Unable to go get

[rumstead]

$ GO111MODULE="on" go get -u github.com/controlplaneio/kubesec/cmd/kubesec                                                              32s 12:38:24
go: found github.com/controlplaneio/kubesec/cmd/kubesec in github.com/controlplaneio/kubesec v2.2.0+incompatible
go: finding module for package github.com/spf13/cobra
go: finding module for package github.com/garethr/kubeval/kubeval
go: finding module for package go.uber.org/zap
go: finding module for package github.com/prometheus/client_golang/prometheus/promhttp
go: finding module for package github.com/ghodss/yaml
go: finding module for package github.com/thedevsaddam/gojsonq
go: finding module for package go.uber.org/zap/zapcore
go: finding module for package github.com/in-toto/in-toto-golang/in_toto
go: found github.com/garethr/kubeval/kubeval in github.com/garethr/kubeval v0.0.0-20200515185822-7721cbec724c
go: found github.com/spf13/cobra in github.com/spf13/cobra v1.0.0
go: found go.uber.org/zap in go.uber.org/zap v1.16.0
go: found go.uber.org/zap/zapcore in go.uber.org/zap v1.16.0
go: found github.com/ghodss/yaml in github.com/ghodss/yaml v1.0.0
go: found github.com/in-toto/in-toto-golang/in_toto in github.com/in-toto/in-toto-golang v0.0.0-20200909170033-41ca13528b69
go: found github.com/thedevsaddam/gojsonq in github.com/thedevsaddam/gojsonq v2.3.0+incompatible
go: found github.com/prometheus/client_golang/prometheus/promhttp in github.com/prometheus/client_golang v1.7.1
go: github.com/controlplaneio/kubesec/cmd/kubesec imports
        github.com/garethr/kubeval/kubeval: github.com/garethr/kubeval@v0.0.0-20200515185822-7721cbec724c: parsing go.mod:
        module declares its path as: github.com/instrumenta/kubeval
                but was required as: github.com/garethr/kubeval

Is this comment still valid? #57 (comment)

[06kellyjac]

So it's grabbing v2.2.0+incompatible, v2.2.0 was using dep

It looks like go get has a fit when a module called v2 doesn't keep things in a v2 directory...
https://blog.golang.org/v2-go-modules

However, if v2+ source code is on the repository's default branch (usually master), tools that are not version-aware — including the go command in GOPATH mode — may not distinguish between major versions.

[06kellyjac]

ok so GO111MODULE="on" go get -u github.com/controlplaneio/kubesec/v2/cmd/kubesec now builds from the correct tag

Now need to resolve the following error:

# github.com/controlplaneio/kubesec/v2/pkg/server
pkg/mod/github.com/controlplaneio/kubesec/v2@v2.7.0/pkg/server/server.go:145:16: undefined: in_toto.ParseEd25519FromPrivateJSON

[rumstead]

I ran into that when I tried to use GOPATH and deps instead of modules.

[06kellyjac]

go: downloading github.com/in-toto/in-toto-golang v0.0.0-20200909170033-41ca13528b69

So go get is just ignoring the go.mod & go.sum and grabbing the latest version of in-toto lib
I'm guessing this is because they're all v0.0.0

[06kellyjac]

Ok so for now GO111MODULE="on" go get github.com/controlplaneio/kubesec/v2/cmd/kubesec without -u will actually respect the version in the go.mod and go.sum files

[06kellyjac]

I've updated the README to reflect the new install method with go get