incus-0.3: Build failure openfga/go-sdk/oauth2/clientcredentials/clientcredentials.go: expects import "golang.org/x/oauth2"

[ganto]

When trying to build incus-0.3 from the release archive via RPM spec file the incusd binary build will fail with:

+ GOPATH=/builddir/build/BUILD/incus-0.3/_build:/usr/share/gocode
+ GO111MODULE=off
+ go build -buildmode pie -compiler gc '-tags=rpm_crashtraceback libsqlite3' -ldflags ' -X github.com/lxc/incus/version=0.3 -B 0x581a52dff56a33d675a511b550782a8c391d2eeb -compressdwarf=false -linkmode=external -extldflags '\''-Wl,-z,relro -Wl,--as-needed  -Wl,-z,now -specs=/usr/lib/rpm/redhat/redhat-hardened-ld -specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -specs=/usr/lib/rpm/redhat/redhat-package-notes  '\''' -a -v -x -o /builddir/build/BUILD/incus-0.3/_build/lib/incusd github.com/lxc/incus/cmd/incusd
WORK=/tmp/go-build4146813390
_build/src/github.com/lxc/incus/vendor/github.com/openfga/go-sdk/oauth2/clientcredentials/clientcredentials.go:19:5: code in directory /builddir/build/BUILD/incus-0.3/_build/src/github.com/lxc/incus/vendor/github.com/openfga/go-sdk/oauth2 expects import "golang.org/x/oauth2"
_build/src/github.com/lxc/incus/vendor/github.com/openfga/go-sdk/credentials/credentials.go:9:5: code in directory /builddir/build/BUILD/incus-0.3/_build/src/github.com/lxc/incus/vendor/github.com/openfga/go-sdk/oauth2/clientcredentials expects import "golang.org/x/oauth2/clientcredentials"

The error doesn't happen when building the project via Makefile.

[ganto]

Just a few notes for troubleshooting:

• The mechanism that is tripped here is called canonical import paths and is part of go since 1.4
• The github.com/openfga/go-sdk package is used by Incus 0.3 in release v0.2.2
• Such a canonical import path is defined for github.com/openfga/go-sdk/oauth2/clientcredentials which prefers to be imported as golang.org/x/oauth2/clientcredentials
• However the "wrong" import is referenced at github.com/openfga/go-sdk/credentials which itself is used by incusd via internal/server/auth/driver_openfga.go

So it makes sense that the error is triggered when only considering the facts stated above. But why is it not triggered when building via Makefile?

[bketelsen]

this is a bug in the openfga repo, and should be filed & fixed there. They copied in code from the golang.org oauth2 package, but didn't modify the canonical import directive.

It's not triggered in the Makefile because the dependencies aren't vendored in the repo, but only in the release. So the go tooling is pulling in the golang.org package because that's what the openfga package tells it to do. Confirm this by looking at incus's go.mod file which doesn't mention the openfga org.

Issue filed here
PR filed here

[bketelsen]

unfortunately, even after PR is accepted and fix is released, incus needs to update the openfga dependency and make a new release.

[bketelsen]

lxc/incus#315 (comment)

[bketelsen]

OpenFGA promised a release today to fix this.
Incus 0.4.0 is dropping tomorrow.

So this may resolve in a day or two.

[bketelsen]

https://github.com/openfga/go-sdk/releases/tag/v0.3.1 OpenFGA fixed release, Incus maintainers will include in tomorrow's 0.4.0 release.

[stgraber]

Unfortunately we can't as we support building on the latest two Go versions and OpenFGA 0.3.x only builds on 1.21 (not sure if an actual requirement of just an artifact of their go.mod).

[bketelsen]

for completeness, OpenFGA released a version for go 1.20 to resolve this.

[ganto]

Wow, thanks a lot for stepping in. I really thought there is something wrong on my side otherwise I would have reported that sooner. I'll therefore try my luck again once incus-0.4 is released.

[bketelsen]

my pleasure, thanks for packaging Incus & LXD!

[stgraber]

0.4 is out, well, tag and tarballs are, still working on the announcement :)

[ganto]

Great, thanks everyone. incus-0.4 is now available for Fedora via COPR.

[stgraber]

Great to hear! Also just a quick reminder to send us a PR for doc/installing.md on the Incus repo so we can have instructions for Fedora users too!