Skip to content

Commit 6952eb4

Browse files
janduboisjandubois
committed
Stub out HCL dependencies
The latest version of yqlib depends on the hashicorp/hcl module, which in turn depends on apparentlymart/go-textseg. That one has a custom license and is therefore not approved for use by CNCF projects. yqlib already supports the `yq_nohcl` tag to build without HCL support. Unfortunately the go build system is not tag-aware and always includes all indirect dependencies in go.mod/go.sum. This commit stubs out the HCL dependencies, so they will not be fetched, and unconditionally adds the `yq_nohcl` build tag. Any downstream project will have to do the same, as the `replace` directives in go.mod only apply to this repo and are not inherited via the Go build system. Signed-off-by: Jan Dubois <[email protected]>
1 parent d210dc1 commit 6952eb4

File tree

14 files changed

+57
-23
lines changed

14 files changed

+57
-23
lines changed

‎.github/workflows/test.yml‎

Lines changed: 13 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -92,14 +92,19 @@ jobs:
9292
uses: golangci/golangci-lint-action@1e7e51e771db61008b38414a730f564565cf7c20 # v9.2.0
9393
with:
9494
version: ${{ steps.golangci-lint-version.outputs.GOLANGCI_LINT_VERSION }}
95-
args: --verbose
95+
args: --verbose --build-tags yq_nohcl
9696

9797
security:
9898
name: "Vulncheck"
9999
runs-on: ubuntu-24.04
100100
timeout-minutes: 5
101101
steps:
102-
- uses: golang/govulncheck-action@b625fbe08f3bccbe446d94fbf87fcc875a4f50ee # v1.0.4
102+
- uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
103+
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
104+
with:
105+
go-version: 1.25.x
106+
- name: Run govulncheck
107+
run: go tool -modfile=./hack/tools/go.mod govulncheck -tags yq_nohcl ./...
103108

104109
unit:
105110
name: "Unit tests"
@@ -120,7 +125,7 @@ jobs:
120125
with:
121126
go-version: ${{ matrix.go-version }}
122127
- name: Unit tests
123-
run: go test -v ./...
128+
run: go test -v -tags yq_nohcl ./...
124129
- name: Make
125130
run: make
126131
- name: Install
@@ -171,7 +176,7 @@ jobs:
171176
with:
172177
go-version: 1.25.x
173178
- name: Unit tests
174-
run: go test -v ./...
179+
run: go test -v -tags yq_nohcl ./...
175180
- name: Make
176181
run: make
177182
- name: Integration tests (WSL2, Windows host)
@@ -224,7 +229,7 @@ jobs:
224229
with:
225230
go-version: 1.25.x
226231
- name: Unit tests
227-
run: go test -v ./...
232+
run: go test -v -tags yq_nohcl ./...
228233
- name: Make
229234
run: make
230235
- name: "Inject `no_timer_check` to kernel cmdline"
@@ -458,7 +463,7 @@ jobs:
458463
limactl sudoers | sudo tee /etc/sudoers.d/lima
459464
- name: Unit test (pkg/networks) with socket_vmnet
460465
# Set -count=1 to disable cache
461-
run: go test -v -count=1 ./pkg/networks/...
466+
run: go test -v -tags yq_nohcl -count=1 ./pkg/networks/...
462467
- name: Test socket_vmnet
463468
uses: nick-fields/retry@ce71cc2ab81d554ebbe88c79ab5975992d79ba08 # v3.0.2
464469
with:
@@ -588,8 +593,8 @@ jobs:
588593
- uses: actions/setup-go@4dc6199c7b1a012772edbd06daecab0f50c9053c # v6.1.0
589594
with:
590595
go-version: 1.25.x
591-
- run: GOOS=netbsd go build ./...
592-
- run: GOOS=dragonfly go build ./...
596+
- run: GOOS=netbsd go build -tags yq_nohcl ./...
597+
- run: GOOS=dragonfly go build -tags yq_nohcl ./...
593598

594599
qemu-linux-old:
595600
name: "Smoke tests (QEMU, old Linux host)"

‎Makefile‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,8 @@ endif
3939
ADDITIONAL_DRIVERS ?= $(DEFAULT_ADDITIONAL_DRIVERS)
4040

