Merge pull request containerd#4318 from Shubhranshu153/update-go-license

fix: go-license dependency and fixes for provenance/sbom tests.

Author: AkihiroSuda

Dockerfile

@@ -47,7 +47,7 @@ ARG GOMODJAIL_VERSION=v0.1.2@0a86b34442a491fa8f5e4565e9c846fce310239c
 ARG GO_VERSION=1.24
 ARG UBUNTU_VERSION=24.04
 ARG CONTAINERIZED_SYSTEMD_VERSION=v0.1.1
-ARG GOTESTSUM_VERSION=v1.12.2
+ARG GOTESTSUM_VERSION=0d9599e513d70e5792bb9334869f82f6e8b53d4d
 ARG NYDUS_VERSION=v2.3.1
 ARG SOCI_SNAPSHOTTER_VERSION=0.9.0
 ARG KUBO_VERSION=v0.34.1

Makefile

@@ -218,12 +218,14 @@ install-dev-tools:
 	# git-validation: main (2025-02-25)
 	# ltag: main (2025-03-04)
 	# go-licenses: v2.0.0-alpha.1 (2024-06-27)
+	# stubbing go-licenses with dependency upgrade due to non-compatibility with golang 1.25rc1
+	# Issue: https://github.com/google/go-licenses/issues/312
 	@cd $(MAKEFILE_DIR) \
+	        && go install github.com/Shubhranshu153/go-licenses/v2@f8c503d1357dffb6c97ed3b94e912ab294dde24a \
 		&& go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@2b224c2cf4c9f261c22a16af7f8ca6408467f338 \
 		&& go install github.com/vbatts/git-validation@7b60e35b055dd2eab5844202ffffad51d9c93922 \
 		&& go install github.com/containerd/ltag@66e6a514664ee2d11a470735519fa22b1a9eaabd \
-		&& go install github.com/google/go-licenses/v2@d01822334fba5896920a060f762ea7ecdbd086e8 \
-		&& go install gotest.tools/gotestsum@ac6dad9c7d87b969004f7749d1942938526c9716
+		&& go install gotest.tools/gotestsum@0d9599e513d70e5792bb9334869f82f6e8b53d4d
 	@echo "Remember to add \$$HOME/go/bin to your path"
 	$(call footer, $@)
 

cmd/nerdctl/builder/builder_build_test.go

@@ -19,7 +19,9 @@ package builder
 import (
 	"errors"
 	"fmt"
+	"os"
 	"path/filepath"
+	"regexp"
 	"runtime"
 	"strings"
 	"testing"
@@ -851,8 +853,9 @@ RUN curl -I http://google.com
 func TestBuildAttestation(t *testing.T) {
 	nerdtest.Setup()
 
-	const testSBOMFileName = "sbom.spdx.json"
-	const testProvenanceFileName = "provenance.json"
+	// Using regex patterns to match SBOM and provenance files with optional platform suffix
+	const testSBOMFilePattern = `sbom\.spdx(?:\.[a-z0-9_]+)?\.json`
+	const testProvenanceFilePattern = `provenance(?:\.[a-z0-9_]+)?\.json`
 
 	dockerfile := fmt.Sprintf(`FROM %s`, testutil.CommonImage)
 
