Re: [ISSUE] [CLOSED] aws-vault: go build pulls old version of itself

[ericonr <ericonr@users.noreply.github.com>]

[-- Attachment #1: Type: text/plain, Size: 4873 bytes --]

Closed issue by vixus0 on void-packages repository

https://github.com/void-linux/void-packages/issues/27688

Description:
<!-- Don't request update of package. We have a script for that. https://alpha.de.repo.voidlinux.org/void-updates/void-updates.txt . However, a quality pull request may help. -->
### System

* xuname:  Void 5.9.16_1 x86_64 GenuineIntel notuptodate rFF
* package:  aws-vault-6.2.0_1

### Expected behavior

I coincidentally discovered this issue while trying some newer functionality available in recent versions of aws-vault.

Here's the correct output using a manual `go build .` from the archive downloaded into `hostddir/sources`:

```
❯ ./aws-vault --backend=file --debug login sso-dev
2021/01/05 15:00:54 aws-vault dev
2021/01/05 15:00:54 [keyring] Considering backends: [file]
2021/01/05 15:00:54 Loading config file $HOME/.aws/config
2021/01/05 15:00:54 Parsing config file $HOME/.aws/config
2021/01/05 15:00:54 [keyring] Expanded file dir to $HOME/.awsvault/keys/
2021/01/05 15:00:54 [keyring] Expanded file dir to $HOME/.awsvault/keys/
2021/01/05 15:00:54 [keyring] Expanded file dir to $HOME/.awsvault/keys/
2021/01/05 15:00:54 [keyring] Expanded file dir to $HOME/.awsvault/keys/
2021/01/05 15:00:54 [keyring] Expanded file dir to $HOME/.awsvault/keys/
2021/01/05 15:00:55 Created new OIDC client (expires at: 2021-04-05 16:00:54 +0200 CEST)
2021/01/05 15:00:55 Created OIDC device code for https://xxxx.awsapps.com/start (expires in: 600s)
2021/01/05 15:00:55 Opening SSO authorization page in browser
Opening the SSO authorization page in your default browser (use Ctrl-C to abort)
https://device.sso.eu-west-1.amazonaws.com/?user_code=XXXX
```

### Actual behavior

Incorrect output from the binary built by the package.

```
❯ /usr/bin/aws-vault --backend=file --debug login sso-dev
2021/01/05 15:04:39 [keyring] Considering backends: [file]
2021/01/05 15:04:39 Loading config file $HOME/.aws/config
2021/01/05 15:04:39 Parsing config file $HOME/.aws/config
2021/01/05 15:04:39 Skipping session token and using master credentials directly
2021/01/05 15:04:39 Looking up keyring for sso-dev
2021/01/05 15:04:39 [keyring] Expanded file dir to $HOME/.awsvault/keys/
2021/01/05 15:04:39 Error from keyring The specified item could not be found in the keyring
2021/01/05 15:04:39 Failed to find credentials for profile "sso-dev" in keyring
aws-vault: error: Failed to get credentials for sso-dev: The specified item could not be found in the keyring
```

### Steps to reproduce the behavior

It's sufficient to search for the string `Skipping session token` in the resulting aws-vault binary because it was removed from the source in 2019 but shows up in the latest void-packages build:

```sh
grep 'Skipping session token' /usr/bin/aws-vault
grep: /usr/bin/aws-vault: binary file matches # we don't want this
```

### Additional information

I tracked the issue down to the go modules that get populated during the `xbps-src` build.
The output of `go mod graph | grep 99designs/aws-vault` reveals an old v4.5.1 version of the module being pulled in.

```
github.com/99designs/aws-vault/v6 github.com/99designs/aws-vault@v4.5.1+incompatible
github.com/99designs/aws-vault/v6 github.com/99designs/keyring@v1.1.6
github.com/99designs/aws-vault/v6 github.com/alecthomas/kingpin@v0.0.0-20200323085623-b6657d9477a6
github.com/99designs/aws-vault/v6 github.com/alecthomas/template@v0.0.0-20190718012654-fb15b899a751
github.com/99designs/aws-vault/v6 github.com/alecthomas/units@v0.0.0-20190924025748-f65c72e2690d
github.com/99designs/aws-vault/v6 github.com/aws/aws-sdk-go@v1.34.13
github.com/99designs/aws-vault/v6 github.com/danieljoos/wincred@v1.1.0
github.com/99designs/aws-vault/v6 github.com/go-ini/ini@v1.62.0
github.com/99designs/aws-vault/v6 github.com/google/go-cmp@v0.5.2
github.com/99designs/aws-vault/v6 github.com/keybase/go-keychain@v0.0.0-20200502122510-cda31fe0c86d
github.com/99designs/aws-vault/v6 github.com/mitchellh/go-homedir@v1.1.0
github.com/99designs/aws-vault/v6 github.com/mtibben/androiddnsfix@v0.0.0-20200907095054-ff0280446354
github.com/99designs/aws-vault/v6 github.com/skratchdot/open-golang@v0.0.0-20200116055534-eef842397966
github.com/99designs/aws-vault/v6 github.com/smartystreets/goconvey@v1.6.4
github.com/99designs/aws-vault/v6 golang.org/x/crypto@v0.0.0-20200820211705-5c72a883971a
github.com/99designs/aws-vault/v6 golang.org/x/sys@v0.0.0-20200923182605-d9f96fdee20d
github.com/99designs/aws-vault/v6 gopkg.in/alecthomas/kingpin.v2@v2.2.6
github.com/99designs/aws-vault/v6 gopkg.in/ini.v1@v1.60.2
```

This doesn't appear when we just run `go build .` in the source directory, so there must be something in xbps-src's go build method that causes this. I'll do some more investigation and add anything I find here.