*: update dependencies

.travis.yml

@@ -1,16 +1,20 @@
+os: linux
+dist: bionic
+
 language: go
+go:
+  - 1.x
 
-# `make ci` uses Docker.
-sudo: required
 services:
   - docker
 
-go:
-  - 1.x
-
 before_install:
   - sudo sh -c "apt-get -qq update && apt-get install -y gcc-multilib"
-  - go get -u -v github.com/cpuguy83/go-md2man
+  # Need to set GO111MODULE=off here because Travis runs inside our source repo
+  # (which is a Go module) and thus 'go get' will actually add dependencies to
+  # our go.mod file. Annoyingly this means we cannot require v2 of go-md2man
+  # because that requires Go module support.
+  - GO111MODULE=off go get -u -v github.com/cpuguy83/go-md2man
 
 env:
   - DOCKER_IMAGE="opensuse/leap:latest"
@@ -22,12 +26,20 @@ env:
 matrix:
   fast_finish: true
   allow_failures:
+    # The Fedora image has caused us plenty of pain in the past, so don't let
+    # it kill PRs. This is made more annoying by the fact that the Fedora
+    # image's size makes this test stage take much longer than any other image
+    # (~40 minutes on some days).
     - env: DOCKER_IMAGE="fedora:latest"
 
 notifications:
   email: false
 
 script:
-  - chmod a+rwx . # Necessary to make Travis co-operate with Docker.
-  - make GO111MODULE=off GOARCH=386 local-validate-build # Make sure 32-bit builds work.
+  # Necessary to make Travis co-operate with Docker.
+  - chmod a+rwx .
+  # Make sure 32-bit builds work. I'm not sure why GO111MODULE breaks here, but
+  # disable it since we just care about whether you get compiler errors.
+  - make GO111MODULE=off GOARCH=386 local-validate-build
+  # Run the actual CI.
   - make DOCKER_IMAGE=$DOCKER_IMAGE ci

Dockerfile

@@ -17,15 +17,16 @@ FROM opensuse/leap:latest
 MAINTAINER "Aleksa Sarai <asarai@suse.com>"
 
 # We have to use out-of-tree repos because several packages haven't been merged
-# into openSUSE:Factory yet.
+# into openSUSE Leap yet, or are out of date in Leap.
 RUN zypper ar -f -p 10 -g obs://Virtualization:containers obs-vc && \
 	zypper ar -f -p 10 -g obs://home:cyphar:bats obs-bats && \
+	zypper ar -f -p 10 -g obs://devel:languages:go obs-go && \
 	zypper --gpg-auto-import-keys -n ref && \
 	zypper -n up
 RUN zypper -n in \
 		bats \
 		git \
-		"go>=1.11" \
+		go1.14 \
 		go-mtree \
 		jq \
 		libcap-progs \
@@ -36,9 +37,9 @@ RUN zypper -n in \
 		python-setuptools python-xattr attr \
 		skopeo \
 		tar
+RUN useradd -u 1000 -m -d /home/rootless -s /bin/bash rootless
 
-ENV GOPATH /go
-ENV PATH $GOPATH/bin:$PATH
+ENV GOPATH=/go PATH=/go/bin:$PATH
 RUN go get -u github.com/cpuguy83/go-md2man && \
     go get -u golang.org/x/lint/golint && \
     go get -u github.com/securego/gosec/cmd/gosec && \

Makefile

@@ -19,7 +19,7 @@ SHELL = /bin/bash
 # Go tools.
 GO ?= go
 GO_MD2MAN ?= go-md2man
-export GO111MODULE=off
+export GO111MODULE=on
 
 # Set up the ... lovely ... GOPATH hacks.
 PROJECT := github.com/opencontainers/umoci
@@ -114,9 +114,9 @@ local-validate-go:
 	test -z "$$(gosec -quiet -exclude=G301,G302,G304 $$GOPATH/$(PROJECT)/... | tee /dev/stderr)"
 	./hack/test-vendor.sh
 
