Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

cmd/go: +dirty in version stamping doesn't combine well with +incompatible #71971

Open
xnox opened this issue Feb 26, 2025 · 2 comments
Open
Assignees
Labels
GoCommand cmd/go NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.

Comments

@xnox
Copy link

xnox commented Feb 26, 2025

Go version

go1.24

Output of go env in your module/workspace:

n/a

What did you do?

Build pulumi with main module version v3.152.0+incompatible+dirty from pulumi project

Such version is not a valid semver as per semver spec & regex, as only a single + suffix allowed; which must be followed by not-dot-character and then additional characters.

What did you see happen?

It creates +incompatible+dirty + vcs.modified=true fields. The +dirty is entirely redundant, no? given that vcs.modified=true already exists to specify +dirty

What did you expect to see?

I expect for the module version to be: v3.152.0+incompatible without +dirty suffix which is already encoded in vcs.modified=true. Or alternatively as +incompatible.dirty see below.

Such that go module version generate still passes the semver spec regex as seen at:
https://github.com/anchore/go-version/blob/main/version.go#L28

Alternatively the identifiers must be dot separated, from https://semver.org/#spec-item-10:

  1. Build metadata MAY be denoted by appending a plus sign and a series of dot separated identifiers immediately following the patch or pre-release version. Identifiers MUST comprise only ASCII alphanumerics and hyphens [0-9A-Za-z-]. Identifiers MUST NOT be empty. Build metadata MUST be ignored when determining version precedence. Thus two versions that differ only in the build metadata, have the same precedence. Examples: 1.0.0-alpha+001, 1.0.0+20130313144700, 1.0.0-beta+exp.sha.5114f85, 1.0.0+21AF26D3----117B344092BD.

Thus correct semver with incompatible & dirty build metadata should be: v3.152.0+incompatible.dirty

@xnox xnox changed the title build: golang 1.24 generates non-semver main module version +incompatible+dirty as only one suffix is allowed by semver spec build: golang 1.24 generates non-semver main module version +incompatible+dirty as a single build metadata suffix is allowed, with dot separated fields, by the semver spec Feb 26, 2025
@xnox xnox changed the title build: golang 1.24 generates non-semver main module version +incompatible+dirty as a single build metadata suffix is allowed, with dot separated fields, by the semver spec build: golang 1.24 generates non-semver main module version +incompatible+dirty as only a single build metadata suffix is allowed, with dot separated fields, by the semver spec Feb 26, 2025
@seankhliao seankhliao changed the title build: golang 1.24 generates non-semver main module version +incompatible+dirty as only a single build metadata suffix is allowed, with dot separated fields, by the semver spec cmd/go: +dirty in version stamping doesn't combine well with +incompatible Feb 26, 2025
xnox added a commit to xnox/grype that referenced this issue Feb 26, 2025
go1.24.0 stamps versions with `+incompatible+dirty` which is an
invalid SemVer version. Add a fixup to correct this to SemVer
compliant buildinfo version of `+incompatible.dirty` with a test case.

Related:
- golang/go#71971
- anchore#2482
xnox added a commit to xnox/grype that referenced this issue Feb 26, 2025
go1.24.0 stamps versions with `+incompatible+dirty` which is an
invalid SemVer version. Add a fixup to correct this to SemVer
compliant buildinfo version of `+incompatible.dirty` with a test case.

Related:
- golang/go#71971
- anchore#2482

Signed-off-by: Dimitri John Ledkov <dimitri.ledkov@surgut.co.uk>
@seankhliao seankhliao added NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one. GoCommand cmd/go labels Feb 26, 2025
@xnox
Copy link
Author

xnox commented Feb 26, 2025

Created a patch to make the generated version semver compliant:

@prattmic
Copy link
Member

cc @matloob @samthanawalla

@samthanawalla samthanawalla assigned xnox and unassigned matloob Mar 31, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
GoCommand cmd/go NeedsInvestigation Someone must examine and confirm this is a valid issue and not a duplicate of an existing one.
Projects
None yet
Development

No branches or pull requests

4 participants