Upgrade argo image to 2.12+

[Bobgy]

Part of #4553

/cc @NikeNano

[Bobgy]

/assign

[Bobgy]

I found that there's now a maintained tool to extract licenses from go libraries: https://github.com/google/go-licenses.

We can use it instead of our home-made tool.

UPDATE: I took a look and it seems this new tool doesn't support go modules, so it could only get licenses using a library's latest version IIUC. See google/go-licenses#33.

[Bobgy]

I'll have to keep using https://github.com/kubeflow/testing/tree/master/py/kubeflow/testing/go-license-tools

[Bobgy]

Noticed a problem with kubeflow go-license-tools, although

The command go list -m all lists the current module and all its dependencies:

I found that when using this command in argo repo, it lists a dependency: github.com/fasthttp-contrib/websocket. However, this repo doesn't have a license file.

So I kept investigating, and found that argo is not using this module. It's mentioned in go.sum, but not used anywhere in the repo.

Therefore, I can conclude that go list -m all lists too many dependencies, including those not used.

UPDATE: I take it back.

I learned that I can use go mod graph to search for dependency graph. https://stackoverflow.com/a/63779350/8745218

And I figured out that fasthttp-contrib/websocket is introduced by github.com/gavv/httpexpect/v2 v2.0.3

$ go mod graph | grep fasthttp-contrib/websocket
github.com/gavv/httpexpect/v2@v2.0.3 github.com/fasthttp-contrib/websocket@v0.0.0-20160511215533-1f3b11f56072
$ go mod graph | grep httpexpect
github.com/argoproj/argo/v2 github.com/gavv/httpexpect/v2@v2.0.3

httpexpect is only used in tests, but not built in the binary, so it's not a license issue for us.

[Bobgy]

In summary, two dependencies are problematic:

• https://github.com/yudai/pp mentions it is licensed under MIT, but it doesn't keep a copy of MIT license in the repo.
• https://github.com/fasthttp-contrib/websocket doesn't have a license

Both of them were imported by httpexpect v2.0.3 (a dev dependency), so I guess httpexpect isn't very well maintained either.
Well, httpexpect fixed this problem for fasthttp-contrib/websocket in gavv/httpexpect#74, and released 2.1.0 and 2.2.0 after that.

Because they are dev dependencies not built into images, we don't need to worry about them.

[Bobgy]

There are several images I'll need to generate license info, so I built a better tool to automate this: https://github.com/Bobgy/go-mod-licenses.

[davidspek]

@Bobgy Just came across this, thought it would be relevant. https://blog.argoproj.io/argo-workflows-v3-0-4d0b69f15a6e

[Bobgy]

@davidspek thanks, rationale for choosing 2.12 was recorded in #4553 (comment)

[Bobgy]

Hmm, I just discovered https://github.com/github/licensed, it's written in Ruby, but it seems to support a wide range of languages and a robust workflow for working with licenses & cache.

[Bobgy]

I'm starting to notice some limitations of my approach:

• dev dependencies are pulled in as well -- this greatly increases number of licenses and their problems to deal with (but in fact they may not be in the binary).
• only supports repos using one single license (not yet seeing an exception)

[Bobgy]

/reopen
I also need to update gcp marketplace manifests

[google-oss-robot]

@Bobgy: Reopened this issue.

In response to this:

/reopen
I also need to update gcp marketplace manifests

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.