4141
GO_BUILDTAGS ?=
42+
# HCL depends on modules with incompatible license
43+
GO_BUILDTAGS += yq_nohcl
4244
ifeq ($(GOOS),darwin)
4345
ifeq ($(shell test $(MACOS_SDK_VERSION) -lt 13; echo $$?),0)
4446
# The "vz" mode needs macOS 13 SDK or later

‎go.mod‎

Lines changed: 8 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,14 @@ module github.com/lima-vm/lima/v2
33

44
go 1.24.0
55

6+
// Avoid pulling in the real HCL module, which depends on github.com/apparentlymart/go-textseg/v15
7+
// which uses a nonstandard license and therefore cannot be used by CNCF projects.
8+
replace github.com/hashicorp/hcl/v2 => ./internal/hclstub
9+
10+
// go-cty is only used in files that are excluded when building with yq_nohcl.
11+
// It also depends on github.com/apparentlymart/go-textseg/v15.
12+
replace github.com/zclconf/go-cty => ./internal/ctystub
13+
614
require (
715
al.essio.dev/pkg/shellescape v1.6.0
816
github.com/AlecAivazis/survey/v2 v2.3.7
@@ -138,12 +146,9 @@ require (
138146
)
139147

140148
require (
141-
github.com/agext/levenshtein v1.2.1 // indirect
142-
github.com/apparentlymart/go-textseg/v15 v15.0.0 // indirect
143149
github.com/go-ini/ini v1.67.0 // indirect
144150
github.com/google/jsonschema-go v0.3.0 // indirect
145151
github.com/hashicorp/hcl/v2 v2.24.0 // indirect
146-
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
147152
github.com/pmezard/go-difflib v1.0.0 // indirect
148153
github.com/zclconf/go-cty v1.17.0 // indirect
149154
go.yaml.in/yaml/v2 v2.4.2 // indirect

