Fix broken dependencies in go 1.13

[rvolosatovs]

Latest master is broken on go 1.13 due to invalid dependencies:

go version && go mod tidy
go version go1.13 linux/amd64
go: github.com/moby/buildkit@v0.5.1 requires
        github.com/opencontainers/runc@v1.0.1-0.20190307181833-2b18fe1d885e: invalid pseudo-version: preceding tag (v1.0.0) not found

Fixed that

[jpreese]

Thanks for pointing this out @rvolosatovs !

After taking a quick look at this, I think a better approach would be to update the go version to 1.13 in the go.mod file, and refetch the dependencies so that we can leverage 1.13's approach to module resolution.

Thoughts?

[rvolosatovs]

I added 7243ee0, but sure enough, go mod tidy and go mod download does not change the versions.
The issue is that dependencies(and dependencies of dependencies) use invalid (in Go 1.13) versions in their modules. Fixed that in 21f0ab1
efe05a2 is required, since the old commit is incompatible with Go 1.13

The only way to fix these without replace is to update the dependencies (namely, github.com/moby/buildkit) to a version, where the requested versions are valid.

[jpreese]

Looking at oras .mod they're replacing their docker with 0.7.3 specifically.

We had a previous run in with this module in the past which can be seen here and in their own repository here

You've dug into this more than I have, but as a quick test I just deleted all of the requirements in the go.mod file with a single replace:

replace github.com/docker/docker => github.com/moby/moby v0.7.3-0.20190826074503-38ab9da00309

Ran a go mod tidy to repopulate the requirements, built, and it looks to be kosher with a much smaller go.mod file

[jpreese]

FWIW this is what mine looked like after running the above commands

module github.com/instrumenta/conftest

go 1.13

replace github.com/docker/docker => github.com/moby/moby v0.7.3-0.20190826074503-38ab9da00309

require (
	cuelang.org/go v0.0.9
	github.com/BurntSushi/toml v0.3.1
	github.com/containerd/containerd v1.3.0-beta.2.0.20190823190603-4a2f61c4f2b4
	github.com/deislabs/oras v0.7.0
	github.com/ghodss/yaml v1.0.0
	github.com/go-ini/ini v1.46.0
	github.com/gobwas/glob v0.2.3 // indirect
	github.com/hashicorp/terraform v0.12.8
	github.com/logrusorgru/aurora v0.0.0-20190803045625-94edacc10f9b
	github.com/moby/buildkit v0.6.1
	github.com/open-policy-agent/opa v0.13.5
	github.com/opencontainers/image-spec v1.0.1
	github.com/sirupsen/logrus v1.4.2
	github.com/spf13/cobra v0.0.5
	github.com/spf13/viper v1.4.0
	github.com/stretchr/testify v1.4.0
	github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b // indirect
)

[rvolosatovs]

Ok, I:

1. removed the require and replace blocks from go.mod
2. tried go mod tidy until it worked (and added replaces for invalid versions with error message)
3. recreated the go.sum

replace github.com/docker/docker => github.com/moby/moby v0.7.3-0.20190826074503-38ab9da00309 is quite dangerous, since that replaces docker version used in all dependencies and can potentially break something. In this case we can just replace the incorrect versions, which is cleaner

[rvolosatovs]

Missed the Thrift replace in previous commit

[jpreese]

I'm fine with specifying a specific docker version, we should just replace my previous comment with that and be good without needing so many other replaces

module github.com/instrumenta/conftest

go 1.13

replace github.com/docker/docker v0.0.0-00010101000000-000000000000 => github.com/moby/moby v0.7.3-0.20190826074503-38ab9da00309

require (
	cuelang.org/go v0.0.11
	github.com/BurntSushi/toml v0.3.1
	github.com/containerd/containerd v1.3.0-rc.1
	github.com/deislabs/oras v0.7.0
	github.com/ghodss/yaml v1.0.0
	github.com/go-ini/ini v1.46.0
	github.com/gobwas/glob v0.2.3 // indirect
	github.com/hashicorp/terraform v0.12.8
	github.com/logrusorgru/aurora v0.0.0-20190803045625-94edacc10f9b
	github.com/moby/buildkit v0.6.1
	github.com/open-policy-agent/opa v0.14.0
	github.com/opencontainers/image-spec v1.0.1
	github.com/sirupsen/logrus v1.4.2
	github.com/spf13/cobra v0.0.5
	github.com/spf13/viper v1.4.0
	github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b // indirect
)

[rvolosatovs]

The replaces are necessary for go mod commands to succeed.
Here's output with the go.mod you suggest:

cat go.mod && go mod download
module github.com/instrumenta/conftest

go 1.13

replace github.com/docker/docker v0.0.0-00010101000000-000000000000 => github.com/moby/moby v0.7.3-0.20190826074503-38ab9da00309

require (
        cuelang.org/go v0.0.11
        github.com/BurntSushi/toml v0.3.1
        github.com/containerd/containerd v1.3.0-rc.1
        github.com/deislabs/oras v0.7.0
        github.com/ghodss/yaml v1.0.0
        github.com/go-ini/ini v1.46.0
        github.com/gobwas/glob v0.2.3 // indirect
        github.com/hashicorp/terraform v0.12.8
        github.com/logrusorgru/aurora v0.0.0-20190803045625-94edacc10f9b
        github.com/moby/buildkit v0.6.1
        github.com/open-policy-agent/opa v0.14.0
        github.com/opencontainers/image-spec v1.0.1
        github.com/sirupsen/logrus v1.4.2
        github.com/spf13/cobra v0.0.5
        github.com/spf13/viper v1.4.0
        github.com/yashtewari/glob-intersection v0.0.0-20180916065949-5c77d914dd0b // indirect
)
go: github.com/moby/buildkit@v0.6.1 requires
        github.com/containerd/containerd@v1.3.0-0.20190507210959-7c1e88399ec0: invalid pseudo-version: version before v1.3.0 would have negative patch number

[jpreese]

Odd. I'm out of town for the weekend so can't run it till later, but was definitely able to get it to build with a single replace.

I just deleted all of the required modules, leaving only the single replace, built, and then added rc1 for container.

I was using the go1.13 binary with the environment variables

[garethr]

Updated in #99