Annotate go mod replace statements

[shoenig]

In the nomad go.mod file we have a set of replace directives to pin certain dependencies to an older version. For example, NYTimes/gziphandler made a breaking change where existing zipped data can not be unzipped with newer versions. We should link to an issue documenting why each dependency is stuck, and maybe look into whether any of them can be updated now.

github.com/Microsoft/go-winio

We depend on a fork #5864 with changes not in upstream

github.com/hashicorp/hcl

Nomad still supports HCL v1, but the hcl repository has switched to v2 in the go.mod file

github.com/armon/go-metrics

Our branch contains additional logs and defensive code to workaround a panic described in #15861

[apollo13]

@shoenig Regarding go-discover. Which dependency here uses replace? I grepped through but couldn't find any. The only thing that failed when removing the replace was consul via:

go: github.com/hashicorp/consul@v1.7.8 requires
	github.com/hashicorp/go-discover@v0.0.0-20191202160150-7ec2cfbda7a2 requires
	github.com/tencentcloud/tencentcloud-sdk-go@v3.0.83+incompatible: reading github.com/tencentcloud/tencentcloud-sdk-go/go.mod at revision v3.0.83: unknown revision v3.0.83

This should be solvable by updating consul to a newer library instead though.

[shoenig]

I think you're right @apollo13, unfortunately updating consul isn't going to be straightforward since they split out autopilot to https://github.com/hashicorp/raft-autopilot

➜ go mod tidy
go: finding module for package github.com/hashicorp/consul/agent/consul/autopilot
github.com/hashicorp/nomad/command/agent imports
	github.com/hashicorp/consul/agent/consul/autopilot: module github.com/hashicorp/consul@latest found (v1.11.2), but does not contain package github.com/hashicorp/consul/agent/consul/autopilot

I suspect raft-autopilot only works with raft v3, and Nomad would have to drop support for raft v2 first.

[lgfa29]

go-metrics cannot be upgraded to hashicorp/go-metrics until all dependencies that use armon/go-metrics are also updated (ref #19369).

This is the current list of dependencies using it:

$ go mod graph | grep ' github.com/armon/go-metrics'
github.com/hashicorp/nomad github.com/armon/go-metrics@v0.4.1
github.com/hashicorp/consul-template@v0.35.0 github.com/armon/go-metrics@v0.4.1
github.com/hashicorp/consul/api@v1.26.1 github.com/armon/go-metrics@v0.4.1
github.com/hashicorp/memberlist@v0.5.0 github.com/armon/go-metrics@v0.0.0-20180917152333-f0300d1749da
github.com/hashicorp/raft@v1.5.0 github.com/armon/go-metrics@v0.4.1
github.com/hashicorp/raft-boltdb/v2@v2.2.2 github.com/armon/go-metrics@v0.0.0-20190430140413-ec5e00d3c878
github.com/hashicorp/serf@v0.10.1 github.com/armon/go-metrics@v0.0.0-20180917152333-f0300d1749da
github.com/hashicorp/raft@v1.2.0 github.com/armon/go-metrics@v0.0.0-20190430140413-ec5e00d3c878
github.com/hashicorp/raft@v1.1.0 github.com/armon/go-metrics@v0.0.0-20190430140413-ec5e00d3c878