chore: use go to bootstrap downloading and running task

.binny.yaml

@@ -2,26 +2,30 @@ tools:
  # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
  - name: binny
  version:
- want: v0.8.0
- method: github-release
+# want: v0.8.0
+ want: fix-freebsd
+ method: go-install
  with:
- repo: anchore/binny
+ module: github.com/anchore/binny
+ entrypoint: cmd/binny
 
  # used to produce SBOMs during release
  - name: syft
  version:
  want: latest
- method: github-release
+ method: go-install
  with:
- repo: anchore/syft
+ module: github.com/anchore/syft
+ entrypoint: cmd/syft
 
  # used to sign mac binaries at release
  - name: quill
  version:
  want: v0.4.1
- method: github-release
+ method: go-install
  with:
- repo: anchore/quill
+ module: github.com/anchore/quill
+ entrypoint: cmd/quill
 
  # used for linting
  - name: golangci-lint
@@ -43,41 +47,46 @@ tools:
  - name: cosign
  version:
  want: v2.2.4
- method: github-release
+ method: go-install
  with:
- repo: sigstore/cosign
+ module: github.com/sigstore/cosign/v2
+ entrypoint: cmd/cosign
 
  # used in integration tests to verify JSON schemas
  - name: yajsv
  version:
  want: v1.4.1
- method: github-release
+ method: go-install
  with:
- repo: neilpa/yajsv
+ module: github.com/neilpa/yajsv
+ entrypoint:
 
  # used to release all artifacts
  - name: goreleaser
  version:
  want: v2.0.1
- method: github-release
+ method: go-install
  with:
- repo: goreleaser/goreleaser
+ module: github.com/goreleaser/goreleaser/v2
+# entrypoint: cmd
 
  # used for organizing imports during static analysis
  - name: gosimports
  version:
  want: v0.3.8
- method: github-release
+ method: go-install
  with:
- repo: rinchsan/gosimports
+ module: github.com/rinchsan/gosimports
+ entrypoint: cmd/gosimports
 
  # used at release to generate the changelog
  - name: chronicle
  version:
  want: v0.8.0
- method: github-release
+ method: go-install
  with:
- repo: anchore/chronicle
+ module: github.com/anchore/chronicle
+ entrypoint: cmd/chronicle
 
  # used during static analysis for license compliance
  - name: bouncer
@@ -86,6 +95,10 @@ tools:
  method: github-release
  with:
  repo: wagoodman/go-bouncer
+# method: go-install
+# with:
+# module: github.com/wagoodman/go-bouncer
+# entrypoint:
 
  # used for showing benchmark testing
  - name: benchstat
@@ -112,6 +125,7 @@ tools:
  - name: gh
  version:
  want: v2.51.0
- method: github-release
+ method: go-install
  with:
- repo: cli/cli
+ module: github.com/cli/cli/v2
+ entrypoint: cmd/gh

Makefile

@@ -1,46 +1,17 @@
-OWNER = anchore
-PROJECT = syft
+.PHONY: *
 
-TOOL_DIR = .tool
-BINNY = $(TOOL_DIR)/binny
-TASK = $(TOOL_DIR)/task
+help:
+ @go run -C buildtools . -l
 
-.DEFAULT_GOAL := make-default
+bootstrap:
+ @go run -C buildtools . bootstrap
 
-## Bootstrapping targets #################################
+unit:
+ @go run -C buildtools . $@
 
-# note: we need to assume that binny and task have not already been installed
-$(BINNY):
- @mkdir -p $(TOOL_DIR)
- @curl -sSfL https://raw.githubusercontent.com/$(OWNER)/binny/main/install.sh | sh -s -- -b $(TOOL_DIR)
+# for some reason test does not work without an explicit target - the dir?
+test:
+ @go run -C buildtools . $@
 
