Add Makefile, buildx target to ensure root and e2e go.mod are kept in sync

Signed-off-by: Laura Brehm <laurabrehm@hey.com>

Dockerfile

@@ -69,6 +69,11 @@ RUN --mount=type=bind,target=.,rw <<EOT
   fi
 EOT
 
+FROM vendored AS modules-validate
+RUN apk add --no-cache bash
+RUN apk add --no-cache jq
+RUN --mount=type=bind,target=.,rw ./verify-go-modules.sh e2e
+
 FROM build-base AS build
 ARG BUILD_TAGS
 ARG TARGETPLATFORM

Makefile

@@ -129,8 +129,13 @@ go-mod-tidy: ## Run go mod tidy in a container and output resulting go.mod and g
 .PHONY: validate-go-mod
 validate-go-mod: ## Validate go.mod and go.sum are up-to-date
 	$(BUILDX_CMD) bake vendor-validate
+	$(BUILDX_CMD) bake modules-validate
 
-validate: validate-go-mod validate-headers validate-docs ## Validate sources
+.PHONY: validate-modules
+validate-modules: ## Validate root and e2e go.mod are synced
+	$(BUILDX_CMD) bake modules-validate
+
+validate: validate-go-mod validate-modules validate-headers validate-docs  ## Validate sources
 
 pre-commit: validate check-dependencies lint build test e2e-compose
 

docker-bake.hcl

@@ -71,6 +71,12 @@ target "vendor-validate" {
   output = ["type=cacheonly"]
 }
 
+target "modules-validate" {
+  inherits = ["_common"]
+  target = "modules-validate"
+  output = ["type=cacheonly"]
+}
+
 target "vendor" {
   inherits = ["_common"]
   target = "vendor-update"

e2e/go.mod

@@ -21,9 +21,9 @@ require (
 	github.com/buger/goterm v1.0.4 // indirect
 	github.com/cenkalti/backoff/v4 v4.1.2 // indirect
 	github.com/cespare/xxhash/v2 v2.1.2 // indirect
-	github.com/cnabio/cnab-go v0.24.1-0.20220907172316-1ca5c8721bf7 // indirect
+	github.com/cnabio/cnab-go v0.23.4 // indirect
 	github.com/cnabio/cnab-to-oci v0.3.7 // indirect
-	github.com/compose-spec/compose-go v1.5.1 // indirect
+	github.com/compose-spec/compose-go v1.6.0 // indirect
 	github.com/containerd/console v1.0.3 // indirect
 	github.com/containerd/containerd v1.6.8 // indirect
 	github.com/containerd/continuity v0.2.3-0.20220330195504-d132b287edc8 // indirect
@@ -33,7 +33,7 @@ require (
 	github.com/cucumber/messages-go/v16 v16.0.1 // indirect
 	github.com/cyberphone/json-canonicalization v0.0.0-20210303052042-6bc126869bf4 // indirect
 	github.com/davecgh/go-spew v1.1.1 // indirect
-	github.com/distribution/distribution/v3 v3.0.0-20220902125104-0122d7ddaec0 // indirect
+	github.com/distribution/distribution/v3 v3.0.0-20220907155224-78b9c98c5c31 // indirect
 	github.com/docker/buildx v0.8.2 // indirect
 	github.com/docker/cli v20.10.17+incompatible // indirect
 	github.com/docker/distribution v2.8.1+incompatible // indirect
@@ -77,9 +77,7 @@ require (
 	github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
 	github.com/mgutz/ansi v0.0.0-20170206155736-9520e82c474b // indirect
 	github.com/miekg/pkcs11 v1.1.1 // indirect
-	github.com/mitchellh/copystructure v1.0.0 // indirect
 	github.com/mitchellh/mapstructure v1.5.0 // indirect
-	github.com/mitchellh/reflectwalk v1.0.0 // indirect
 	github.com/moby/buildkit v0.10.4 // indirect
 	github.com/moby/locker v1.0.1 // indirect
 	github.com/moby/spdystream v0.2.0 // indirect

