Hi everyone,
go-vendor-tools 0.7.0 was released today. It will be pushed to rawhide and all stable Fedora branches. Please see https://fedora.gitlab.io/sigs/go/go-vendor-tools/news/#0.7.0 for full release notes.
In summary:
This is a pretty big release, consisting of several months of work. There are no major breaking changes to the CLI or RPM macro interfaces, but there are many improvements to the internal code. These changes may result in:
- Additional errors due to undetected licenses that need to be manually specified (affects packages using the trivy backend)
- Changes to the generated License expression due to `LICENSE.docs` files in dependencies no longer being included in license detection (mainly affects packages using the askalono backend)
You can fix these errors by running the following command which will prompt for any missing licenses and then update the License tag in the specfile if needed (using the new `--update-spec` flag).
```bash go_vendor_license --config go-vendor-tools.toml --path *.spec report --prompt --update-spec ```
---
I have submitted PRs for the packages affected by the change to the trivy backend, but the second change will need to be handled manually by package maintainers. As stated in the README, note that go-vendor-tools is under active development and available in stable Fedora releases for testing purposes. Anyone using the %go_vendor_* macros in active Fedora packages MUST join the Fedora Golang Matrix room and Fedora Go SIG mailing list to be notified of any major changes.
Discussion about wider adoption of go-vendor-tools and Guidelines updates is taking place in https://pagure.io/GoSIG/go-sig/issue/61.
Best, Maxwell