Update dependencies

[imjasonh]

Picks up buildpacks/imgutil#124, upgrades the docker/docker dep to v20.10.7, drops pinned x/sys dep

Signed-off-by: Jason Hall jasonhall@redhat.com

cc @natalieparellano

[imjasonh]

Also switched to using module-aware go install to fetch version-pinned tooling dependencies, instead of requiring the import+go.mod hack in tools/tools.go.

I'm not sure if this means tools/go.mod can be dropped entirely, if so I can make that change in this PR as well.

[jabrown85]

Can we get rid of tools/* completely now that you've upgrade the Makefile?

[imjasonh]

There are still useful tools in there (tools/image/main.go, etc.), but I don't see any reason it has to be a separate Go module anymore. I've pushed another commit that removes tools/go.* and reruns go mod download to get all of tools/'s deps in /go.mod.

[jabrown85]

Thanks for this! It looks great.

I've approved the CI run. Looks like you need to DCO the latest commit @imjasonh.

[jabrown85]

@imjasonh just re-reviewing as CI immediately failed. We need to update to go 1.16 to get this behavior (CI included)

[imjasonh]

@imjasonh just re-reviewing as CI immediately failed. We need to update to go 1.16 to get this behavior (CI included)

Thanks, I've updated to 1.16 everywhere I could find, let me know if you know of more.

[jabrown85]

Linting is failing now - see here

I guess the upgraded linter means new rules and some deprecation of linters entirely

[imjasonh]

Linting is failing now - see here

I guess the upgraded linter means new rules and some deprecation of linters entirely

Oh my bad, I was blindly upgrading golangci-lint instead of using the same version that had been pinned in tools/go.mod. That should be fixed now 🤞

[imjasonh]

Moving tools/* into the main module means it's now subject to lint checks, I've fixed some findings.

[jabrown85]

go install github.com/sclevine/yj@v0.0.0-20200815061347-554173e71934: github.com/sclevine/yj@v0.0.0-20200815061347-554173e71934
The go.mod file for the module providing named packages contains one or
more replace directives. It must not contain directives that would cause
it to be interpreted differently than if it were the main module.

Hmm - I guess we need to add the same replace directive in the main go.mod now or we need @sclevine to cut a version that doesn't have a replace directive (if possible).

[imjasonh]

I even tried adding the replace directive here, and got the same error message. 😢

It's possible that module-aware go install just doesn't support replace in the installed package at all? 🤔

[jabrown85]

@imjasonh Stephen pulled in my PR to remove the replace directive if you want to pull that in and unblock this PR

[imjasonh]

@imjasonh Stephen pulled in my PR to remove the replace directive if you want to pull that in and unblock this PR

Thanks! Done. 👍

[jabrown85]

@imjasonh 🤞 the final hurdle appears to be the acceptance testdata launcher Dockerfile(s). The go1.16 tooling expects a go.mod to be present in order to run go build -o helper <>. Adding GO111MODULE=off to those Dockerfile or adding a go.mod for that exec.d folder should resolve it.

[imjasonh]

@imjasonh 🤞 the final hurdle appears to be the acceptance testdata launcher Dockerfile(s). The go1.16 tooling expects a go.mod to be present in order to run go build -o helper <>. Adding GO111MODULE=off to those Dockerfile or adding a go.mod for that exec.d folder should resolve it.

Done! It's getting closer I can feel it! 😄

[sonatype-lift]

Critical OSS Vulnerability:  

pkg:golang/github.com/coreos/etcd@3.3.13

1 Critical, 2 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/buildpacks/imgutil@0.0.0-20210609210403-3145c7480cde

CRITICAL Vulnerabilities (1)

---

CVE-2020-15114

[CVE-2020-15114] In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP prox...

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

CVSS Score: 7.7

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

---

SEVERE Vulnerabilities (2)

---

CVE-2020-15136

[CVE-2020-15136] In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only ap...

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

CVSS Score: 6.5

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

---

CVE-2020-15115

[CVE-2020-15115] etcd before versions 3.3.23 and 3.4.10 does not perform any password length vali...