e2e/go.sum

@@ -269,8 +269,8 @@ github.com/client9/misspell v0.3.4/go.mod h1:qj6jICC3Q7zFZvVWo7KLAzC3yx5G7kyvSDk
 github.com/cloudflare/cfssl v0.0.0-20180223231731-4e2dcbde5004/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
 github.com/cloudflare/cfssl v0.0.0-20181213083726-b94e044bb51e/go.mod h1:yMWuSON2oQp+43nFtAV/uvKQIFpSPerB57DCt9t8sSA=
 github.com/cloudflare/cfssl v1.4.1 h1:vScfU2DrIUI9VPHBVeeAQ0q5A+9yshO1Gz+3QoUQiKw=
-github.com/cnabio/cnab-go v0.24.1-0.20220907172316-1ca5c8721bf7 h1:6cETeoyahKaH4hNShuB4KUqkTdjLVKEpTakHW5bpDW8=
+github.com/cnabio/cnab-go v0.23.4 h1:jplQcSnvFyQlD6swiqL3BmqRnhbnS+lc/EKdBLH9E80=
-github.com/cnabio/cnab-go v0.24.1-0.20220907172316-1ca5c8721bf7/go.mod h1:Zm0HTH8xxzinB64SXm7KFSna7DEN0ZjZwrRwZpfgChU=
+github.com/cnabio/cnab-go v0.23.4/go.mod h1:9EmgHR51LFqQStzaC+xHPJlkD4OPsF6Ev5Y8e/YHEns=
 github.com/cnabio/cnab-to-oci v0.3.7 h1:wA2AG3HQMaJZhWlr3zsfVoa2m5B1R/SP+YcoFuNfP9o=
 github.com/cnabio/cnab-to-oci v0.3.7/go.mod h1:AvVNl0Hh3VBk1zqeLdyE5S3bTQ5EsZPPF4mUUJYyy1Y=
 github.com/cncf/udpa/go v0.0.0-20191209042840-269d4d468f6f/go.mod h1:M8M6+tZqaGXZJjfX53e64911xZQV5JYwmTeXPW+k8Sc=
@@ -287,8 +287,8 @@ github.com/cockroachdb/errors v1.2.4/go.mod h1:rQD95gz6FARkaKkQXUksEje/d9a6wBJoC
 github.com/cockroachdb/logtags v0.0.0-20190617123548-eb05cc24525f/go.mod h1:i/u985jwjWRlyHXQbwatDASoW0RMlZ/3i9yJHE2xLkI=
 github.com/codahale/hdrhistogram v0.0.0-20160425231609-f8ad88b59a58/go.mod h1:sE/e/2PUdi/liOCUjSTXgM1o87ZssimdTWN964YiIeI=
 github.com/compose-spec/compose-go v1.2.1/go.mod h1:pAy7Mikpeft4pxkFU565/DRHEbDfR84G6AQuiL+Hdg8=
-github.com/compose-spec/compose-go v1.5.1 h1:qch68VrytuoNMtklbdkhkI6FgDVLuFrUwWK1Lj828Xo=
+github.com/compose-spec/compose-go v1.6.0 h1:7Ol/UULMUtbPmB0EYrETASRoum821JpOh/XaEf+hN+Q=
-github.com/compose-spec/compose-go v1.5.1/go.mod h1:nVa8sWM16GzxGLZ1kGrUtEt6RGimsdMmIzULVVD6S9k=
+github.com/compose-spec/compose-go v1.6.0/go.mod h1:os+Ulh2jlZxY1XT1hbciERadjSUU/BtZ6+gcN7vD7J0=
 github.com/containerd/aufs v0.0.0-20200908144142-dab0cbea06f4/go.mod h1:nukgQABAEopAHvB6j7cnP5zJ+/3aVcE7hCYqvIwAHyE=
 github.com/containerd/aufs v0.0.0-20201003224125-76a6863f2989/go.mod h1:AkGGQs9NM2vtYHaUen+NljV0/baGCAPELGm2q9ZXpWU=
 github.com/containerd/aufs v0.0.0-20210316121734-20793ff83c97/go.mod h1:kL5kd6KM5TzQjR79jljyi4olc1Vrx6XBlcyj3gNv2PU=
@@ -456,8 +456,8 @@ github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/distribution/distribution/v3 v3.0.0-20210316161203-a01c71e2477e/go.mod h1:xpWTC2KnJMiDLkoawhsPQcXjvwATEBcbq0xevG2YR9M=
