paketo-buildpacks / go

A Cloud Native Buildpack for Go
Apache License 2.0
85 stars 13 forks source link

misleading reporting of go version #923

Closed joefitzgerald closed 2 months ago

joefitzgerald commented 3 months ago

Expected Behavior

I expect the buildpack to tell me it has selected to use the latest patch release of go (1.22.4) in all invocations.

Current Behavior

Buildpack output suggests that the selected go version is 1.22.0.

Possible Solution

Steps to Reproduce

On the first invocation of pack build sample-go-app --path . --buildpack paketo-buildpacks/go --builder paketobuildpacks/builder-jammy-base, observe the output:

Paketo Buildpack for CA Certificates 3.6.8
  https://github.com/paketo-buildpacks/ca-certificates
  Launch Helper: Contributing to layer
    Creating /layers/paketo-buildpacks_ca-certificates/helper/exec.d/ca-certificates-helper
Paketo Buildpack for Go Distribution 2.5.0
  Resolving Go version
    Candidate version sources (in priority order):
      go.mod    -> ">= 1.22"
      <unknown> -> ""

    Selected Go version (using go.mod): 1.22.0 <<<<< WHY ISN'T THIS 1.22.4?

  Executing build process
    Installing Go 1.22.0 <<<<< WHAT?!
      Completed in 2.517s

  Generating SBOM for /layers/paketo-buildpacks_go-dist/go
      Completed in 1ms

Paketo Buildpack for Git 1.0.8
  Configuring build environment
    REVISION -> "23e60bc5527ce9e785e12c5165ac1791ef7fbe09"

  Configuring launch environment
    REVISION -> "23e60bc5527ce9e785e12c5165ac1791ef7fbe09"

Paketo Buildpack for Go Mod Vendor 1.0.29
  Executing build process
    Running 'go mod vendor'
      go: downloading go1.22.4 (linux/amd64) <<<<< IT LOOKS LIKE IT IS CORRECTLY USING THE PATCH RELEASE
      go: no dependencies to vendor
      Completed in 4.383s

  Generating SBOM for /workspace/go.mod
      Completed in 16ms

Paketo Buildpack for Go Build 2.2.1
  Executing build process
    Running 'go build -o /layers/paketo-buildpacks_go-build/targets/bin -buildmode pie -trimpath .'
      go: downloading go1.22.4 (linux/amd64) <<<<< IT LOOKS LIKE IT IS CORRECTLY USING THE PATCH RELEASE
      Completed in 22.803s

  Generating SBOM for /layers/paketo-buildpacks_go-build/targets/bin
      Completed in 23ms

  Assigning launch processes:
    sample-go-app (default): /layers/paketo-buildpacks_go-build/targets/bin/sample-go-app

For subsequent invocations, observe that there is no mention whatsoever that the buildpack is using go 1.22.4; one is left to assume it is using go 1.22.0 only.

Paketo Buildpack for CA Certificates 3.6.8
  https://github.com/paketo-buildpacks/ca-certificates
  Launch Helper: Reusing cached layer
Paketo Buildpack for Go Distribution 2.5.0
  Resolving Go version
    Candidate version sources (in priority order):
      go.mod    -> ">= 1.22"
      <unknown> -> ""

    Selected Go version (using go.mod): 1.22.0 <<<<< WHY ISN'T THIS 1.22.4?

  Reusing cached layer /layers/paketo-buildpacks_go-dist/go

Paketo Buildpack for Git 1.0.8
  Configuring build environment
    REVISION -> "23e60bc5527ce9e785e12c5165ac1791ef7fbe09"

  Configuring launch environment
    REVISION -> "23e60bc5527ce9e785e12c5165ac1791ef7fbe09"

Paketo Buildpack for Go Mod Vendor 1.0.29
  Executing build process
    Running 'go mod vendor' <<<<< I GUESS YOU'RE USING GO 1.22.0 TO BUILD THIS?
      go: no dependencies to vendor
      Completed in 109ms

  Generating SBOM for /workspace/go.mod
      Completed in 16ms

Paketo Buildpack for Go Build 2.2.1
  Executing build process <<<<< I GUESS YOU'RE USING GO 1.22.0 TO BUILD THIS?
    Running 'go build -o /layers/paketo-buildpacks_go-build/targets/bin -buildmode pie -trimpath .'
      Completed in 18.737s

  Generating SBOM for /layers/paketo-buildpacks_go-build/targets/bin
      Completed in 22ms

  Assigning launch processes:
    sample-go-app (default): /layers/paketo-buildpacks_go-build/targets/bin/sample-go-app

It appears the go version is being omitted because it is already cached, but it leaves me confused about what version is actually being used.

Motivations

This erodes trust in the buildpack. Please log the go version used to build the app.