fail if the current Go version is newer than what built garble

For instance, Go 1.18 added support for generics, so its compiler output
files changed format to accomodate for the new language feature.
If garble is built with Go 1.17 and then used to perform builds on Go
1.18, it will fail in a very confusing way, because garble's go/types
and go/importer packages will not know how to deal with that.

As already discussed in #269, require the version that built the garble
binary to be equal or newer. In that thread we discussed only comparing
the major version, so for example garble built on go1.18 could be used
on the toolchain go1.18.5. However, that could still fail in confusing
ways if a fix to go/types or go/importer happened in a point release.

While here, I noticed that we were still using Go 1.17 for some CI
checks. Fix that, except for staticcheck.

Fixes #269.

.github/workflows/test.yml

@@ -40,12 +40,13 @@ jobs:
 
     # Static checks from this point forward. Only run on one Go version and on
     # Linux, since it's the fastest platform, and the tools behave the same.
-    - if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.17.x'
+    - if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.18.x'
       run: diff <(echo -n) <(gofmt -d .)
-    - if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.17.x'
+    - if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.18.x'
       run: go vet ./...
+    # TODO: bump to Go 1.18 once staticcheck supports it
     - if: matrix.os == 'ubuntu-latest' && matrix.go-version == '1.17.x'
-      uses: dominikh/staticcheck-action@v1.1.0
+      uses: dominikh/staticcheck-action@v1
       with:
         version: "2021.1.2"
         install-go: false
@@ -61,7 +62,7 @@ jobs:
     steps:
     - uses: actions/setup-go@v3
       with:
-        go-version: 1.17.x
+        go-version: 1.18.x
     - uses: actions/checkout@v3
     - name: Test
       run: go test -timeout=15m ./...

main.go

@@ -256,27 +256,52 @@ type errJustExit int
 
 func (e errJustExit) Error() string { return fmt.Sprintf("exit: %d", e) }
 
-var goVersionSemver string
+// toolchainVersionSemver is a semver-compatible version of the Go toolchain currently
+// being used, as reported by "go env GOVERSION".
+// Note that the version of Go that built the garble binary might be newer.
+var toolchainVersionSemver string
 
 func goVersionOK() bool {
 	const (
 		minGoVersionSemver = "v1.17.0"
 		suggestedGoVersion = "1.17.x"
 	)
 
-	rxVersion := regexp.MustCompile(`go\d+\.\d+(\.\d)?`)
-	version := rxVersion.FindString(cache.GoEnv.GOVERSION)
-	if version == "" {
+	// rxVersion looks for a version like "go1.2" or "go1.2.3"
+	rxVersion := regexp.MustCompile(`go\d+\.\d+(\.\d+)?`)
+
+	toolchainVersionFull := cache.GoEnv.GOVERSION
+	toolchainVersion := rxVersion.FindString(cache.GoEnv.GOVERSION)
+	if toolchainVersion == "" {
 		// Go 1.15.x and older do not have GOVERSION yet.
-		// We could go the extra mile and fetch it via 'go version',
+		// We could go the extra mile and fetch it via 'go toolchainVersion',
 		// but we'd have to error anyway.
 		fmt.Fprintf(os.Stderr, "Go version is too old; please upgrade to Go %s or a newer devel version\n", suggestedGoVersion)
 		return false
 	}
 
-	goVersionSemver = "v" + strings.TrimPrefix(version, "go")
-	if semver.Compare(goVersionSemver, minGoVersionSemver) < 0 {
-		fmt.Fprintf(os.Stderr, "Go version %q is too old; please upgrade to Go %s\n", version, suggestedGoVersion)
+	toolchainVersionSemver = "v" + strings.TrimPrefix(toolchainVersion, "go")
+	if semver.Compare(toolchainVersionSemver, minGoVersionSemver) < 0 {
+		fmt.Fprintf(os.Stderr, "Go version %q is too old; please upgrade to Go %s\n", toolchainVersionFull, suggestedGoVersion)
+		return false
+	}
+
+	// Ensure that the version of Go that built the garble binary is equal or
+	// newer than toolchainVersionSemver.
+	builtVersionFull := os.Getenv("GARBLE_TEST_GOVERSION")
+	if builtVersionFull == "" {
+		builtVersionFull = runtime.Version()
+	}
+	builtVersion := rxVersion.FindString(builtVersionFull)
+	if builtVersion == "" {
+		// If garble built itself, we don't know what Go version was used.
+		// Fall back to not performing the check against the toolchain version.
+		return true
+	}
+	builtVersionSemver := "v" + strings.TrimPrefix(builtVersion, "go")
+	if semver.Compare(builtVersionSemver, toolchainVersionSemver) < 0 {
+		fmt.Fprintf(os.Stderr, "garble was built with %q and is being used with %q; please rebuild garble with the newer version\n",
+			builtVersionFull, toolchainVersionFull)
 		return false
 	}
 