-github.com/distribution/distribution/v3 v3.0.0-20220902125104-0122d7ddaec0 h1:0UuPq7m6stSY6at1v5PLo0zzYTpailcwjhmkJpgnGBY=
+github.com/distribution/distribution/v3 v3.0.0-20220907155224-78b9c98c5c31 h1:AqcwAyaSEkILnr/bLybFnM2i/+EW67JJIRs/4dWmzxo=
-github.com/distribution/distribution/v3 v3.0.0-20220902125104-0122d7ddaec0/go.mod h1:28YO/VJk9/64+sTGNuYaBjWxrXTPrj0C0XmgTIOjxX4=
+github.com/distribution/distribution/v3 v3.0.0-20220907155224-78b9c98c5c31/go.mod h1:XrR+08YQxO57vT8gtNmhLfHy/YIutMmmEeKMhU7zXqY=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/buildx v0.8.2 h1:dsd3F0hhmUydFX/KFrvbK81JvlTA4T3Iy0lwDJt4PsU=
 github.com/docker/buildx v0.8.2/go.mod h1:5sMOfNwOmO2jy/MxBL4ySk2LoLIG1tQFu2EU8wbKa34=
@@ -1020,8 +1020,6 @@ github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
 github.com/miekg/pkcs11 v1.1.1/go.mod h1:XsNlhZGX73bx86s2hdc/FuaLm2CPZJemRLMA+WTFxgs=
 github.com/mistifyio/go-zfs v2.1.2-0.20190413222219-f784269be439+incompatible/go.mod h1:8AuVvqP/mXw1px98n46wfvcGfQ4ci2FwoAjKYxuo3Z4=
 github.com/mitchellh/cli v1.0.0/go.mod h1:hNIlj7HEI86fIcpObd7a0FcrxTWetlwJDGcceTlRvqc=
-github.com/mitchellh/copystructure v1.0.0 h1:Laisrj+bAB6b/yJwB5Bt3ITZhGJdqmxquMKeZ+mmkFQ=
-github.com/mitchellh/copystructure v1.0.0/go.mod h1:SNtv71yrdKgLRyLFxmLdkAbkKEFWgYaq1OVrnRcwhnw=
 github.com/mitchellh/go-homedir v1.0.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-homedir v1.1.0/go.mod h1:SfyaCUpYCn1Vlf4IUYiD9fPX4A5wJrkLzIz1N1q0pr0=
 github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b/go.mod h1:r1VsdOzOPt1ZSrGZWFoNhsAedKnEd6r9Np1+5blZCWk=
@@ -1040,8 +1038,6 @@ github.com/mitchellh/mapstructure v1.4.3/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RR
 github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
 github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
 github.com/mitchellh/osext v0.0.0-20151018003038-5e2d6d41470f/go.mod h1:OkQIRizQZAeMln+1tSwduZz7+Af5oFlKirV/MSYes2A=
-github.com/mitchellh/reflectwalk v1.0.0 h1:9D+8oIskB4VJBN5SFlmc27fSlIBZaov1Wpk/IfikLNY=
-github.com/mitchellh/reflectwalk v1.0.0/go.mod h1:mSTlrgnPZtwu0c4WaC2kGObEpuNDbx0jmZXqmk4esnw=
 github.com/moby/buildkit v0.8.1/go.mod h1:/kyU1hKy/aYCuP39GZA9MaKioovHku57N6cqlKZIaiQ=
 github.com/moby/buildkit v0.10.1-0.20220403220257-10e6f94bf90d/go.mod h1:WvwAZv8aRScHkqc/+X46cRC2CKMKpqcaX+pRvUTtPes=
 github.com/moby/buildkit v0.10.4 h1:FvC+buO8isGpUFZ1abdSLdGHZVqg9sqI4BbFL8tlzP4=

