First time packaging a Go application: docker-credential-helpers

[Tadej Janež]

Hey Go packagers,

this is my first time trying to package a Go application, namely the
docker-credential-helpers:
https://github.com/docker/docker-credential-helpers

I used go2rpm with '--profile vendor' to generate the initial SPEC file
and then augmented it.

Here is my current work-in-progress:
https://github.com/tjanez/docker-credential-helpers-package
And the Koji scratch build:
https://koji.fedoraproject.org/koji/taskinfo?taskID=147794860

The upstream project basically consists of 4 helpers:
- pass
- secretservice
- osxkeychain
- wincred

The first 2 are applicable to Fedora and I've created 2 corresponding
subpackages for them.

The last 2 are OS X/macOS and Windows specific so they don't make sense
in a Fedora package.

The go.mod file only requires dependent modules for those 2:
```
require (
    github.com/danieljoos/wincred v1.2.3
    github.com/keybase/go-keychain v0.0.1
)

require golang.org/x/sys v0.20.0 // indirect
```

I think it would be better to just remove the 2 required modules and
the indirect dependency from the vendor tarball since they are not
needed on Fedora?

Is it possible to configure the go2rpm vendoring tools to exclude
certain dependencies?

Regards,
Tadej

[Mikel Olasagasti]

Hi Tadej,

Can you try to add this section to your go-vendor-tools.toml file and
try to recreate the vendor either using go2rpm again or
"go_vendor_archive create --config go-vendor-tools.toml foo.spec" ?

[archive]
pre_commands = [
    ["rm", "-r", "osxkeychain/"],
    ["rm", "-r", "wincred/"],
    ["rm", "-r", "vendor/"],
    ["go", "mod", "tidy"],
]

Best regards,
Mikel

Hau idatzi du Tadej Janež via golang ([e-mail])
erabiltzaileak (2026 uzt. 14(a), ar. (14:09)):
> Hey Go packagers,
>
> this is my first time trying to package a Go application, namely the
> docker-credential-helpers:
> https://github.com/docker/docker-credential-helpers
>
> I used go2rpm with '--profile vendor' to generate the initial SPEC file
> and then augmented it.
>
> Here is my current work-in-progress:
> https://github.com/tjanez/docker-credential-helpers-package
> And the Koji scratch build:
> https://koji.fedoraproject.org/koji/taskinfo?taskID=147794860
>
> The upstream project basically consists of 4 helpers:
> pass
> secretservice
> osxkeychain
> wincred
>
> The first 2 are applicable to Fedora and I've created 2 corresponding
> subpackages for them.
>
> The last 2 are OS X/macOS and Windows specific so they don't make sense
> in a Fedora package.
>
> The go.mod file only requires dependent modules for those 2:
> require (
>         github.com/danieljoos/wincred v1.2.3
>         github.com/keybase/go-keychain v0.0.1
> )
>
> require golang.org/x/sys v0.20.0 // indirect
>
> I think it would be better to just remove the 2 required modules and
> the indirect dependency from the vendor tarball since they are not
> needed on Fedora?
>
> Is it possible to configure the go2rpm vendoring tools to exclude
> certain dependencies?
>
> Regards,
> Tadej
>
> --
> _______________________________________________
> golang mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it: https://forge.fedoraproject.org/infra/tickets/issues/new

[Tadej Janež]

Hi Mikel,

thanks for the pointer on how to exclude things from the vendor
archive.

It turns out 'go mod tidy' is already run at the end by default, so I
ended up with:

```
[archive]
pre_commands = [
    ["rm", "-r", "osxkeychain/"],
    ["rm", "-r", "wincred/"],
    ["rm", "-r", "vendor/"],
]

[licensing]
exclude_directories = [
    "osxkeychain/",
    "wincred/",
    "vendor/",
]
detector = "askalono"
```

For this concrete package, the vendor archive is pretty much empty now.
So, I have some follow up questions:

1. Does it still make sense to keep all things as-is in the SPEC file?
   Namely, there are various macros throughout the SPEC file
   that operate on Source2...