@@ -473,7 +498,7 @@ This command wraps "go %s". Below is its help:
 		command,
 		"-trimpath",
 	}
-	if semver.Compare(goVersionSemver, "v1.18.0") >= 0 {
+	if semver.Compare(toolchainVersionSemver, "v1.18.0") >= 0 {
 		// TODO: remove the conditional once we drop support for 1.17
 		goArgs = append(goArgs, "-buildvcs=false")
 	}

testdata/scripts/goversion.txt

@@ -5,39 +5,75 @@ go build -o .bin/go$exe ./fakego
 env PATH=${WORK}/.bin${:}${PATH}
 
 # An empty go version.
-env GOVERSION=''
+env TOOLCHAIN_GOVERSION=''
 ! garble build
-stderr 'Go version is too old; please upgrade to Go 1.17.x or a newer devel version'
+stderr 'Go version is too old; please upgrade to Go 1\.17\.x or a newer devel version'
 
 # We should error on a devel version that's too old.
 # Note that they lacked the "goN.M-" prefix.
-env GOVERSION='devel +afb5fca Sun Aug 07 00:00:00 2020 +0000'
+env TOOLCHAIN_GOVERSION='devel +afb5fca Sun Aug 07 00:00:00 2020 +0000'
 ! garble build
-stderr 'Go version is too old; please upgrade to Go 1.17.x or a newer devel version'
+stderr 'Go version is too old; please upgrade to Go 1\.17\.x or a newer devel version'
 
 # Another form of old version; with an old "goN.M-" prefix.
-env GOVERSION='devel go1.15-afb5fca Sun Aug 07 00:00:00 2020 +0000'
+env TOOLCHAIN_GOVERSION='devel go1.15-afb5fca Sun Aug 07 00:00:00 2020 +0000'
 ! garble build
-stderr 'Go version "go1.15" is too old; please upgrade to Go 1.17.x'
+stderr 'Go version "devel go1\.15-.*2020.*" is too old; please upgrade to Go 1\.17\.x'
 
-# A current devel version should be fine
-env GOVERSION='devel go1.18-ad97d204f0 Sun Sep 12 16:46:58 2021 +0000'
+# A current devel version should be fine.
+# Note that we don't look at devel version timestamps.
+env GARBLE_TEST_GOVERSION='go1.18'
+env TOOLCHAIN_GOVERSION='devel go1.18-ad97d204f0 Sun Sep 12 16:46:58 2021 +0000'
 ! garble build
 stderr 'mocking the real build'
 
 # We should error on a stable version that's too old.
-env GOVERSION='go1.14'
+env TOOLCHAIN_GOVERSION='go1.14'
 ! garble build
-stderr 'Go version "go1.14" is too old; please upgrade to Go 1.17.x'
+stderr 'Go version "go1\.14" is too old; please upgrade to Go 1\.17\.x'
 ! stderr 'or a newer devel version'
 
 # We should accept a future stable version.
-env GOVERSION='go1.18.2'
+# Note that we need to bump the version of Go that supposedly built it, too.
+env GARBLE_TEST_GOVERSION='go1.28.2'
+env TOOLCHAIN_GOVERSION='go1.28.2'
 ! garble build
 stderr 'mocking the real build'
 
 # We should accept custom devel strings.
-env GOVERSION='devel go1.18-somecustomversion'
+env TOOLCHAIN_GOVERSION='devel go1.18-somecustomversion'
+! garble build
+stderr 'mocking the real build'
+
+# The current toolchain may be older than the one that built garble.
+env GARBLE_TEST_GOVERSION='go1.18'
+env TOOLCHAIN_GOVERSION='go1.17.3'
+! garble build
+stderr 'mocking the real build'
+
+# The current toolchain may be equal to the one that built garble.
+env GARBLE_TEST_GOVERSION='devel go1.19-6673d5d701 Sun Mar 20 16:05:03 2022 +0000'
+env TOOLCHAIN_GOVERSION='devel go1.19-6673d5d701 Sun Mar 20 16:05:03 2022 +0000'
+! garble build
+stderr 'mocking the real build'
+
+# The current toolchain must not be newer than the one that built garble.
+env GARBLE_TEST_GOVERSION='go1.17'
+env TOOLCHAIN_GOVERSION='go1.18.1'
+! garble build
+stderr 'garble was built with "go1\.17" and is being used with "go1\.18\.1"; please rebuild garble with the newer version'
+
+# We'll error even if the difference is a minor (bugfix) level.
+# In practice it probably wouldn't matter, but in theory it could still lead to tricky bugs.
+env GARBLE_TEST_GOVERSION='go1.18.11'
+env TOOLCHAIN_GOVERSION='go1.18.14'
+! garble build
+stderr 'garble was built with "go1\.18\.11" and is being used with "go1\.18\.14"; please rebuild garble with the newer version'
+
+# If garble builds itself and is then used, it won't know what version built it.
+# As a fallback, we drop the comparison against the toolchain's version.
+env GARBLE_TEST_GOVERSION='bogus version'
+env TOOLCHAIN_GOVERSION='go1.17.3'
 ! garble build
 stderr 'mocking the real build'
 
@@ -64,7 +100,7 @@ func main() {
 		enc, _ := json.Marshal(struct{
 			GOVERSION string
 		} {
-			GOVERSION: os.Getenv("GOVERSION"),
+			GOVERSION: os.Getenv("TOOLCHAIN_GOVERSION"),
 		})
 		fmt.Printf("%s\n", enc)
 		return