-# TODO: This currently fails if you run it right after 'make docs'.
 .PHONY: local-validate-spell
 local-validate-spell:
+	make clean
 	@type misspell  >/dev/null 2>/dev/null || (echo "ERROR: misspell not found." && false)
 	test -z "$$(find . -type f -print0 | xargs -0 misspell | grep -vE '/(vendor|third_party|\.site)/' | tee /dev/stderr)"
 

go.mod

@@ -3,39 +3,32 @@ module github.com/opencontainers/umoci
 go 1.14
 
 require (
-	github.com/apex/log v1.1.1
-	github.com/aphistic/sweet v0.3.0 // indirect
-	github.com/aws/aws-sdk-go v1.23.21 // indirect
+	github.com/apex/log v1.4.0
+	github.com/cpuguy83/go-md2man/v2 v2.0.0 // indirect
 	github.com/cyphar/filepath-securejoin v0.2.2
 	github.com/docker/go-units v0.4.0
-	github.com/golang/protobuf v1.3.2
-	github.com/klauspost/compress v1.8.3 // indirect
-	github.com/klauspost/cpuid v1.2.1 // indirect
-	github.com/klauspost/pgzip v1.2.1
-	github.com/konsorten/go-windows-terminal-sequences v1.0.2 // indirect
-	github.com/kr/pretty v0.1.0 // indirect
-	github.com/kr/pty v1.1.8 // indirect
-	github.com/mattn/go-isatty v0.0.9 // indirect
+	github.com/golang/protobuf v1.4.2
+	github.com/klauspost/compress v1.10.9 // indirect
+	github.com/klauspost/pgzip v1.2.4
 	github.com/mohae/deepcopy v0.0.0-20170929034955-c48cc78d4826
-	github.com/onsi/ginkgo v1.10.1 // indirect
-	github.com/onsi/gomega v1.7.0 // indirect
-	github.com/opencontainers/go-digest v1.0.0-rc1
+	github.com/opencontainers/go-digest v1.0.0
 	github.com/opencontainers/image-spec v1.0.1
-	github.com/opencontainers/runtime-spec v1.0.1
-	github.com/pkg/errors v0.8.1
-	github.com/rogpeppe/fastuuid v1.2.0 // indirect
+	github.com/opencontainers/runtime-spec v1.0.2
+	github.com/pkg/errors v0.9.1
 	github.com/rootless-containers/proto v0.1.0
-	github.com/sirupsen/logrus v1.4.2 // indirect
-	github.com/smartystreets/gunit v1.0.4 // indirect
-	github.com/stretchr/objx v0.2.0 // indirect
-	github.com/stretchr/testify v1.4.0 // indirect
+	github.com/sirupsen/logrus v1.6.0 // indirect
 	github.com/urfave/cli v1.22.1
-	github.com/vbatts/go-mtree v0.4.4
-	golang.org/x/crypto v0.0.0-20190911031432-227b76d455e7 // indirect
-	golang.org/x/net v0.0.0-20190912160710-24e19bdeb0f2
-	golang.org/x/sync v0.0.0-20190911185100-cd5d95a43a6e // indirect
-	golang.org/x/sys v0.0.0-20190913121621-c3b328c6e5a7
-	golang.org/x/text v0.3.2 // indirect
-	golang.org/x/tools v0.0.0-20190913181337-0240832f5c3d // indirect
-	gopkg.in/check.v1 v1.0.0-20190902080502-41f04d3bba15 // indirect
+	github.com/vbatts/go-mtree v0.5.0
+	golang.org/x/crypto v0.0.0-20200604202706-70a84ac30bf9 // indirect
+	golang.org/x/net v0.0.0-20200602114024-627f9648deb9
+	golang.org/x/sys v0.0.0-20200615200032-f1bc736245b1
+	google.golang.org/protobuf v1.24.0 // indirect
+)
+
+exclude (
+	// These versions have regressions that break umoci's CI and UX. For more
+	// details, see <https://github.com/urfave/cli/issues/1152>.
+	github.com/urfave/cli v1.22.2
+	github.com/urfave/cli v1.22.3
+	github.com/urfave/cli v1.22.4
 )