Vendoring 0.199.0 fails with "goformation/v4 v4.0.0: missing ziphash: open hash: no such file or directory"

[kastl-ars]

Dear maintainers,

I am packaging eksctl for openSUSE. The latest version 0.199.0 fails during the go vendoring, necessary for building offline.

INFO:obs-service-go_modules:Using archive eksctl-0.199.0.obscpio
INFO:obs-service-go_modules:Extracting eksctl-0.199.0.obscpio to /tmp/tmpysmseaty
INFO:obs-service-go_modules:Switching to /tmp/tmpysmseaty
INFO:obs-service-go_modules:Detected basename eksctl-0.199.0 from archive
INFO:obs-service-go_modules:Using go.mod found at /tmp/tmpysmseaty/eksctl-0.199.0/go.mod
INFO:obs-service-go_modules:go mod download
INFO:obs-service-go_modules:go mod vendor
INFO:obs-service-go_modules:go mod verify
ERROR:obs-service-go_modules:goformation/v4 v4.0.0: missing ziphash: open hash: no such file or directory
ERROR:obs-service-go_modules:go mod verify failed

Vendoring manually in a git clone of the 0.199.0 tag shows the same error:

$ go mod verify
goformation/v4 v4.0.0: missing ziphash: open hash: no such file or directory
$

Could you please take a look?

Kind Regards,
Johannes

[github-actions]

Hello kastl-ars 👋 Thank you for opening an issue in eksctl project. The team will review the issue and aim to respond within 1-5 business days. Meanwhile, please read about the Contribution and Code of Conduct guidelines here. You can find out more information about eksctl on our website

[tendervittles]

This also breaks go mod verify for anything importing eksctl.

[tendervittles]

This broke on commit 84ac23d.

[kastl-ars]

Unfortunately still broken in 0.200.0. Could this be fixed please? Due to the way the vendoring is done, this cannot easily be done in the packaging.

[inesshz]

The change of goformation/v4 package is causing us issues with vendoring eksctl.

Can this be fixed or reverted ?

[tendervittles]

@kastl-ars the title of the bug is slightly off. The broken version is 0.199.0. That might be why no action has been taken.

Also, you should be able to package 0.198.0 until this is resolved.

[kastl-ars]

@kastl-ars the title of the bug is slightly off. The broken version is 0.199.0. That might be why no action has been taken.

Typo fixed, thanks. But as there is no such version and there never was a 1.x.y version of eksctl yet, I think everyone knows which version this is about.

Also, you should be able to package 0.198.0 until this is resolved.

As there are quite some golang-related security fixes going around, not having the latest version might in this case not be good enough...

[kastl-ars]

Still broken in 0.201.0:

INFO:obs-service-go_modules:go mod verify
ERROR:obs-service-go_modules:goformation/v4 v4.0.0: missing ziphash: open hash: no such file or directory
ERROR:obs-service-go_modules:go mod verify failed

[tendervittles]

@cheeseandcereal the local fork changes in 84ac23d break go mod verify.

This breaks reproducible builds for packagers.

[cheeseandcereal]

Sorry about that! Thanks for reporting; I just merged a fix, so this should be resolved now (on main branch) and with the next release.