-# note: we need to assume that binny and task have not already been installed
-.PHONY: task
-$(TASK) task: $(BINNY)
- @$(BINNY) install task -q
-
-.PHONY: ci-bootstrap-go
-ci-bootstrap-go:
- go mod download
-
-# this is a bootstrapping catch-all, where if the target doesn't exist, we'll ensure the tools are installed and then try again
 %:
- make $(TASK)
- $(TASK) $@
-
-## Shim targets #################################
-
-.PHONY: make-default
-make-default: $(TASK)
- @# run the default task in the taskfile
- @$(TASK)
-
-# for those of us that can't seem to kick the habit of typing `make ...` lets wrap the superior `task` tool
-TASKS := $(shell bash -c "test -f $(TASK) && $(TASK) -l | grep '^\* ' | cut -d' ' -f2 | tr -d ':' | tr '\n' ' '" ) $(shell bash -c "test -f $(TASK) && $(TASK) -l | grep 'aliases:' | cut -d ':' -f 3 | tr '\n' ' ' | tr -d ','")
-
-.PHONY: $(TASKS)
-$(TASKS): $(TASK)
- @$(TASK) $@
-
-help: $(TASK)
- @$(TASK) -l
+ @go run -C buildtools . $@

Taskfile.yaml

@@ -68,32 +68,32 @@ tasks:
 
  ## Bootstrap tasks #################################
 
- binny:
- internal: true
- # desc: Get the binny tool
- generates:
- - "{{ .TOOL_DIR }}/binny"
- status:
- - "test -f {{ .TOOL_DIR }}/binny"
- cmd: "curl -sSfL https://raw.githubusercontent.com/anchore/binny/main/install.sh | sh -s -- -b .tool"
- silent: true
+# binny:
+# internal: true
+# # desc: Get the binny tool
+# generates:
+# - "{{ .TOOL_DIR }}/binny"
+# status:
+# - "test -f {{ .TOOL_DIR }}/binny"
+# cmd: "curl -sSfL https://raw.githubusercontent.com/anchore/binny/main/install.sh | sh -s -- -b .tool"
+# silent: true
 
  tools:
  desc: Install all tools needed for CI and local development
- deps: [binny]
+# deps: [binny]
  aliases:
  - bootstrap
- generates:
- - ".binny.yaml"
- - "{{ .TOOL_DIR }}/*"
- status:
- - "{{ .TOOL_DIR }}/binny check -v"
- cmd: "{{ .TOOL_DIR }}/binny install -v"
+# generates:
+# - ".binny.yaml"
+# - "{{ .TOOL_DIR }}/*"
+# status:
+# - "{{ .TOOL_DIR }}/binny check -v"
+# cmd: "{{ .TOOL_DIR }}/binny install -v"
  silent: true
 
  update-tools:
  desc: Update pinned versions of all tools to their latest available versions
- deps: [binny]
+# deps: [binny]
  generates:
  - ".binny.yaml"
  - "{{ .TOOL_DIR }}/*"
@@ -102,13 +102,13 @@ tasks:
 
  list-tools:
  desc: List all tools needed for CI and local development
- deps: [binny]
+# deps: [binny]
  cmd: "{{ .TOOL_DIR }}/binny list"
  silent: true
 
  list-tool-updates:
  desc: List all tools that are not up to date relative to the binny config
- deps: [binny]
+# deps: [binny]
  cmd: "{{ .TOOL_DIR }}/binny list --updates"
  silent: true
 
@@ -118,19 +118,22 @@ tasks:
  - "{{ .TMP_DIR }}"
  cmd: "mkdir -p {{ .TMP_DIR }}"
 