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

CVSS Score: 5.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Critical OSS Vulnerability:  

pkg:golang/github.com/coreos/etcd@3.3.13

1 Critical, 2 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/google/go-containerregistry@0.5.2-0.20210604130445-3bfab55f3bd9

CRITICAL Vulnerabilities (1)

---

CVE-2020-15114

[CVE-2020-15114] In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP prox...

In etcd before versions 3.3.23 and 3.4.10, the etcd gateway is a simple TCP proxy to allow for basic service discovery and access. However, it is possible to include the gateway address as an endpoint. This results in a denial of service, since the endpoint can become stuck in a loop of requesting itself until there are no more available file descriptors to accept connections on the gateway.

CVSS Score: 7.7

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:C/C:N/I:N/A:H

---

SEVERE Vulnerabilities (2)

---

CVE-2020-15136

[CVE-2020-15136] In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only ap...

In ectd before versions 3.4.10 and 3.3.23, gateway TLS authentication is only applied to endpoints detected in DNS SRV records. When starting a gateway, TLS authentication will only be attempted on endpoints identified in DNS SRV records for a given domain, which occurs in the discoverEndpoints function. No authentication is performed against endpoints provided in the --endpoints flag. This has been fixed in versions 3.4.10 and 3.3.23 with improved documentation and deprecation of the functionality.

CVSS Score: 6.5

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N

---

CVE-2020-15115

[CVE-2020-15115] etcd before versions 3.3.23 and 3.4.10 does not perform any password length vali...

etcd before versions 3.3.23 and 3.4.10 does not perform any password length validation, which allows for very short passwords, such as those with a length of one. This may allow an attacker to guess or brute-force users' passwords with little computational effort.

CVSS Score: 5.8

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Critical OSS Vulnerability:  

pkg:golang/github.com/dgrijalva/jwt-go@3.2.0

1 Critical, 0 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/buildpacks/imgutil@0.0.0-20210609210403-3145c7480cde

CRITICAL Vulnerabilities (1)

---

[CVE-2020-26160] jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrict...

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Critical OSS Vulnerability:  

pkg:golang/github.com/dgrijalva/jwt-go@3.2.0

1 Critical, 0 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/google/go-containerregistry@0.5.2-0.20210604130445-3bfab55f3bd9

CRITICAL Vulnerabilities (1)

---

[CVE-2020-26160] jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrict...

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Critical OSS Vulnerability:  

pkg:golang/github.com/dgrijalva/jwt-go@0.0.0-20170104182250-a601269ab70c

1 Critical, 0 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/buildpacks/imgutil@0.0.0-20210609210403-3145c7480cde

CRITICAL Vulnerabilities (1)

---

[CVE-2020-26160] jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrict...

jwt-go before 4.0.0-preview1 allows attackers to bypass intended access restrictions in situations with []string{} for m["aud"] (which is allowed by the specification). Because the type assertion fails, "" is the value of aud. This is a security problem if the JWT token is presented to a service that lacks its own audience check.

CVSS Score: 7.5

CVSS Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20180904163835-0709b304e793

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/buildpacks/imgutil@0.0.0-20210609210403-3145c7480cde

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20180904163835-0709b304e793

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/google/go-containerregistry@0.5.2-0.20210604130445-3bfab55f3bd9

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20181009213950-7c1a557ab941

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/buildpacks/imgutil@0.0.0-20210609210403-3145c7480cde

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20181009213950-7c1a557ab941

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/google/go-containerregistry@0.5.2-0.20210604130445-3bfab55f3bd9

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/buildpacks/imgutil@0.0.0-20210609210403-3145c7480cde

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/google/go-containerregistry@0.5.2-0.20210604130445-3bfab55f3bd9

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/moby/term@0.0.0-20210610120745-9d4ed1856297

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20190308221718-c2843e01d9a2

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/google.golang.org/genproto@0.0.0-20210610141715-e7a9b787a5a4

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20171113213409-9f005a07e0d3

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/buildpacks/imgutil@0.0.0-20210609210403-3145c7480cde

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[sonatype-lift]

Severe OSS Vulnerability:  

pkg:golang/golang.org/x/crypto@0.0.0-20171113213409-9f005a07e0d3

0 Critical, 1 Severe, 0 Moderate and 0 Unknown vulnerabilities have been found in a transitive dependency of pkg:golang/github.com/google/go-containerregistry@0.5.2-0.20210604130445-3bfab55f3bd9