go.mod

@@ -9,7 +9,7 @@ require (
 	github.com/compose-spec/compose-go v1.5.1
 	github.com/containerd/console v1.0.3
 	github.com/containerd/containerd v1.6.8
-	github.com/distribution/distribution/v3 v3.0.0-20220902125104-0122d7ddaec0
+	github.com/distribution/distribution/v3 v3.0.0-20220907155224-78b9c98c5c31
 	github.com/docker/buildx v0.8.2 // when updating, also update the replace rules accordingly
 	github.com/docker/cli v20.10.17+incompatible
 	github.com/docker/cli-docs-tool v0.5.0

go.sum

@@ -450,8 +450,8 @@ github.com/dgryski/go-sip13 v0.0.0-20181026042036-e10d5fee7954/go.mod h1:vAd38F8
 github.com/dimchansky/utfbom v1.1.0/go.mod h1:rO41eb7gLfo8SF1jd9F8HplJm1Fewwi4mQvIirEdv+8=
 github.com/dimchansky/utfbom v1.1.1/go.mod h1:SxdoEBH5qIqFocHMyGOXVAybYJdr71b1Q/j0mACtrfE=
 github.com/distribution/distribution/v3 v3.0.0-20210316161203-a01c71e2477e/go.mod h1:xpWTC2KnJMiDLkoawhsPQcXjvwATEBcbq0xevG2YR9M=
-github.com/distribution/distribution/v3 v3.0.0-20220902125104-0122d7ddaec0 h1:0UuPq7m6stSY6at1v5PLo0zzYTpailcwjhmkJpgnGBY=
+github.com/distribution/distribution/v3 v3.0.0-20220907155224-78b9c98c5c31 h1:AqcwAyaSEkILnr/bLybFnM2i/+EW67JJIRs/4dWmzxo=
-github.com/distribution/distribution/v3 v3.0.0-20220902125104-0122d7ddaec0/go.mod h1:28YO/VJk9/64+sTGNuYaBjWxrXTPrj0C0XmgTIOjxX4=
+github.com/distribution/distribution/v3 v3.0.0-20220907155224-78b9c98c5c31/go.mod h1:XrR+08YQxO57vT8gtNmhLfHy/YIutMmmEeKMhU7zXqY=
 github.com/dnaeon/go-vcr v1.0.1/go.mod h1:aBB1+wY4s93YsC3HHjMBMrwTj2R9FHDzUr9KyGc8n1E=
 github.com/docker/buildx v0.8.2 h1:dsd3F0hhmUydFX/KFrvbK81JvlTA4T3Iy0lwDJt4PsU=
 github.com/docker/buildx v0.8.2/go.mod h1:5sMOfNwOmO2jy/MxBL4ySk2LoLIG1tQFu2EU8wbKa34=