2. rpmlint now give the error:
   docker-credential-pass.x86_64: E: zero-length
/usr/share/licenses/docker-credential-helpers/vendor/modules.txt
   This is because the modules.txt is correctly empty since there are
no vendored modules (at the moment).

Thanks and best regards,
Tadej

On Tue, 2026-07-14 at 19:54 +0200, Mikel Olasagasti via golang wrote:
> Hi Tadej,
>
> Can you try to add this section to your go-vendor-tools.toml file and
> try to recreate the vendor either using go2rpm again or
> "go_vendor_archive create --config go-vendor-tools.toml foo.spec" ?
>
> [archive]
> pre_commands = [
>     ["rm", "-r", "osxkeychain/"],
>     ["rm", "-r", "wincred/"],
>     ["rm", "-r", "vendor/"],
>     ["go", "mod", "tidy"],
> ]
>
> Best regards,
> Mikel
>
> Hau idatzi du Tadej Janež via golang ([e-mail])
> erabiltzaileak (2026 uzt. 14(a), ar. (14:09)):
> > Hey Go packagers,
> >
> > this is my first time trying to package a Go application, namely
> > the
> > docker-credential-helpers:
> > https://github.com/docker/docker-credential-helpers
> >
> > I used go2rpm with '--profile vendor' to generate the initial SPEC
> > file
> > and then augmented it.
> >
> > Here is my current work-in-progress:
> > https://github.com/tjanez/docker-credential-helpers-package
> > And the Koji scratch build:
> > https://koji.fedoraproject.org/koji/taskinfo?taskID=147794860
> >
> > The upstream project basically consists of 4 helpers:
> > pass
> > secretservice
> > osxkeychain
> > wincred
> >
> > The first 2 are applicable to Fedora and I've created 2
> > corresponding
> > subpackages for them.
> >
> > The last 2 are OS X/macOS and Windows specific so they don't make
> > sense
> > in a Fedora package.
> >
> > The go.mod file only requires dependent modules for those 2:
> > require (
> >         github.com/danieljoos/wincred v1.2.3
> >         github.com/keybase/go-keychain v0.0.1
> > )
> >
> > require golang.org/x/sys v0.20.0 // indirect
> >
> > I think it would be better to just remove the 2 required modules
> > and
> > the indirect dependency from the vendor tarball since they are not
> > needed on Fedora?
> >
> > Is it possible to configure the go2rpm vendoring tools to exclude
> > certain dependencies?
> >
> > Regards,
> > Tadej
> >
> > --
> > _______________________________________________
> > golang mailing list -- [e-mail]
> > To unsubscribe send an email to
> > [e-mail]
> > Fedora Code of Conduct:
> > https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> > List Guidelines:
> > https://fedoraproject.org/wiki/Mailing_list_guidelines
> > List Archives:
> > https://lists.fedoraproject.org/archives/list/[e-mail]
> > Do not reply to spam, report it:
> > https://forge.fedoraproject.org/infra/tickets/issues/new

[Mikel Olasagasti]

Hi Tadej,

Hau idatzi du Tadej Janež ([e-mail]) erabiltzaileak (2026 uzt.
15(a), az. (12:16)):
> For this concrete package, the vendor archive is pretty much empty now.
> So, I have some follow up questions:
> Does it still make sense to keep all things as-is in the SPEC file?
> Namely, there are various macros throughout the SPEC file
> that operate on Source2...

Yes, that way if in the future a dependency is added the spec doesn't
need to be changed. Also brings consistency with all other Go specs.
> rpmlint now give the error:
> docker-credential-pass.x86_64: E: zero-length
>
> /usr/share/licenses/docker-credential-helpers/vendor/modules.txt
>    This is because the modules.txt is correctly empty since there are
> no vendored modules (at the moment).

Not a blocker.

