search

sigstore / cosign

Code signing and transparency for containers and binaries
Apache License 2.0
4.48k stars 547 forks source link

Cuelang version error with go installer #3786

Open arthurus-rex opened 3 months ago

arthurus-rex commented 3 months ago

Description

I was attempting to install cosign locally on my Fedora 40 macine using the command: go install github.com/sigstore/cosign/v2/cmd/cosign@latest

And received the following error:

pkg/mod/github.com/sigstore/cosign/v2@v2.2.4/pkg/cosign/cue/cue.go:19:2: reading cuelang.org/go/go.mod at revision v0.8.1: unknown revision v0.8.1
pkg/mod/github.com/sigstore/cosign/v2@v2.2.4/pkg/cosign/cue/cue.go:20:2: reading cuelang.org/go/go.mod at revision v0.8.1: unknown revision v0.8.1
pkg/mod/github.com/sigstore/cosign/v2@v2.2.4/pkg/cosign/cue/cue.go:21:2: reading cuelang.org/go/go.mod at revision v0.8.1: unknown revision v0.8.1

At the following step: go: downloading cuelang.org/go v0.8.1

Notable information is that go.mod appears to specify cuelang v0.9.2, so it is unclear why the go installer is attempting to download an older version of cuelang. The rpm binary installation from the official docs was successful.

Version OS: Fedora 40 Go: 1.22.5

arthurus-rex commented 2 months ago

Tried this again a few days ago, and the issue appears to be resolved. This may have been due to a versioning conflict between 'latest' and the in-progress version that was in development at the time. One way to prevent these conflicts in the future would be to periodically update the official docs above to not use the 'latest' tag on the Go installer. Is this something the community may be interested in adding to the docs?