From 4ada9029308d8fdf2676eb48db8e99750e4d3514 Mon Sep 17 00:00:00 2001 From: slayerjain Date: Sat, 24 Oct 2026 10:12:48 +0530 Subject: [PATCH] fix(golint): say which install.sh cannot install golangci-lint v2.15.0 The comment above the golangci-lint install said upstream's install.sh cannot install any version this image can use. That holds only for the copies older than golangci/golangci-lint#6539 (merged to main 2026-05-01, first tagged in v2.12.1): the one on golangci-lint's master branch, which has not moved since March 2025, and those of v2.12.0 and earlier tags. Their unanchored checksum grep also matches the SBOM line each release from v2.12.0 lists, so the verify fails. https://golangci-lint.run/install.sh, which serves main's copy, installs v2.15.0. The comment now says which copy fails (master's) and which works (main's, served by golangci-lint.run), puts the SBOM cut-off at v2.12.0 rather than v2.13.0, and quotes master's grep line exactly. Comments only: the install itself is unchanged. It stays by hand so that no install script is fetched at build time; it makes the same checksum check, matched on the exact filename. Signed-off-by: slayerjain --- keploy-ci-golint/Dockerfile | 31 ++++++++++++++++++++----------- 1 file changed, 20 insertions(+), 11 deletions(-) diff --git a/keploy-ci-golint/Dockerfile b/keploy-ci-golint/Dockerfile index 6729b1b..aec0bd7 100644 --- a/keploy-ci-golint/Dockerfile +++ b/keploy-ci-golint/Dockerfile @@ -61,25 +61,34 @@ RUN set -eux; \ # supported version 4)"); golint-1.2.46 shipped v2.13.2 on go1.27.2. ARG GOLANGCI_LINT_VERSION=v2.15.0 -# golangci-lint is installed by hand rather than by piping upstream's -# install.sh, which cannot install any version we are able to use here. +# golangci-lint is installed by hand: the release tarball, verified against its +# line in the release's checksums file, matched on the EXACT filename. # -# From v2.13.0 the release publishes an SBOM alongside each archive, named -# ".sbom.json", so the checksums file carries two lines whose names -# both CONTAIN the tarball name. install.sh looks the checksum up with an -# unanchored grep: +# The install.sh on upstream's master branch, still served at +# raw.githubusercontent.com/golangci/golangci-lint/master/install.sh, cannot +# install v2.12.0 or later. From v2.12.0 the release publishes an SBOM +# alongside each binary archive, named ".sbom.json", so the checksums +# file carries two lines whose names both CONTAIN the tarball name. That copy +# looks the checksum up with an unanchored grep: # -# want=$(grep "${BASENAME}" "${checksums}" | tr '\t' ' ' | cut -d ' ' -f 1) +# want=$(grep "${BASENAME}" "${checksums}" 2>/dev/null | tr '\t' ' ' | cut -d ' ' -f 1) # # which matches both lines, leaves $want holding two hashes, and fails the # verify every time with a correctly downloaded archive: # # err hash_sha256_verify checksum for '...-linux-amd64.tar.gz' did not verify # -# v2.13.0 is also the first release built with Go 1.27, and golangci-lint -# refuses to run when its build Go is older than the module's target, so every -# version new enough for a `go 1.27.0` module hits that bug. Matching the -# checksum line on the EXACT filename avoids it and keeps verification intact. +# v2.13.0 is the first release built with Go 1.27, and golangci-lint refuses +# to run when the language version of its build Go is older than the module's, +# so that copy cannot install any version new enough for a Go 1.27 module. +# +# master has not moved since March 2025; upstream works on main, where +# golangci/golangci-lint#6539 (2026-05-01) anchored that grep at the end of the +# line (`grep "${BASENAME}$"`). Main's install.sh, which +# https://golangci-lint.run/install.sh serves and which is the same file as the +# v2.15.0 tag's copy, installs v2.15.0. The install below makes the same check +# as main's install.sh (the tarball's sha256 against its line in the checksums +# file) without fetching a script at build time. # # Ends by linting a module that imports the stdlib, with this image's Go, so a # golangci-lint that cannot read this Go's export data fails here, not in a