SEVERE Vulnerabilities (1)

---

[CVE-2019-11840] Use of Insufficiently Random Values

An issue was discovered in supplementary Go cryptography libraries, aka golang-googlecode-go-crypto, before 2019-03-20. A flaw was found in the amd64 implementation of golang.org/x/crypto/salsa20 and golang.org/x/crypto/salsa20/salsa. If more than 256 GiB of keystream is generated, or if the counter otherwise grows greater than 32 bits, the amd64 implementation will first generate incorrect output, and then cycle back to previously generated keystream. Repeated keystream bytes can lead to loss of confidentiality in encryption applications, or to predictability in CSPRNG applications.

CVSS Score: 5.9

CVSS Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N

---

(at-me in a reply with help or ignore)

[jabrown85]

@imjasonh Linux passed 🎉 Windows 😬

RUN GO111MODULE=off go build -o helper.exe exec.d
         ---> Running in 07384429eba3
        'GO111MODULE' is not recognized as an internal or external command,

I think we need something like

RUN set GO111MODULE=off before the RUN go build command.

[jabrown85]

I'm super happy to see this!

[natalieparellano]

I fear that I created these merge conflicts when I merged #617 :'( @imjasonh do you mind resolving them? We could hold off on other merges until this gets through.

[codecov]

Codecov Report

Merging #628 (b1b37e1) into main (7c5f36b) will decrease coverage by 0.21%.
The diff coverage is n/a.

❗ Current head b1b37e1 differs from pull request most recent head b0f8657. Consider uploading reports for the commit b0f8657 to get more accurate results

@@            Coverage Diff             @@
##             main     #628      +/-   ##
==========================================
- Coverage   65.10%   64.90%   -0.20%     
==========================================
  Files          53       52       -1     
  Lines        3676     3623      -53     
==========================================
- Hits         2393     2351      -42     
+ Misses       1031     1023       -8     
+ Partials      252      249       -3     

Flag	Coverage Δ
os_windows	64.90% <ø> (-0.20%)	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

[imjasonh]

I fear that I created these merge conflicts when I merged #617 :'( @imjasonh do you mind resolving them? We could hold off on other merges until this gets through.

No worries! Since the conflict was just on tools/go.sum which I deleted anyway the merge was very easy. 😈

I also took this opportunity to squash commits.

[natalieparellano]

@imjasonh I think we might have lost the fix for this Windows error in the squash:

Step 6/9 : RUN copy c:\gopath\helper.exe c:\layers\0.6_buildpack\some_layer\exec.d\helper.exe
         ---> Running in 01cc5789cf70
        The system cannot find the file specified.

Do you remember what it was? If not, I can grab a Windows environment.

[imjasonh]

@imjasonh I think we might have lost the fix for this Windows error in the squash:

Step 6/9 : RUN copy c:\gopath\helper.exe c:\layers\0.6_buildpack\some_layer\exec.d\helper.exe
         ---> Running in 01cc5789cf70
        The system cannot find the file specified.

Do you remember what it was? If not, I can grab a Windows environment.

I'm not sure I understand what changed. The only changes I made here were:

1. Update to Go 1.16, which changed the default GO111MODULE to on, so I
2. Explicitly set GO111MODULE=off

This seems to have caused the system cannot find the file specified error, which I've attempted to fix by explicitly writing the built binary to c:\gopath\helper.exe. This didn't seem to fix the issue though.

I've pushed another commit that might fix this, but I'm a bit grasping at straws here. If someone knows more about how Windows works that might be helpful.

[imjasonh]

The latest failure is:

        --- FAIL: TestAnalyzer/acceptance-analyzer/0.3/daemon_case/writes_analyzed.toml (0.52s)
        --- FAIL: TestAnalyzer/acceptance-analyzer/0.3/daemon_case/app_image_exists/restores_app_metadata (62.44s)

It only failed on Windows, but looking briefly at the test I'm not sure how that would be platform-dependent, or how it could be related to my change. 🤔

Any ideas?

edit: seems like a flake?

[natalieparellano]

seems like a flake?

@imjasonh I'm of that opinion as well. Let's merge this!

Thank you so much for all the effort in getting this through!