‎go.sum‎

Lines changed: 0 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -14,8 +14,6 @@ github.com/VividCortex/ewma v1.2.0 h1:f58SaIzcDXrSy3kWaHNvuJgJ3Nmz59Zji6XoJR/q1o
1414
github.com/VividCortex/ewma v1.2.0/go.mod h1:nz4BbCtbLyFDeC9SUHbtcT5644juEuWfUAUnGx7j5l4=
1515
github.com/a8m/envsubst v1.4.3 h1:kDF7paGK8QACWYaQo6KtyYBozY2jhQrTuNNuUxQkhJY=
1616
github.com/a8m/envsubst v1.4.3/go.mod h1:4jjHWQlZoaXPoLQUb7H2qT4iLkZDdmEQiOUogdUmqVU=
17-
github.com/agext/levenshtein v1.2.1 h1:QmvMAjj2aEICytGiWzmxoE0x2KZvE0fvmqMOfy2tjT8=
18-
github.com/agext/levenshtein v1.2.1/go.mod h1:JEDfjyjHDjOF/1e4FlBE/PkbqA9OfWu2ki2W0IB5558=
1917
github.com/alecthomas/assert/v2 v2.11.0 h1:2Q9r3ki8+JYXvGsDyBXwH3LcJ+WK5D0gc5E8vS6K3D0=
2018
github.com/alecthomas/assert/v2 v2.11.0/go.mod h1:Bze95FyfUr7x34QZrjL+XP+0qgp/zg8yS+TtBj1WA3k=
2119
github.com/alecthomas/participle/v2 v2.1.4 h1:W/H79S8Sat/krZ3el6sQMvMaahJ+XcM9WSI2naI7w2U=
@@ -26,8 +24,6 @@ github.com/anchore/go-lzo v0.1.0 h1:NgAacnzqPeGH49Ky19QKLBZEuFRqtTG9cdaucc3Vncs=
2624
github.com/anchore/go-lzo v0.1.0/go.mod h1:3kLx0bve2oN1iDwgM1U5zGku1Tfbdb0No5qp1eL1fIk=
2725
github.com/apparentlymart/go-cidr v1.1.0 h1:2mAhrMoF+nhXqxTzSZMUzDHkLjmIHC+Zzn4tdgBZjnU=
2826
github.com/apparentlymart/go-cidr v1.1.0/go.mod h1:EBcsNrHc3zQeuaeCeCtQruQm+n9/YjEn/vI25Lg7Gwc=
29-
github.com/apparentlymart/go-textseg/v15 v15.0.0 h1:uYvfpb3DyLSCGWnctWKGj857c6ew1u1fNQOlOtuGxQY=
30-
github.com/apparentlymart/go-textseg/v15 v15.0.0/go.mod h1:K8XmNZdhEBkdlyDdvbmmsvpAG721bKi0joRfFdHIWJ4=
3127
github.com/bahlo/generic-list-go v0.2.0 h1:5sz/EEAK+ls5wF+NeqDpk5+iNdMDXrh3z3nPnH1Wvgk=
3228
github.com/bahlo/generic-list-go v0.2.0/go.mod h1:2KvAjgMlE5NNynlg/5iLrrCCZ2+5xWbdbCW3pNTGyYg=
3329
github.com/balajiv113/fd v0.0.0-20230330094840-143eec500f3e h1:IdMhFPEfTZQU971tIHx3UhY4l+yCeynprnINrDTSrOc=
@@ -133,8 +129,6 @@ github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
133129
github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
134130
github.com/google/yamlfmt v0.21.0 h1:9FKApQkDpMKgBjwLFytBHUCgqnQgxaQnci0uiESfbzs=
135131
github.com/google/yamlfmt v0.21.0/go.mod h1:q6FYExB+Ueu7jZDjKECJk+EaeDXJzJ6Ne0dxx69GWfI=
136-
github.com/hashicorp/hcl/v2 v2.24.0 h1:2QJdZ454DSsYGoaE6QheQZjtKZSUs9Nh2izTWiwQxvE=
137-
github.com/hashicorp/hcl/v2 v2.24.0/go.mod h1:oGoO1FIQYfn/AgyOhlg9qLC6/nOJPX3qGbkZpYAcqfM=
138132
github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
139133
github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
140134
github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
@@ -203,8 +197,6 @@ github.com/miekg/dns v1.1.70 h1:DZ4u2AV35VJxdD9Fo9fIWm119BsQL5cZU1cQ9s0LkqA=
203197
github.com/miekg/dns v1.1.70/go.mod h1:+EuEPhdHOsfk6Wk5TT2CzssZdqkmFhf8r+aVyDEToIs=
204198
github.com/mikefarah/yq/v4 v4.50.1 h1:u7pnei4FIv4HGL5ZBuNVDhDBe9et1YRFnoTmKZw6zOY=
205199
github.com/mikefarah/yq/v4 v4.50.1/go.mod h1:L4Z8NywrquZ+PVMz6IFFeGIp64eBC2mGC0nMryygCnI=
206-
github.com/mitchellh/go-wordwrap v1.0.1 h1:TLuKupo69TCn6TQSyGxwI1EblZZEsQ0vMlAFQflz0v0=
207-
github.com/mitchellh/go-wordwrap v1.0.1/go.mod h1:R62XHJLzvMFRBbcrT7m7WgmE1eOyTSsCt+hzestvNj0=
208200
github.com/mitchellh/mapstructure v1.5.0 h1:jeMsZIYE/09sWLaz43PL7Gy6RuMjD2eJVyuac5Z2hdY=
209201
github.com/mitchellh/mapstructure v1.5.0/go.mod h1:bFUtVrKA4DC2yAKiSyO/QUcy7e+RRV2QTWOzhPopBRo=
210202
github.com/modelcontextprotocol/go-sdk v1.1.0 h1:Qjayg53dnKC4UZ+792W21e4BpwEZBzwgRW6LrjLWSwA=
@@ -289,10 +281,6 @@ github.com/yuin/goldmark v1.3.5/go.mod h1:mwnBkeHKe2W/ZEtQ+71ViKU8L12m81fl3OWwC1
289281
github.com/yuin/goldmark v1.4.13/go.mod h1:6yULJ656Px+3vBD8DxQVa3kxgyrAnzto9xy5taEt/CY=
290282
github.com/yuin/gopher-lua v1.1.1 h1:kYKnWBjvbNP4XLT3+bPEwAXJx262OhaHDWDVOPjL46M=
291283
github.com/yuin/gopher-lua v1.1.1/go.mod h1:GBR0iDaNXjAgGg9zfCvksxSRnQx76gclCIb7kdAd1Pw=
292-
github.com/zclconf/go-cty v1.17.0 h1:seZvECve6XX4tmnvRzWtJNHdscMtYEx5R7bnnVyd/d0=
293-
github.com/zclconf/go-cty v1.17.0/go.mod h1:wqFzcImaLTI6A5HfsRwB0nj5n0MRZFwmey8YoFPPs3U=
294-
github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940 h1:4r45xpDWB6ZMSMNJFMOjqrGHynW3DIBuR2H9j0ug+Mo=
295-
github.com/zclconf/go-cty-debug v0.0.0-20240509010212-0d6042c53940/go.mod h1:CmBdvvj3nqzfzJ6nTCIwDTPZ56aVGvDrmztiO5g3qrM=
296284
go.opentelemetry.io/auto/sdk v1.2.1 h1:jXsnJ4Lmnqd11kwkBV2LgLoFMZKizbCi5fNZ/ipaZ64=
297285
go.opentelemetry.io/auto/sdk v1.2.1/go.mod h1:KRTj+aOaElaLi+wW1kO/DZRXwkF4C5xPbEe3ZiIhN7Y=
298286
go.opentelemetry.io/otel v1.38.0 h1:RkfdswUDRimDg0m2Az18RKOsnI8UDzppJAtj01/Ymk8=

