Skip to content
Snippets Groups Projects
  1. Feb 17, 2025
  2. Dec 12, 2024
  3. Dec 11, 2024
  4. Nov 15, 2024
  5. Oct 11, 2024
  6. Sep 16, 2024
  7. Aug 13, 2024
  8. Jul 14, 2024
  9. Jun 11, 2024
  10. May 13, 2024
  11. Apr 11, 2024
  12. Mar 19, 2024
  13. Oct 06, 2023
  14. Sep 05, 2023
  15. Aug 07, 2023
  16. Jul 31, 2023
  17. Jul 05, 2023
  18. Jun 15, 2023
  19. Jun 01, 2023
  20. May 30, 2023
  21. Apr 13, 2023
  22. Mar 16, 2023
  23. Feb 10, 2023
  24. Jan 09, 2023
  25. Dec 19, 2022
  26. Oct 10, 2022
    • Patrick Steinhardt's avatar
      Makefile: Track Go tool versions via separate Go modules · 0cd4b875
      Patrick Steinhardt authored
      Right now we track versions of our Go tooling directly in our Makefile.
      While this is simple, it has several drawbacks:
      
          - We're susceptible to supply-chain attacks in case an adversary
            manages to replace the code used to build any of our tools.
      
          - We cannot use proper dependencies in our Makefile, which adds the
            need for `*.version` files.
      
          - It is hard to build the tools outside of our Makefile as we don't
            have a way to properly pull in the correct version.
      
          - Upgrading our tooling requires us to manually hunt down new
            releases for all of our tools.
      
      We can fix these issues by following the approach that is efficially
      recommended by the Go project [1]: every tool has its own Go module in
      `tools/` with a "tool.go" file that imports the tool of interest. Like
      this we can use Go's normal tooling to keep track of versions:
      
          - We record hashes of the tool's sources as well as all of its
            dependencies, making supply-chain attacks almost impossible.
      
          - We can now provide proper dependencies in our Makefile: every tool
            depends on "tool.go", "go.mod" and "go.sum". If any of them
            changes we need to rebuild.
      
          - The tools can be installed in the correct version simply by using
            `go install` with the correct `go.mod` file.
      
          - Upgrading tools is as simple as running `go get -u`, so no more
            manual hunting for new versions.
      
      While these benefits are great on their own already, we can go even
      further with this refactoring: now that each tool has its own `go.mod`
      file we can adapt the Renovate bot to pick up these files. This means
      that we don't have to remember upgrading at all anymore, but instead the
      bot will automatically upgrade them for us.
      
      [1]: https://github.com/golang/go/wiki/Modules#how-can-i-track-tool-dependencies-for-a-module
      0cd4b875
Loading