Installation fails due to a broken dependency in sigstore-go

[kpfleming]

Installation of v2 currently fails:

go: github.com/goreleaser/goreleaser/v2 imports
	github.com/goreleaser/goreleaser/v2/cmd imports
	github.com/goreleaser/goreleaser/v2/internal/pipeline imports
	github.com/goreleaser/goreleaser/v2/internal/pipe/ko imports
	github.com/google/ko/pkg/publish imports
	github.com/sigstore/cosign/v2/pkg/oci/remote imports
	github.com/sigstore/sigstore-go/pkg/bundle imports
	github.com/sigstore/sigstore-go/pkg/root imports
	github.com/sigstore/sigstore-go/pkg/tuf tested by
	github.com/sigstore/sigstore-go/pkg/tuf.test imports
	github.com/theupdateframework/go-tuf/v2/metadata/repository: module github.com/theupdateframework/go-tuf/v2@latest found (v2.1.0), but does not contain package github.com/theupdateframework/go-tuf/v2/metadata/repository

There's a PR in sigstore-go to fix this. The problem began when version 2.1.0 of go-tuf was published yesterday.

[caarlos0]

weird, CI on our end isnt failing... which command are you using to get this error?

[kpfleming]

We're running go mod tidy with github.com/goreleaser/goreleaser/v2 in the tools block of go.mod. It's not a big issue though, the fix in sigstore-go has already been applied and presumably they'll make a new release shortly.

[caarlos0]

well, goreleaser doesnt use that lib directly, so its coming as a dep of a dep into goreleaser.

from our go.sum:

github.com/theupdateframework/go-tuf v0.7.0 h1:CqbQFrWo1ae3/I0UCblSbczevCCbS31Qvs5LdxRWqRI=
github.com/theupdateframework/go-tuf v0.7.0/go.mod h1:uEB7WSY+7ZIugK6R1hiBMBjQftaFzn7ZCDJcp1tCUug=

that's comming from Ko:

❱ go mod why github.com/theupdateframework/go-tuf
# github.com/theupdateframework/go-tuf
github.com/goreleaser/goreleaser/v2/internal/pipe/ko
github.com/google/ko/pkg/build
github.com/sigstore/cosign/v2/pkg/oci
github.com/sigstore/cosign/v2/pkg/cosign/bundle
github.com/sigstore/rekor/pkg/tle
github.com/sigstore/rekor/pkg/types
github.com/sigstore/rekor/pkg/pki
github.com/sigstore/rekor/pkg/pki/tuf
github.com/sigstore/rekor/pkg/pki/tuf.test
github.com/theupdateframework/go-tuf

I guess some other tool you have is asking for a newer version? either way, prob will need to upgrade Ko -> cosign -> rekor 🤔

[kpfleming]

We're going to switch to using binary builds of goreleaser anyway, but thanks for looking into this.