‎hack/tools/go.mod‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -7,6 +7,7 @@ tool (
77
github.com/containerd/ltag
88
github.com/golangci/golangci-lint/v2/cmd/golangci-lint
99
github.com/yoheimuta/protolint/cmd/protolint
10+
golang.org/x/vuln/cmd/govulncheck
1011
google.golang.org/grpc/cmd/protoc-gen-go-grpc
1112
google.golang.org/protobuf/cmd/protoc-gen-go
1213
mvdan.cc/sh/v3/cmd/shfmt
@@ -227,9 +228,11 @@ require (
227228
golang.org/x/net v0.48.0 // indirect
228229
golang.org/x/sync v0.19.0 // indirect
229230
golang.org/x/sys v0.40.0 // indirect
231+
golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54 // indirect
230232
golang.org/x/term v0.38.0 // indirect
231233
golang.org/x/text v0.32.0 // indirect
232234
golang.org/x/tools v0.39.0 // indirect
235+
golang.org/x/vuln v1.1.4 // indirect
233236
google.golang.org/genproto/googleapis/rpc v0.0.0-20251029180050-ab9386a59fda // indirect
234237
google.golang.org/grpc/cmd/protoc-gen-go-grpc v1.5.1 // indirect
235238
gopkg.in/ini.v1 v1.67.0 // indirect

