Builds from releases fail because of broken OpenFGA canonical imports

[bketelsen]

Required information

• Distribution: all
• Distribution version: n/a
• The output of "incus info" or if that fails:
  N/A

Issue description

OpenFGA oauth2 package declares a canonical import for golang.org/x/oauth2, but the openfga/credentials package imports the code in their package namespace. Go's tooling correctly pulls in golang.org/x/oauth2 and ignores the openfga package. This causes incus builds to fail if dependencies are vendored.

issue: openfga/go-sdk#63
PR: openfga/go-sdk#64

Steps to reproduce

1. download released incus
2. build
3. observe failure

Information to attach

See issue in COPR build here: ganto/copr-lxc4#34

Note: this is an issue with a dependency, not Incus directly, but will require dependency updates when upstream is fixed.

[stgraber]

The OpenFGA folks have been pretty quick at reviewing and merging fixes so with a bit of luck we'll have that one in time for Incus 0.4 tomorrow.

[bketelsen]

https://github.com/openfga/go-sdk/releases/tag/v0.3.1

0.3.1 released with import fix.

[stgraber]

Ah, so we've got a bit of a problem with that one...
We can only pull as recent as 0.2.2 for now due to our requirement of still building on Go 1.20...

[stgraber]

openfga/go-sdk and mdlayher/socket are the two packages that we currently have to pin to older releases to still be able to build on Go 1.20.

[stgraber]

That will go away once Go 1.22 releases as we'll then deprecate support for Go 1.20.

[stgraber]

Going to check if there's some creative way around this particular one

[rhamzeh]

We can release v0.3.1-go1.20 if that helps unblock you @stgraber

[stgraber]

@rhamzeh that'd be great!

[rhamzeh]

Released, warning that there's some breaking changes introduced in the v0.3.0 release - will submit a draft PR for the update that you can take over