diff options
author | Patrick Steinhardt <psteinhardt@gitlab.com> | 2022-10-10 17:09:20 +0300 |
---|---|---|
committer | Patrick Steinhardt <psteinhardt@gitlab.com> | 2022-10-10 17:10:31 +0300 |
commit | 0cd4b87513b7d76d30c2d424161d3635b13dba21 (patch) | |
tree | 937b459ccb6ede730fa7510b3c8a2cfb67f12d48 /tools/goimports/go.mod | |
parent | 8751343f230ee12a009546c8e6e5ad7c3c09db61 (diff) |
Makefile: Track Go tool versions via separate Go modules
Right now we track versions of our Go tooling directly in our Makefile.
While this is simple, it has several drawbacks:
- We're susceptible to supply-chain attacks in case an adversary
manages to replace the code used to build any of our tools.
- We cannot use proper dependencies in our Makefile, which adds the
need for `*.version` files.
- It is hard to build the tools outside of our Makefile as we don't
have a way to properly pull in the correct version.
- Upgrading our tooling requires us to manually hunt down new
releases for all of our tools.
We can fix these issues by following the approach that is efficially
recommended by the Go project [1]: every tool has its own Go module in
`tools/` with a "tool.go" file that imports the tool of interest. Like
this we can use Go's normal tooling to keep track of versions:
- We record hashes of the tool's sources as well as all of its
dependencies, making supply-chain attacks almost impossible.
- We can now provide proper dependencies in our Makefile: every tool
depends on "tool.go", "go.mod" and "go.sum". If any of them
changes we need to rebuild.
- The tools can be installed in the correct version simply by using
`go install` with the correct `go.mod` file.
- Upgrading tools is as simple as running `go get -u`, so no more
manual hunting for new versions.
While these benefits are great on their own already, we can go even
further with this refactoring: now that each tool has its own `go.mod`
file we can adapt the Renovate bot to pick up these files. This means
that we don't have to remember upgrading at all anymore, but instead the
bot will automatically upgrade them for us.
[1]: https://github.com/golang/go/wiki/Modules#how-can-i-track-tool-dependencies-for-a-module
Diffstat (limited to 'tools/goimports/go.mod')
-rw-r--r-- | tools/goimports/go.mod | 10 |
1 files changed, 10 insertions, 0 deletions
diff --git a/tools/goimports/go.mod b/tools/goimports/go.mod new file mode 100644 index 000000000..5235db9e3 --- /dev/null +++ b/tools/goimports/go.mod @@ -0,0 +1,10 @@ +module gitlab.com/gitlab-org/gitaly/tools/goimports + +go 1.17 + +require golang.org/x/tools v0.1.10 + +require ( + golang.org/x/mod v0.6.0-dev.0.20220419223038-86c51ed26bb4 // indirect + golang.org/x/sys v0.0.0-20220829200755-d48e67d00261 // indirect +) |