canonical / snap-vault

Vault is a tool for securely accessing secrets
https://snapcraft.io/vault
Other
16 stars 9 forks source link

Snaps appear to have the wrong binary version inside #30

Closed damoxc closed 1 year ago

damoxc commented 3 years ago

I'm not sure if I'm doing something wrong but it appears as if the vault binaries in the snaps for the older stable branches don't match the metadata. I've had to update to 1.5.4 in order to find one which matches.

root@juju-6ab857-8-lxd-1:/snap/vault# snap list
Name    Version    Rev    Tracking       Publisher   Notes
vault   1.2.7      1926   1.2/stable     canonical✓  -
root@juju-6ab857-8-lxd-1:/snap/vault/1926/bin# ./vault version
Vault v1.2.4 (cgo)
root@juju-6ab857-9-lxd-1:~# snap list
Name    Version    Rev    Tracking       Publisher   Notes
vault   1.4.6      1936   1.4/stable     canonical✓  -
root@juju-6ab857-9-lxd-1:/snap/vault/1936# bin/vault version
Vault v1.4.3 (cgo)
javacruft commented 1 year ago

Hmm that is odd:

$ sudo snap refresh --channel 1.4 vault
vault (1.4/stable) 1.4.6 from Canonical✓ refreshed
$ vault version
Vault v1.4.3 (cgo)
javacruft commented 1 year ago

The snap build process uses https://github.com/hashicorp/vault and checks out the most recent tag that it can find for the version its associated with:

    override-pull: |
      set -x
      snapcraftctl pull
      release_tag="$(git tag -l --sort=version:refname "v1.4.*" | tail -1)"
      # If the latest tag from the upstream project has not been released to
      git checkout "${release_tag}"
      git apply $SNAPCRAFT_STAGE/etcd_export_tls_no_verify.patch
      git apply $SNAPCRAFT_STAGE/ubuntu-fan.patch
      snapcraftctl set-version `echo ${release_tag} | sed "s/v//g"`
javacruft commented 1 year ago

I think this is a mismatch within the vault code itself:

package version

var (
        // The git commit that was compiled. This will be filled in by the compiler.
        GitCommit   string
        GitDescribe string

        // Whether cgo is enabled or not; set at build time
        CgoEnabled bool

        Version           = "1.4.3"
        VersionPrerelease = ""
        VersionMetadata   = ""
)

That's taken from the tree related to the 1.4.6 tag.

javacruft commented 1 year ago

The 1.2.7 tag has the same type of issue