Run tests using Go 1.18

[imjasonh]

Summary

Go 1.19 will be out next month, which means Go 1.17 will be out of support.

Signed-off-by: Jason Hall jason@chainguard.dev

Release Note

NONE

Documentation

NONE

[imjasonh]

This hits #2091 😢

[cpanato]

this is something we can enable only for the tests or does that affects the binary when users use this feature?

[imjasonh]

this is something we can enable only for the tests or does that affects the binary when users use this feature?

I think we could GODEBUG=x509sha1=1 for tests, and rely on e2e tests to tell us whether this causes any issues in the actual CLI usage.

Just building cosign from HEAD with Go 1.18 and testing locally, I'm able to COSIGN_EXPERIMENTAL=1 cosign sign && cosign verify an image, so at least that much seems to work.

[asraa]

quick ping on this if possible? it's blocking upgrading rekor so we can handle some incompatible rekor changes that prevent blob verification #2058

[imjasonh]

My understanding is we can either update our usage of the deprecated SHA-1 cert (#2091 (comment)) or temporarily set the env var to ignore it during tests.

If you're blocked I'd say set the env var in tests and upgrade to Go 1.18+ to get unblocked.

[dlorenc]

Added the suppression, this can unblock a few pending PRs.

[codecov-commenter]

Codecov Report

Merging #2093 (641d445) into main (95b74db) will decrease coverage by 0.10%.
The diff coverage is n/a.

@@            Coverage Diff             @@
##             main    #2093      +/-   ##
==========================================
- Coverage   26.33%   26.23%   -0.11%     
==========================================
  Files         129      130       +1     
  Lines        7564     7617      +53     
==========================================
+ Hits         1992     1998       +6     
- Misses       5317     5362      +45     
- Partials      255      257       +2     

Impacted Files	Coverage Δ
pkg/oci/static/file.go	64.70% <0.00%> (-5.30%)	⬇️
pkg/oci/mutate/signatures.go	33.33% <0.00%> (-0.67%)	⬇️
pkg/policy/eval.go	78.94% <0.00%> (-0.54%)	⬇️
pkg/cosign/rego/rego.go	70.96% <0.00%> (-0.47%)	⬇️
cmd/cosign/cli/verify/verify_blob.go	9.72% <0.00%> (-0.16%)	⬇️
cmd/cosign/cli/sign/sign.go	14.57% <0.00%> (-0.13%)	⬇️
pkg/cosign/tlog.go	30.07% <0.00%> (ø)
pkg/cosign/fetch.go	0.00% <0.00%> (ø)
cmd/cosign/cli/sign.go	0.00% <0.00%> (ø)
cmd/cosign/cli/attach.go	0.00% <0.00%> (ø)
... and 5 more

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.