Best regards,
Mikel

[Tadej Janež]

Hi Mikel,

thanks for clarifying things regarding the (currently) empty vendored
modules.

I have two more things I would like to clarify before submitting the
package for review:

1. The docker-helper-secretservice uses cgo. Do I need to set something
like:
export CGO_CFLAGS="%{build_cflags}" CGO_LDFLAGS="%{build_ldflags}"
before calling %gobuild?

Currently, the build step for secretservice helper expands to:

+ GOPATH=/builddir/build/BUILD/docker-credential-helpers-0.9.8-
build/docker-credential-helpers-0.9.8/_build:/usr/share/gocode
+ GO111MODULE=on
+ go build -buildmode pie -compiler gc '-tags=rpm_crashtraceback ' -a -
v -ldflags ' -X github.com/docker/docker-credential-
helpers/version=0.9.8 -B 0xaa0903ba5ba82d3948afd9f468f83cde5e72068c -
compressdwarf=false -linkmode=external -extldflags '''-Wl,-z,relro -
Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -
specs=/usr/lib/rpm/redhat/redhat-hardened-ld -
specs=/usr/lib/rpm/redhat/redhat-hardened-ld-errors -
specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -
specs=/usr/lib/rpm/redhat/redhat-package-notes   '''' -o
/builddir/build/BUILD/docker-credential-helpers-0.9.8-build/docker-
credential-helpers-0.9.8/_build/bin/docker-credential-secretservice
github.com/docker/docker-credential-helpers/secretservice/cmd

2. As seen in the snippet above, -ldflags get set, but it appears
different from what upstream has in the Makefile:
https://github.com/docker/docker-credential-helpers/blob/main/Makefile#L6

And when they call 'go build', they also set an additional flag:
-X ${GO_PKG}/credentials.Name=docker-credential-$*
(see
https://github.com/docker/docker-credential-helpers/blob/main/Makefile#L42
)

How should I correctly set the LDFLAGS?

The current work-in-progress SPEC file is here:
https://github.com/tjanez/docker-credential-helpers-package/blob/master/dock...

Regards,
Tadej

On Mon, 2026-07-20 at 09:59 +0200, Mikel Olasagasti via golang wrote:
> Hi Tadej,
>
> Hau idatzi du Tadej Janež ([e-mail]) erabiltzaileak (2026 uzt.
> 15(a), az. (12:16)):
> > For this concrete package, the vendor archive is pretty much empty
> > now.
> > So, I have some follow up questions:
> > Does it still make sense to keep all things as-is in the SPEC
> >
> > file?
> >    Namely, there are various macros throughout the SPEC file
> >    that operate on Source2...
>
> Yes, that way if in the future a dependency is added the spec doesn't
> need to be changed. Also brings consistency with all other Go specs.
> > rpmlint now give the error:
> >
> > docker-credential-pass.x86_64: E: zero-length
> > /usr/share/licenses/docker-credential-helpers/vendor/modules.txt
> >    This is because the modules.txt is correctly empty since there
> > are
> > no vendored modules (at the moment).
>
> Not a blocker.
>
> Best regards,
> Mikel

[Brad Smith]

Mikel -

I often find that I need to look at the macro files in /usr/lib/rpm to find
helpful information about how a given macro is configured.

The moby-engine spec file (
https://src.fedoraproject.org/rpms/moby-engine/blob/rawhide/f/moby-engine.sp...)
sets the CCO_CFLAGS and CGO_LDFLAGS as you suggest above.

One possibility for GO_LDFLAGS might be:

global specgoldflags -s -w -X %{goipath}/credentials.Version=%{version} -X
%{goipath}/credentials.Revision=%{release} -X
%{goipath}/credentials.Package=%{goipath}
for helper in pass secretservice; do
    export GO_LDFLAGS="%{specgoldflags} -X
%{goipath}/credentials.Name=docker-credentials-${helper}"
    %gobuild -o %{gobuilddir}/bin/docker-credential-${helper}
%{goipath}/${helper}/cmd
done

I have not checked if the -s and -w flags make sense in a fedora build
environment.

