deps: investigate steps needed for updating go-getter

[shoenig]

If/When hashicorp/go-getter#300 is merged, we need to be careful in understanding the implications on Nomad's use of go-getter for artifact downloading. In particular

1. If git is now going to lookup the user's .gitconfig, is it going to error when landlock blocks that access?

2. Regardless of 1, now that go-getter would be able to access the user .gitconfig, should we go ahead and allow that to happen?

[picatz]

⚠️ FYI: it was merged today after this issue was created.

[crw]

Just FYI hashicorp/terraform#28968 is blocked on having a new release cut for go-getter (v1), which my understanding is the Nomad team will create when you have resolved the questions in this issue. Linking these issues so I can more easily check in on status. :)

[shoenig]

@crw @picatz I just ran through Nomad's artifact e2e tests with go-getter on main - everything still works on our end. The policy question in 2 is something we can handle without holding anyone up.

[crw]

Hi @shoenig, @picatz: according to @kmoe, the Nomad team agreed to make a new release of go-getter when the Nomad team was ready to accept the change. Given the previous comment, is that time now? :) I ask because we have an issue on the Terraform side that is blocked on the next release of go-getter (hashicorp/terraform#28968). It looks like there was an additional PR merged since the above-mentioned, see: hashicorp/go-getter@v1.7.1...main. Thanks for any info.

[tgross]

Hi @crw! Sorry, I think there was a miscommunication and we're fine with the change. We just need to figure out whether or not to special case the Landlock config in Nomad for it, but that's not something we need to block on at all.

I've had a quick look at the go-getter repo and how the releases work and I think I've got a handle on that. I've just pushed the 1.7.2 tag and waiting for the release action to complete.

[crw]

@tgross thank you so much for your very prompt response! I appreciate it.

[tgross]

go-getter release done: https://github.com/hashicorp/go-getter/releases/tag/v1.7.2

[tgross]

This has been long-since updated. Closing it out.