Enforce go-licenses v1.0.0

[matzew]

This should fixes issues we are getting with go.mod files containing the toolchain directive.

See google/go-licenses#128.

[knative-prow]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: matzew
Once this PR has been reviewed and has the lgtm label, please assign dprotaso for approval. For more information see the Kubernetes Code Review Process.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[matzew]

Tekton was doing similar before:
tektoncd/plumbing#2042

I was getting a lot of

E0903 10:38:10.600391   51037 library.go:117] Package crypto/aes does not have module info. Non go modules projects are no longer supported. For feedback, refer to https://github.com/google/go-licenses/issues/128.
W0903 10:38:10.600398   51037 library.go:101] "golang.org/x/crypto/chacha20poly1305" contains non-Go code that can't be inspected for further dependencies:
/home/matzew/go/src/knative.dev/serving/vendor/golang.org/x/crypto/chacha20poly1305/chacha20poly1305_amd64.s
W0903 10:38:10.616318   51037 library.go:101] "golang.org/x/crypto/internal/poly1305" contains non-Go code that can't be inspected for further dependencies:
/home/matzew/go/src/knative.dev/serving/vendor/golang.org/x/crypto/internal/poly1305/sum_amd64.s
W0903 10:38:10.623869   51037 library.go:101] "golang.org/x/sys/cpu" contains non-Go code that can't be inspected for further dependencies:
/home/matzew/go/src/knative.dev/serving/vendor/golang.org/x/sys/cpu/cpu_x86.s
E0903 10:38:11.100804   51037 library.go:117] Package net/rpc does not have module info. Non go modules projects are no longer supported. For feedback, refer to https://github.com/google/go-licenses/issues/128.
F0903 10:38:16.129641   51037 main.go:77] some errors occurred when loading direct and transitive dependency packages

hence I am proposing this

[dsimansk]

@matzew what's the exact error related to toolchain directive? The warning about native files are present for a long time in go-licenses check.

[matzew]

I personally find this a bit annoying:

F0904 08:18:20.345646   54599 main.go:77] some errors occurred when loading direct and transitive dependency packages
exit status 1
--- FAIL: go-licenses failed the license check
Command '__go_update_deps_for_module' failed in module /home/matzew/go/src/knative.dev/eventing: 1

Am I the only one w/ the exit status and FAIL:?

[skonto]

We are going back? 🤔 Ok I see:

In v1.1, we made a breaking change of no longer supporting non go modules managed projects

Tekton has it (and go license have breaking changes) but is it a failure or warning? Does it happen on the CI too or is it local? 🤔

[dsimansk]

There are warning in various CI logs, but I haven't found exit status 1.

[cardil]

Do we really want to use some non-gomod deps?

/hold

[codysoyland]

Do we really want to use some non-gomod deps?

Note the errors which indicate go-licenses is expecting Go standard library code to be Go Modules (Package crypto/aes does not have module info.), which seems to be a bug.

[dsimansk]

I personally find this a bit annoying:

F0904 08:18:20.345646   54599 main.go:77] some errors occurred when loading direct and transitive dependency packages
exit status 1
--- FAIL: go-licenses failed the license check
Command '__go_update_deps_for_module' failed in module /home/matzew/go/src/knative.dev/eventing: 1

Am I the only one w/ the exit status and FAIL:?

What's the command you are running it through here?

[codysoyland]

I can confirm also experiencing issues here with sigstore/policy-controller.

This PR was failing when an update added a toolchain directive. The errors coming from go-licenses show that it's expecting go stdlib packages to be go modules, for example:

  E0409 20:52:59.528793   13997 library.go:117] Package crypto/sha256 does not have module info. Non go modules projects are no longer supported. For feedback, refer to https://github.com/google/go-licenses/issues/128.

The check passed when the toolchain line was removed. I don't understand the root cause, but lots of people are pinning to go-licenses 1.0.0 according to google/go-licenses#128.