fix: possible race condition when applying templates to flags/ldflags

[caarlos0]

while working on goreleaser/goreleaser#3653, I got some race conditions sometimes.

Seems to happen when the base image is a image index, in which case it'll build for all platform needed concurrently, which is when we get the concurrent writes.

I don't see a big issue in returning a copy instead, not sure what you think.

PS: Its late here, so please pardon me if I'm doing something dumb 😂

[codecov-commenter]

Codecov Report

Merging #913 (1d05794) into main (ac2df47) will decrease coverage by 0.04%.
The diff coverage is 0.00%.

@@            Coverage Diff             @@
##             main     #913      +/-   ##
==========================================
- Coverage   51.34%   51.30%   -0.05%     
==========================================
  Files          44       44              
  Lines        3414     3417       +3     
==========================================
  Hits         1753     1753              
- Misses       1432     1435       +3     
  Partials      229      229              

Impacted Files	Coverage Δ
pkg/build/gobuild.go	56.97% <0.00%> (-0.21%)	⬇️

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[caarlos0]

giving it a second though, a question: when the base image is not multi-platform, should ko still try to build for all the given platforms?

[imjasonh]

giving it a second though, a question: when the base image is not multi-platform, should ko still try to build for all the given platforms?

ko's behavior here is kind of weird, since there are a number of scenarios it has to cover.

1. If the base image is a single-platform image, --platform basically only describes the platform to set on the output image. KO_DEFAULTBASEIMAGE=some-amd64-image ko build --platform=linux/arm64 even works, and adds an arm64 Go binary on top of the amd64 base. 🙃
2. --platform=all when building on a single-platform base just means "whatever the base image's platform is", which is nearly always linux/amd64, and might just always default to that (I haven't tried; there really aren't a lot of single-platform non-amd64 images).

I think we should keep this behavior (at least (2)), because of how it interacts with ko resolve where there may be many builds and many base images. You'd want ko resolve --platform=all to produce multi-arch images when possible, and single-arch images when that's all that's available in the base.

[caarlos0]

ah cool, thanks for explaining all that, @imjasonh!

Cheers!