verify-go-modules.sh

@@ -0,0 +1,112 @@
+#!/usr/bin/env bash
+
+#   Copyright The containerd Authors.
+
+#   Licensed under the Apache License, Version 2.0 (the "License");
+#   you may not use this file except in compliance with the License.
+#   You may obtain a copy of the License at
+
+#       http://www.apache.org/licenses/LICENSE-2.0
+
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS,
+#   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#   See the License for the specific language governing permissions and
+#   limitations under the License.
+
+#
+# verifies if the require and replace directives for two go.mod files are in sync
+#
+set -eu -o pipefail
+
+ROOT=$(dirname "${BASH_SOURCE}")
+
+if [ "$#" -ne 1 ]; then
+  echo "Usage: $0 dir-for-second-go-mod"
+  exit 1
+fi
+
+if ! command -v jq &> /dev/null ; then
+  echo Please install jq
+  exit 1
+fi
+
+# Load the requires and replaces section in the root go.mod file
+declare -A map_requires_1
+declare -A map_replaces_1
+pushd "${ROOT}" > /dev/null
+while IFS='#' read -r key value
+do
+  map_requires_1[$key]="$value"
+done<<<$(go mod edit -json | jq -r '.Require[] | .Path +  " # " + .Version')
+while IFS='#' read -r key value
+do
+  [ "$key" = "" ] || map_replaces_1[$key]="$value"
+done<<<$(go mod edit -json | jq -r 'try .Replace[] | .Old.Path + " # " + .New.Path + " : " + .New.Version')
+popd > /dev/null
+
+# Load the requires and replaces section in the other go.mod file
+declare -A map_requires_2
+declare -A map_replaces_2
+pushd "${ROOT}/$1" > /dev/null
+while IFS='#' read -r key value
+do
+  [ "$key" = "" ] || map_requires_2[$key]="$value"
+done<<<$(go mod edit -json | jq -r '.Require[] | .Path +  " # " + .Version')
+while IFS='#' read -r key value
+do
+  map_replaces_2[$key]="$value"
+done<<<$(go mod edit -json | jq -r 'try .Replace[] | .Old.Path + " # " + .New.Path + " : " + .New.Version')
+popd > /dev/null
+
+# signal for errors later
+ERRORS=0
+
+# iterate through the second go.mod's require section and ensure that all items
+# have the same values in the root go.mod replace section
+for k in "${!map_requires_2[@]}"
+do
+  if [ -v "map_requires_1[$k]" ]; then
+    if [ "${map_requires_2[$k]}" != "${map_requires_1[$k]}" ]; then
+      echo "${k} has different values in the go.mod files require section:" \
+        "${map_requires_1[$k]} in root go.mod ${map_requires_2[$k]} in $1/go.mod"
+      ERRORS=$(( ERRORS + 1 ))
+    fi
+  fi
+done
+
+# iterate through the second go.mod's replace section and ensure that all items
+# have the same values in the root go.mod's replace section. Except for the
+# containerd/containerd which we know will be different
+for k in "${!map_replaces_2[@]}"
+do
+  if [[ "${k}" == "github.com/containerd/containerd"* ]]; then
+    continue
+  fi
+  if [ -v "map_replaces_1[$k]" ]; then
+    if [ "${map_replaces_2[$k]}" != "${map_replaces_1[$k]}" ]; then
+      echo "${k} has different values in the go.mod files replace section:" \
+        "${map_replaces_1[$k]} in root go.mod ${map_replaces_2[$k]} in $1/go.mod"
+      ERRORS=$(( ERRORS + 1 ))
+    fi
+  fi
+done
+
+# iterate through the root go.mod's replace section and ensure that all the
+# same items are present in the second go.mod's replace section and nothing is missing
+for k in "${!map_replaces_1[@]}"
+do
+  if [[ "${k}" == "github.com/containerd/containerd"* ]]; then
+    continue
+  fi
+  if [ ! -v "map_replaces_2[$k]" ]; then
+    echo "${k} has an entry in root go.mod replace section, but is missing from" \
+      " replace section in $1/go.mod"
+    ERRORS=$(( ERRORS + 1 ))
+  fi
+done
+
+if [ "$ERRORS" -ne 0 ]; then
+  echo "Found $ERRORS error(s)."
+  exit 1
+fi