flux commands panic when $HOME $XDG_CONFIG_HOME unset

[hillsprig]

Describe the bug

I'm running a couple of flux commands in daemon scripts to check and do various operations towards my edge cluster.

In Flux 2.2.3 this worked fine. In Flux 2.3.0 we get a panic unless either $HOME or $XDG_CONFIG_HOME is set.

Steps to reproduce

% env -u HOME -u XDG_CONFIG_HOME ./flux_2.3.0_linux_amd64 check

panic: neither $XDG_CONFIG_HOME nor $HOME are defined

goroutine 1 [running]:
github.com/notaryproject/notation-go/dir.loadUserPath()
/home/runner/go/pkg/mod/github.com/notaryproject/notation-go@v1.1.0/dir/path.go:85 +0xc5
github.com/notaryproject/notation-go/dir.init.0()
/home/runner/go/pkg/mod/github.com/notaryproject/notation-go@v1.1.0/dir/path.go:77 +0xf

Expected behavior

% env -u HOME -u XDG_CONFIG_HOME ./flux_2.2.3_linux_amd64 check

► checking prerequisites
✗ flux 2.2.3 <2.3.0 (new CLI version is available, please upgrade)
✔ Kubernetes 1.30.4+k3s1 >=1.26.0-0
► checking version in cluster
✔ distribution: flux-v0.0.0-dev.0
✔ bootstrapped: false
► checking controllers
✔ helm-controller: deployment ready
► ghcr.io/fluxcd/helm-controller:v1.0.1
✔ kustomize-controller: deployment ready
► ghcr.io/fluxcd/kustomize-controller:v1.3.0
✔ notification-controller: deployment ready
► ghcr.io/fluxcd/notification-controller:v1.3.0
✔ source-controller: deployment ready
► ghcr.io/fluxcd/source-controller:v1.3.0
► checking crds
✔ alerts.notification.toolkit.fluxcd.io/v1beta3
✔ buckets.source.toolkit.fluxcd.io/v1beta2
✔ gitrepositories.source.toolkit.fluxcd.io/v1
✔ helmcharts.source.toolkit.fluxcd.io/v1
✔ helmreleases.helm.toolkit.fluxcd.io/v2
✔ helmrepositories.source.toolkit.fluxcd.io/v1
✔ kustomizations.kustomize.toolkit.fluxcd.io/v1
✔ ocirepositories.source.toolkit.fluxcd.io/v1beta2
✔ providers.notification.toolkit.fluxcd.io/v1beta3
✔ receivers.notification.toolkit.fluxcd.io/v1
✔ all checks passed

Screenshots and recordings

No response

OS / Distro

Arch Linux, Debian Bookworm

Flux version

v2.3.0

Flux check

N/A

Git provider

No response

Container Registry provider

No response

Additional context

No response

Code of Conduct

• I agree to follow this project's Code of Conduct

[stefanprodan]

We've added validation for notation polices in #4735 which imports the notation-go that has a init function which panics here: https://github.com/notaryproject/notation-go/blob/974c2916fa135b977b02db1714efb6ed2ecec0f3/dir/path.go#L82-L97 It's sad to see an SDK that does this on init, it's a major anti-pattern in Go to have init functions in packages... I see no way around this but to drop the notation dependency from Flux by removing the validation code.

cc @JasonTheDeveloper @darkowlzz

[JasonTheDeveloper]

@stefanprodan thank you for letting me know. I'll raise it with the notation team and see if we can push an update through asap. I'll double check there's no other init funcs that panic while I'm at it