version from go.mod +buildkit_ref=$(./hack/with-go-mod.sh go list -mod=mod -u -m -f '{{if .Replace}}{{.Replace.Version}}{{else}}{{.Version}}{{end}}' "$buildkit_pkg") +buildkit_repo=$(./hack/with-go-mod.sh go list -mod=mod -u -m -f '{{if .Replace}}{{.Replace.Path}}{{else}}{{.Path}}{{end}}' "$buildkit_pkg") buildkit_repo=${buildkit_repo#github.com/} if [[ "${buildkit_ref}" == *-*-* ]]; then
diff --git a/hack/dockerfiles/generate-files.Dockerfile b/hack/dockerfiles/generate-files.Dockerfile index 6e99dc4..b7ac48f 100644 --- a/hack/dockerfiles/generate-files.Dockerfile +++ b/hack/dockerfiles/generate-files.Dockerfile
@@ -35,12 +35,12 @@ RUN --mount=from=src,source=/out,target=.,rw \ --mount=type=cache,target=/root/.cache/go-build <<EOT set -ex - ./hack/with-go-mod.sh go install -v -mod=vendor -modfile=vendor.mod \ + ./hack/with-go-mod.sh go install -v -mod=vendor \ github.com/gogo/protobuf/protoc-gen-gogo \ github.com/gogo/protobuf/protoc-gen-gogofaster \ github.com/gogo/protobuf/protoc-gen-gogoslick \ github.com/golang/protobuf/protoc-gen-go - ./hack/with-go-mod.sh go build -v -mod=vendor -modfile=vendor.mod \ + ./hack/with-go-mod.sh go build -v -mod=vendor \ -o /usr/bin/pluginrpc-gen \ ./pkg/plugins/pluginrpc-gen EOT
diff --git a/hack/dockerfiles/govulncheck.Dockerfile b/hack/dockerfiles/govulncheck.Dockerfile index 444624b..fb667c2 100644 --- a/hack/dockerfiles/govulncheck.Dockerfile +++ b/hack/dockerfiles/govulncheck.Dockerfile
@@ -17,8 +17,6 @@ RUN --mount=type=bind,target=.,rw <<EOT set -ex mkdir /out - ln -s vendor.mod go.mod - ln -s vendor.sum go.sum govulncheck -format ${FORMAT} ./... | tee /out/govulncheck.out if [ "${FORMAT}" = "sarif" ]; then # Make sure "results" field is defined in SARIF output otherwise GitHub Code Scanning
diff --git a/hack/make/.binary b/hack/make/.binary index 37c73d9..17c5dbe 100644 --- a/hack/make/.binary +++ b/hack/make/.binary
@@ -94,7 +94,7 @@ if [ -n "$DOCKER_DEBUG" ]; then set -x fi - ./hack/with-go-mod.sh go build -mod=vendor -modfile=vendor.mod -o "$DEST/$BINARY_FULLNAME" "${BUILDFLAGS[@]}" -ldflags "$LDFLAGS $LDFLAGS_STATIC $DOCKER_LDFLAGS" -gcflags="${GCFLAGS}" "$GO_PACKAGE" + ./hack/with-go-mod.sh go build -mod=vendor -o "$DEST/$BINARY_FULLNAME" "${BUILDFLAGS[@]}" -ldflags "$LDFLAGS $LDFLAGS_STATIC $DOCKER_LDFLAGS" -gcflags="${GCFLAGS}" "$GO_PACKAGE" ) echo "Created binary: $DEST/$BINARY_FULLNAME"
diff --git a/hack/validate/no-module b/hack/validate/no-module deleted file mode 100755 index 917cc3e..0000000 --- a/hack/validate/no-module +++ /dev/null
@@ -1,17 +0,0 @@ -#!/usr/bin/env bash -# -# Check that no one is trying to commit a go.mod. - -SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -ROOTDIR="$(cd "${SCRIPTDIR}/../.." && pwd)" - -if test -e "${ROOTDIR}/go.mod"; then - { - echo 'FAIL: go.mod found in repository root!' - echo - echo ' Moby is not a Go module; please delete go.mod and try again.' - } >&2 - exit 1 -else - echo 'PASS: No go.mod found in repository root!' -fi
diff --git a/hack/validate/vendor b/hack/validate/vendor index a0b35d3..a7a3abf 100755 --- a/hack/validate/vendor +++ b/hack/validate/vendor
@@ -5,7 +5,7 @@ SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" source "${SCRIPTDIR}/.validate" -tidy_files=('vendor.mod' 'vendor.sum') +tidy_files=('go.mod' 'go.sum') vendor_files=("${tidy_files[@]}" 'vendor/') validate_vendor_tidy() {
diff --git a/hack/vendor.sh b/hack/vendor.sh index deaf74b..b072cf7 100755 --- a/hack/vendor.sh +++ b/hack/vendor.sh
@@ -1,7 +1,7 @@ #!/usr/bin/env bash # # This file is just a wrapper around the 'go mod vendor' tool. -# For updating dependencies you should change `vendor.mod` file in root of the +# For updating dependencies you should change `go.mod` file in root of the # project. set -e @@ -10,12 +10,12 @@ tidy() ( set -x - "${SCRIPTDIR}"/with-go-mod.sh go mod tidy -modfile vendor.mod + "${SCRIPTDIR}"/with-go-mod.sh go mod tidy ) vendor() ( set -x - "${SCRIPTDIR}"/with-go-mod.sh go mod vendor -modfile vendor.mod + "${SCRIPTDIR}"/with-go-mod.sh go mod vendor ) help() {
diff --git a/hack/with-go-mod.sh b/hack/with-go-mod.sh index 5071399..1367651 100755 --- a/hack/with-go-mod.sh +++ b/hack/with-go-mod.sh
@@ -1,33 +1,5 @@ #!/usr/bin/env bash -# -# This script is used to coerce certain commands which rely on the presence of -# a go.mod into working with our repository. It works by creating a fake -# go.mod, running a specified command (passed via arguments), and removing it -# when the command is finished. This script should be dropped when this -# repository is a proper Go module with a permanent go.mod. set -e -SCRIPTDIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)" -ROOTDIR="$(cd "${SCRIPTDIR}/.." && pwd)" - -if test -e "${ROOTDIR}/go.mod"; then - { - scriptname=$(basename "$0") - cat >&2 <<- EOF - $scriptname: WARN: go.mod exists in the repository root! - $scriptname: WARN: Using your go.mod instead of our generated version -- this may misbehave! - EOF - } >&2 -else - set -x - - tee "${ROOTDIR}/go.mod" >&2 <<- EOF - module github.com/docker/docker - - go 1.22.0 - EOF - trap 'rm -f "${ROOTDIR}/go.mod"' EXIT -fi - GO111MODULE=on GOTOOLCHAIN=local "$@"