Thanks for adding this to the docker portfolio in Fedora.

best regards

Brad

On Tue, Jul 21, 2026 at 6:04 AM Tadej Janež via golang <
[e-mail]> wrote:
> Hi Mikel,
>
> thanks for clarifying things regarding the (currently) empty vendored
> modules.
>
> I have two more things I would like to clarify before submitting the
> package for review:
> The docker-helper-secretservice uses cgo. Do I need to set something
>
> like:
> export CGO_CFLAGS="%{build_cflags}" CGO_LDFLAGS="%{build_ldflags}"
> before calling %gobuild?
>
> Currently, the build step for secretservice helper expands to:
> GOPATH=/builddir/build/BUILD/docker-credential-helpers-0.9.8-
>
> build/docker-credential-helpers-0.9.8/_build:/usr/share/gocode
> GO111MODULE=on
> go build -buildmode pie -compiler gc '-tags=rpm_crashtraceback ' -a -
>
> v -ldflags ' -X github.com/docker/docker-credential-
> helpers/version=0.9.8 -B 0xaa0903ba5ba82d3948afd9f468f83cde5e72068c -
> compressdwarf=false -linkmode=external -extldflags '''-Wl,-z,relro -
> Wl,--as-needed  -Wl,-z,pack-relative-relocs -Wl,-z,now -
> specs=/usr/lib/rpm/redhat/redhat-hardened-ld -
> specs=/usr/lib/rpm/redhat/redhat-hardened-ld-errors -
> specs=/usr/lib/rpm/redhat/redhat-annobin-cc1  -Wl,--build-id=sha1 -
> specs=/usr/lib/rpm/redhat/redhat-package-notes   '''' -o
> /builddir/build/BUILD/docker-credential-helpers-0.9.8-build/docker-
> credential-helpers-0.9.8/_build/bin/docker-credential-secretservice
> github.com/docker/docker-credential-helpers/secretservice/cmd
> As seen in the snippet above, -ldflags get set, but it appears
>
> different from what upstream has in the Makefile:
> https://github.com/docker/docker-credential-helpers/blob/main/Makefile#L6
>
> And when they call 'go build', they also set an additional flag:
> -X ${GO_PKG}/credentials.Name=docker-credential-$*
> (see
> https://github.com/docker/docker-credential-helpers/blob/main/Makefile#L42
> )
>
> How should I correctly set the LDFLAGS?
>
> The current work-in-progress SPEC file is here:
>
> https://github.com/tjanez/docker-credential-helpers-package/blob/master/dock...
>
> Regards,
> Tadej
>
> On Mon, 2026-07-20 at 09:59 +0200, Mikel Olasagasti via golang wrote:
> > Hi Tadej,
> >
> > Hau idatzi du Tadej Janež ([e-mail]) erabiltzaileak (2026 uzt.
> > 15(a), az. (12:16)):
> > > For this concrete package, the vendor archive is pretty much empty
> > > now.
> > > So, I have some follow up questions:
> > > Does it still make sense to keep all things as-is in the SPEC
> > >
> > > file?
> > >    Namely, there are various macros throughout the SPEC file
> > >    that operate on Source2...
> >
> > Yes, that way if in the future a dependency is added the spec doesn't
> > need to be changed. Also brings consistency with all other Go specs.
> > > rpmlint now give the error:
> > > docker-credential-pass.x86_64: E: zero-length
> > >
> > > /usr/share/licenses/docker-credential-helpers/vendor/modules.txt
> > >    This is because the modules.txt is correctly empty since there
> > > are
> > > no vendored modules (at the moment).
> >
> > Not a blocker.
> >
> > Best regards,
> > Mikel
>
> --
> _______________________________________________
> golang mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct:
> https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
> Do not reply to spam, report it:
> https://forge.fedoraproject.org/infra/tickets/issues/new