‎hack/tools/go.sum‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -292,6 +292,8 @@ github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e h1:gD6P7NEo7Eqt
292292
github.com/golangci/unconvert v0.0.0-20250410112200-a129a6e6413e/go.mod h1:h+wZwLjUTJnm/P2rwlbJdRPZXOzaT36/FwnPnY2inzc=
293293
github.com/google/btree v0.0.0-20180813153112-4030bb1f1f0c/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
294294
github.com/google/btree v1.0.0/go.mod h1:lNA+9X1NB3Zf8V7Ke586lFgjr2dZNuvo3lPJSGZ5JPQ=
295+
github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786 h1:rcv+Ippz6RAtvaGgKxc+8FQIpxHgsF+HBzPyYL2cyVU=
296+
github.com/google/go-cmdtest v0.4.1-0.20220921163831-55ab3332a786/go.mod h1:apVn/GCasLZUVpAJ6oWAuyP7Ne7CEsQbTnc0plM3m+o=
295297
github.com/google/go-cmp v0.2.0/go.mod h1:oXzfMopK8JAjlY9xF4vHSVASa0yLyX7SntLO5aqRK0M=
296298
github.com/google/go-cmp v0.3.0/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
297299
github.com/google/go-cmp v0.3.1/go.mod h1:8QqcDgzrUqlUb/G2PQTWiueGozuR1884gddMywk6iLU=
@@ -317,6 +319,7 @@ github.com/google/pprof v0.0.0-20200430221834-fc25d7d30c6d/go.mod h1:ZgVRPoUq/hf
317319
github.com/google/pprof v0.0.0-20200708004538-1a94d8640e99/go.mod h1:ZgVRPoUq/hfqzAqh7sHMqb3I9Rq5C59dIz2SbBwJ4eM=
318320
github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6 h1:EEHtgt9IwisQ2AZ4pIsMjahcegHh6rmhqxzIRQIyepY=
319321
github.com/google/pprof v0.0.0-20250820193118-f64d9cf942d6/go.mod h1:I6V7YzU0XDpsHqbsyrghnFZLO1gwK6NPTNvmetQIk9U=
322+
github.com/google/renameio v0.1.0 h1:GOZbcHa3HfsPKPlmyPyN2KEohoMXOhdMbHrvbpl2QaA=
320323
github.com/google/renameio v0.1.0/go.mod h1:KWCgfxg9yswjAJkECMjeO8J8rahYeXnNhOm40UhjYkI=
321324
github.com/google/renameio/v2 v2.0.0 h1:UifI23ZTGY8Tt29JbYFiuyIU3eX+RNFtUwefq9qAhxg=
322325
github.com/google/renameio/v2 v2.0.0/go.mod h1:BtmJXm5YlszgC+TD4HOEEUFgkJP3nLxehU6hfe7jRt4=
@@ -859,6 +862,8 @@ golang.org/x/sys v0.12.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
859862
golang.org/x/sys v0.13.0/go.mod h1:oPkhp1MJrh7nUepCBck5+mAzfO9JrbApNNgaTdGDITg=
860863
golang.org/x/sys v0.40.0 h1:DBZZqJ2Rkml6QMQsZywtnjnnGvHza6BTfYFWY9kjEWQ=
861864
golang.org/x/sys v0.40.0/go.mod h1:OgkHotnGiDImocRcuBABYBEXf8A9a87e/uXjp9XT3ks=
865+
golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54 h1:E2/AqCUMZGgd73TQkxUMcMla25GB9i/5HOdLr+uH7Vo=
866+
golang.org/x/telemetry v0.0.0-20251111182119-bc8e575c7b54/go.mod h1:hKdjCMrbv9skySur+Nek8Hd0uJ0GuxJIoIX2payrIdQ=
862867
golang.org/x/term v0.0.0-20201126162022-7de9c90e9dd1/go.mod h1:bj7SfCRtBDWHUb9snDiAeCFNEtKQo2Wmx5Cou7ajbmo=
863868
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211/go.mod h1:jbD1KX2456YbFQfuXm/mYQcufACuNUgVhRMnK/tPxf8=
864869
golang.org/x/term v0.5.0/go.mod h1:jMB1sMXY+tzblOD4FWmEbocvup2/aLOaQEp7JmGp78k=
@@ -938,6 +943,8 @@ golang.org/x/tools/go/expect v0.1.1-deprecated h1:jpBZDwmgPhXsKZC6WhL20P4b/wmnps
938943
golang.org/x/tools/go/expect v0.1.1-deprecated/go.mod h1:eihoPOH+FgIqa3FpoTwguz/bVUSGBlGQU67vpBeOrBY=
939944
golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated h1:1h2MnaIAIXISqTFKdENegdpAgUXz6NrPEsbIeWaBRvM=
940945
golang.org/x/tools/go/packages/packagestest v0.1.1-deprecated/go.mod h1:RVAQXBGNv1ib0J382/DPCRS/BPnsGebyM1Gj5VSDpG8=
946+
golang.org/x/vuln v1.1.4 h1:Ju8QsuyhX3Hk8ma3CesTbO8vfJD9EvUBgHvkxHBzj0I=
947+
golang.org/x/vuln v1.1.4/go.mod h1:F+45wmU18ym/ca5PLTPLsSzr2KppzswxPP603ldA67s=
941948
golang.org/x/xerrors v0.0.0-20190717185122-a985d3407aa7/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
942949
golang.org/x/xerrors v0.0.0-20191011141410-1b5146add898/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=
943950
golang.org/x/xerrors v0.0.0-20191204190536-9bdfabe68543/go.mod h1:I/5z698sn9Ka8TeJc9MKroUUfqBBauWjQqLJ2OPfmY0=

‎internal/ctystub/cty/doc.go‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
// Package cty is an empty stub used to satisfy module replacement.
2+
// It is never built when using the yq_nohcl tag.
3+
package cty

‎internal/ctystub/ctystrings/doc.go‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,2 @@
1+
// Package ctystrings is an empty stub used to satisfy module replacement.
2+
package ctystrings

‎internal/ctystub/go.mod‎

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
module github.com/zclconf/go-cty
2+
3+
go 1.22

‎internal/hclstub/doc.go‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,4 @@
1+
// Package hclstub is a stub replacement for github.com/hashicorp/hcl/v2.
2+
// It exists only to satisfy module resolution when building with tags
3+
// that exclude HCL-dependent code paths.
4+
package hclstub

0 commit comments

Comments
 (0)