packaging+docker: Outdated go.mod used in images and tarball

[btasker]

What version of Go are you using (go version)?

go version go1.20.4 linux/amd64
(docker image golang:1.20.4)

Does this issue reproduce with the latest release?

Yes

What operating system and processor architecture are you using (go env)?

go env Output

$ go env
GO111MODULE=""
GOARCH="amd64"
GOBIN=""
GOCACHE="/root/.cache/go-build"
GOENV="/root/.config/go/env"
GOEXE=""
GOEXPERIMENT=""
GOFLAGS=""
GOHOSTARCH="amd64"
GOHOSTOS="linux"
GOINSECURE=""
GOMODCACHE="/go/pkg/mod"
GONOPROXY=""
GONOSUMDB=""
GOOS="linux"
GOPATH="/go"
GOPRIVATE=""
GOPROXY="https://proxy.golang.org,direct"
GOROOT="/usr/local/go"
GOSUMDB="sum.golang.org"
GOTMPDIR=""
GOTOOLDIR="/usr/local/go/pkg/tool/linux_amd64"
GOVCS=""
GOVERSION="go1.20.4"
GCCGO="gccgo"
GOAMD64="v1"
AR="ar"
CC="gcc"
CXX="g++"
CGO_ENABLED="1"
GOMOD="/dev/null"
GOWORK=""
CGO_CFLAGS="-O2 -g"
CGO_CPPFLAGS=""
CGO_CXXFLAGS="-O2 -g"
CGO_FFLAGS="-O2 -g"
CGO_LDFLAGS="-O2 -g"
PKG_CONFIG="pkg-config"
GOGCCFLAGS="-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -fdebug-prefix-map=/tmp/go-build2411391097=/tmp/go-build -gno-record-gcc-switches"

What did you do?

Started a Go docker container - docker run -it --rm -v $PWD:/src golang:1.20.4 bash and built a project in order to confirm the fix in golang/net@82780d6 took effect

What did you expect to see?

The fix should exist in the h2 bundle (/usr/local/go/src/net/http/h2_bundle.go)

What did you see instead?

It does not (and the issue still repros) because h2_bundle.go is still based on x/net v.4.1

Extra

To try and dig into it a bit further, I figured I'd manually update the bundle and see whether that pulled the changes down

root@dfd0ea978345:/# git clone https://github.com/golang/tools.git
root@dfd0ea978345:~/tools/cmd/bundle# cd tools/cmd/bundle
root@dfd0ea978345:~/tools/cmd/bundle# go build main.go
root@dfd0ea978345:~/tools/cmd/bundle# cp main /bundle

# Taken from the header of the existing bundle
root@dfd0ea978345:/usr/local/go/src/net/http# /bundle -o=h2_bundle.go -prefix=http2 -tags='!nethttpomithttp2' golang.org/x/net/http2`

The file regenerated on disk, but the fix still wasn't in there.

The reason for this was in /usr/local/go/src/go.mod:

root@d8a072516a9a:/go# grep "x/net" /usr/local/go/src/go.mod 
	golang.org/x/net v0.4.1-0.20230214201333-88ed8ca3307d

The docker container is referencing a really old version.

I updated to use v0.10.0 (as here) and updated vendor/modules.txt) accordingly.

The bundle then updated correctly and I was able to build my project with the expected fix in place

[btasker]

Although it's the docker image that I noticed this in, it looks like it's the upstream tarball that's the issue.

The Dockerfile does

wget "https://dl.google.com/go/go1.20.4.linux-amd64.tar.gz"

If we check that

ben@ratchett:~/tmp/go_bundle$ tar xzf go1.20.4.linux-amd64.tar.gz
ben@ratchett:~/tmp/go_bundle$ grep x/net go/src/go.mod 
	golang.org/x/net v0.4.1-0.20230214201333-88ed8ca3307d

[btasker]

For completeness, this affects the Mac and Windows packages too

ben@ratchett:~/tmp/go_bundle$ tar xzf go1.20.4.darwin-amd64.tar.gz 
ben@ratchett:~/tmp/go_bundle$ grep x/net go/src/go.mod 
	golang.org/x/net v0.4.1-0.20230214201333-88ed8ca3307d

ben@ratchett:~/tmp/go_bundle$ unzip go1.20.4.windows-386.zip
ben@ratchett:~/tmp/go_bundle$ grep x/net go/src/go.mod 
	golang.org/x/net v0.4.1-0.20230214201333-88ed8ca3307d

[btasker]

Oh, doh.... they're psuedo-versions.

88ed8ca3307d is the final commit on this branch: https://github.com/golang/net/commits/internal-branch.go1.20-vendor

So, I guess I've jumped the gun and the fix I'm after won't be until 1.20.5 then

[btasker]

Hey @seankhliao - quick follow up: it doesn't look like it's in the list for 1.20.5 either: https://github.com/golang/go/issues?q=milestone%3AGo1.20.5+

Just wanted to make sure the fix itself hadn't been overlooked - there isn't a PR on the github side, because it was created directly in Gerrit: https://go-review.googlesource.com/c/net/+/486156

[seankhliao]

typically we will not backport, our policy is at https://github.com/golang/go/wiki/MinorReleases

[btasker]

Thanks! I think this probably meets the criteria, so I'll raise a cherrypick request so that it can be assessed there