make precommit fails due to corrupted dependency github.com/golangci/golangci-lint v1.45.2

[bradtopol]

Description

Following the Contributing.md instructions I ran make precommit and ran into the following issue:

bradtopol@Brads-MBP opentelemetry-go % make precommit
cd ./internal/tools &&
go build -o /Users/bradtopol/telemetry/opentelemetry-go/.tools/dbotconf go.opentelemetry.io/build-tools/dbotconf
verifying github.com/blizzy78/varnamelen@v0.6.1/go.mod: checksum mismatch
downloaded: h1:mGBHm+Uo4e8JnZEKHRoZgVEOQdSBdQfY/x+k4NAXBWA=
go.sum: h1:zy2Eic4qWqjrxa60jG34cfL0VXcSwzUrIx68eJPb4Q8=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
make: *** [/Users/bradtopol/telemetry/opentelemetry-go/.tools/dbotconf] Error 1

Tracking this down,

It turns out github.com/blizzy78/varnamelen@v0.6.1/go.mod is corrupted.
See blizzy78/varnamelen#13 (comment)

And golangci-lint v1.45.2 depends on github.com/blizzy78/varnamelen@v0.6.1/go.mod

I noticed blizzy78 did merge a patch to fix this. And I found this dependency is located in
internal/tools/go.mod.

so I updated the requires for golangci-lint to be
github.com/golangci/golangci-lint d2ccc6d2bbbb78494617b9590e6d7f0a5881db9d

which after rerunning go mod tidy became
github.com/golangci/golangci-lint v1.45.3-0.20220330010013-d2ccc6d2bbbb

And then everything pretty much worked when I ran make precommit.

Except the linter found errors:
go mod tidy in ./trace
cd ./internal/tools &&
go build -o /Users/bradtopol/go/opentelemetry-go/.tools/golangci-lint github.com/golangci/golangci-lint/cmd/golangci-lint
golangci-lint --fix .
internal/global/benchmark_test.go:28:22: too many arguments in call to global.ResetForTest (typecheck)
global.ResetForTest(b)
^
internal/global/propagator_test.go:26:22: too many arguments in call to global.ResetForTest (typecheck)
global.ResetForTest(t)
^
internal/global/propagator_test.go:56:22: too many arguments in call to global.ResetForTest (typecheck)
global.ResetForTest(t)
^
trace_test.go:22:2: use of internal package go.opentelemetry.io/otel/internal/trace/noop not allowed (typecheck)
"go.opentelemetry.io/otel/internal/trace/noop"
^
internal/global/propagator_test.go:22:2: use of internal package go.opentelemetry.io/otel/internal/internaltest not allowed (typecheck)
"go.opentelemetry.io/otel/internal/internaltest"
^
make: *** [golangci-lint/.] Error 1

But in any case I think a good first step would be to update internal/tools/go.mod
to have the following requires to fix this.

github.com/golangci/golangci-lint v1.45.3-0.20220330010013-d2ccc6d2bbbb

Environment

• OS: iOS
• Architecture: darwin amd64
• Go Version: go1.17.6 darwin/amd64
• opentelemetry-go version: I was running off main

Steps To Reproduce

See above

[bradtopol]

/cc @MrAlias
Assuming you all verify this issue and approve of my approach to fix I'm happy to submit a PR to fix it

[hickeyma]

Replicated this when I pulled the latest from main and ran a make:

$ make

cross-linking all go modules
FILE PATH 

[...]

verifying github.com/blizzy78/varnamelen@v0.6.1/go.mod: checksum mismatch
	downloaded: h1:mGBHm+Uo4e8JnZEKHRoZgVEOQdSBdQfY/x+k4NAXBWA=
	go.sum:     h1:zy2Eic4qWqjrxa60jG34cfL0VXcSwzUrIx68eJPb4Q8=

SECURITY ERROR
This download does NOT match an earlier download recorded in go.sum.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.
make: *** [go-mod-tidy/./internal/tools] Error 1

[hickeyma]

Interested to know, why doesn't this fail in CI?

[Aneurysm9]

Interested to know, why doesn't this fail in CI?

CI includes caches of the Go mod cache. If the cache key hasn't changed since v0.6.1 was available then it will not have this issue.

[hickeyma]

CI includes caches of the Go mod cache. If the cache key hasn't changed since v0.6.1 was available then it will not have this issue.

Ah, thanks @Aneurysm9

[dmathieu]

With #2761 being merged, this should be closeable.