@@ -892,7 +895,17 @@ func TestBuildAttestation(t *testing.T) {
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: func(stdout, info string, t *testing.T) {
-							data.Temp().Exists("dir-for-bom", testSBOMFileName)
+							files, err := os.ReadDir(data.Temp().Path("dir-for-bom"))
+							assert.NilError(t, err, "failed to read directory")
+
+							found := false
+							for _, file := range files {
+								if !file.IsDir() && regexp.MustCompile(testSBOMFilePattern).MatchString(file.Name()) {
+									found = true
+									break
+								}
+							}
+							assert.Assert(t, found, "no SBOM file matching pattern %s found", testSBOMFilePattern)
 						},
 					}
 				},
@@ -914,7 +927,17 @@ func TestBuildAttestation(t *testing.T) {
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: func(stdout, info string, t *testing.T) {
-							data.Temp().Exists("dir-for-prov", testProvenanceFileName)
+							files, err := os.ReadDir(data.Temp().Path("dir-for-prov"))
+							assert.NilError(t, err, "failed to read directory")
+
+							found := false
+							for _, file := range files {
+								if !file.IsDir() && regexp.MustCompile(testProvenanceFilePattern).MatchString(file.Name()) {
+									found = true
+									break
+								}
+							}
+							assert.Assert(t, found, "no provenance file matching pattern %s found", testProvenanceFilePattern)
 						},
 					}
 				},
@@ -937,8 +960,28 @@ func TestBuildAttestation(t *testing.T) {
 				Expected: func(data test.Data, helpers test.Helpers) *test.Expected {
 					return &test.Expected{
 						Output: func(stdout, info string, t *testing.T) {
-							data.Temp().Exists("dir-for-attest", testSBOMFileName)
-							data.Temp().Exists("dir-for-attest", testProvenanceFileName)
+							// Check if any file in the directory matches the SBOM file pattern
+							files, err := os.ReadDir(data.Temp().Path("dir-for-attest"))
+							assert.NilError(t, err, "failed to read directory")
+
+							sbomFound := false
+							for _, file := range files {
+								if !file.IsDir() && regexp.MustCompile(testSBOMFilePattern).MatchString(file.Name()) {
+									sbomFound = true
+									break
+								}
+							}
+							assert.Assert(t, sbomFound, "no SBOM file matching pattern %s found", testSBOMFilePattern)
+
+							// Check if any file in the directory matches the provenance file pattern
+							provenanceFound := false
+							for _, file := range files {
+								if !file.IsDir() && regexp.MustCompile(testProvenanceFilePattern).MatchString(file.Name()) {
+									provenanceFound = true
+									break
+								}
+							}
+							assert.Assert(t, provenanceFound, "no provenance file matching pattern %s found", testProvenanceFilePattern)
 						},
 					}
 				},

hack/build-integration-canary.sh

@@ -28,7 +28,9 @@ readonly root
 # "Blacklisting" here means that any dependency which name is blacklisted will be left untouched, at the version
 # currently pinned in the Dockerfile.
 # This is convenient so that currently broken alpha/beta/RC can be held back temporarily to keep the build green
-blacklist=()
+# TODO: Blacklisting gotestsum until a new version compatible with golang v1.25rc1 is released
+# Issue: https://github.com/google/go-licenses/issues/312
+blacklist=(gotestsum)
 
 # List all the repositories we depend on to build and run integration tests
 dependencies=(

mod/tigron/Makefile

@@ -168,11 +168,13 @@ install-dev-tools:
 	# git-validation: main (2025-02-25)
 	# ltag: main (2025-03-04)
 	# go-licenses: v2.0.0-alpha.1 (2024-06-27)
+	# stubbing go-licenses with dependency upgrade due to non-compatibility with golang 1.25rc1
+	# Issue: https://github.com/google/go-licenses/issues/312
 	@cd $(MAKEFILE_DIR) \
 		&& go install github.com/golangci/golangci-lint/v2/cmd/golangci-lint@2b224c2cf4c9f261c22a16af7f8ca6408467f338 \
 		&& go install github.com/vbatts/git-validation@7b60e35b055dd2eab5844202ffffad51d9c93922 \
 		&& go install github.com/containerd/ltag@66e6a514664ee2d11a470735519fa22b1a9eaabd \
-		&& go install github.com/google/go-licenses/v2@d01822334fba5896920a060f762ea7ecdbd086e8
+		&& go install github.com/Shubhranshu153/go-licenses/v2@f8c503d1357dffb6c97ed3b94e912ab294dde24a
 	@echo "Remember to add \$$HOME/go/bin to your path"
 	$(call footer, $@)