+ ci-bootstrap-go:
+ cmd: "go mod download"
+
  ## Static analysis tasks #################################
 
  format:
  desc: Auto-format all source code
- deps: [tools]
+# deps: [tools]
  cmds:
  - gofmt -w -s .
  - "{{ .TOOL_DIR }}/gosimports -local github.com/anchore -w ."
  - go mod tidy
 
  lint-fix:
  desc: Auto-format all source code + run golangci lint fixers
- deps: [tools]
+# deps: [tools]
  cmds:
  - task: format
  - "{{ .TOOL_DIR }}/golangci-lint run --tests=false --fix"
@@ -142,7 +145,7 @@ tasks:
  sh: gofmt -l -s .
  BAD_FILE_NAMES:
  sh: "find . | grep -e ':' || true"
- deps: [tools]
+# deps: [tools]
  cmds:
  # ensure there are no go fmt differences
  - cmd: 'test -z "{{ .BAD_FMT_FILES }}" || (echo "files with gofmt issues: [{{ .BAD_FMT_FILES }}]"; exit 1)'
@@ -156,7 +159,7 @@ tasks:
 
  check-licenses:
  # desc: Ensure transitive dependencies are compliant with the current license policy
- deps: [tools]
+# deps: [tools]
  cmd: "{{ .TOOL_DIR }}/bouncer check ./..."
 
  check-go-mod-tidy:
@@ -211,7 +214,7 @@ tasks:
  # note: we don't want to regenerate the snapshot unless we have to. In CI it's probable
  # that the cache being restored with the correct binary will be rebuilt since the timestamps
  # and local checksums will not line up.
- deps: [tools, snapshot]
+ deps: [snapshot]
  sources:
  - "{{ .SNAPSHOT_BIN }}"
  - ./test/cli/**
@@ -399,7 +402,7 @@ tasks:
 
  build:
  desc: Build the project
- deps: [tools, tmpdir]
+ deps: [tmpdir]
  generates:
  - "{{ .PROJECT }}"
  cmds:
@@ -414,7 +417,7 @@ tasks:
  desc: Create a snapshot release
  aliases:
  - build
- deps: [tools, tmpdir]
+ deps: [tmpdir]
  sources:
  - cmd/**/*.go
  - syft/**/*.go
@@ -432,7 +435,7 @@ tasks:
 
  changelog:
  desc: Generate a changelog
- deps: [tools]
+# deps: [tools]
  generates:
  - "{{ .CHANGELOG }}"
  - "{{ .NEXT_VERSION }}"
@@ -446,7 +449,7 @@ tasks:
  release:
  desc: Create a release
  interactive: true
- deps: [tools]
+# deps: [tools]
  cmds:
  - cmd: .github/scripts/trigger-release.sh
  silent: true
@@ -462,7 +465,7 @@ tasks:
 
  ci-release:
  # desc: "[CI only] Create a release"
- deps: [tools]
+# deps: [tools]
  cmds:
  - task: ci-check
  - "{{ .TOOL_DIR }}/chronicle -vvv > CHANGELOG.md"
@@ -472,7 +475,7 @@ tasks:
 
  ci-release-version-file:
  # desc: "[CI only] Update the version file"
- deps: [tools]
+# deps: [tools]
  cmds:
  - task: ci-check
  - ".github/scripts/update-version-file.sh {{ .RELEASE_VERSION }}"

buildtools/go.mod

@@ -0,0 +1,11 @@
+module github.com/anchore/syft/buildtools
+
+go 1.22.0
+
+require github.com/kzantow/go-build v0.0.0-20240621190357-037e1844f43f
+
+require (
+ github.com/kr/text v0.2.0 // indirect
+ golang.org/x/mod v0.14.0 // indirect
+ gopkg.in/yaml.v3 v3.0.1 // indirect
+)

buildtools/go.sum

@@ -0,0 +1,16 @@
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kzantow/go-build v0.0.0-20240621190357-037e1844f43f h1:BTLfdsCjHKo58S3ULdG0pn2VLHjlYrWUvzwypjwNp+g=
+github.com/kzantow/go-build v0.0.0-20240621190357-037e1844f43f/go.mod h1:A2nQV6Y2eb8juxo8yN+tZ+YxJ8hDtQzKSScBvJC8zXk=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

buildtools/main.go

@@ -0,0 +1,9 @@
+package main
+
+import (
+ "github.com/kzantow/go-build"
+)
+
+func main() {
+ build.RunTools()
+}