chore: use go to bootstrap downloading and running task

.binny.yaml

@@ -2,26 +2,30 @@ tools:
   # we want to use a pinned version of binny to manage the toolchain (so binny manages itself!)
   - name: binny
     version:
-      want: v0.8.0
-    method: github-release
+#      want: v0.8.0
+      want: fix-freebsd
+    method: go-install
     with:
-      repo: anchore/binny
+      module: github.com/anchore/binny
+      entrypoint: cmd/binny
 
   # used to produce SBOMs during release
   - name: syft
     version:
       want: latest
-    method: github-release
+    method: go-install
     with:
-      repo: anchore/syft
+      module: github.com/anchore/syft
+      entrypoint: cmd/syft
 
   # used to sign mac binaries at release
   - name: quill
     version:
       want: v0.4.1
-    method: github-release
+    method: go-install
     with:
-      repo: anchore/quill
+      module: github.com/anchore/quill
+      entrypoint: cmd/quill
 
   # used for linting
   - name: golangci-lint
@@ -43,41 +47,46 @@ tools:
   - name: cosign
     version:
       want: v2.2.4
-    method: github-release
+    method: go-install
     with:
-      repo: sigstore/cosign
+      module: github.com/sigstore/cosign/v2
+      entrypoint: cmd/cosign
 
   # used in integration tests to verify JSON schemas
   - name: yajsv
     version:
       want: v1.4.1
-    method: github-release
+    method: go-install
     with:
-      repo: neilpa/yajsv
+      module: github.com/neilpa/yajsv
+      entrypoint:
 
   # used to release all artifacts
   - name: goreleaser
     version:
       want: v2.0.1
-    method: github-release
+    method: go-install
     with:
-      repo: goreleaser/goreleaser
+      module: github.com/goreleaser/goreleaser/v2
+#      entrypoint: cmd
 
   # used for organizing imports during static analysis
   - name: gosimports
     version:
       want: v0.3.8
-    method: github-release
+    method: go-install
     with:
-      repo: rinchsan/gosimports
+      module: github.com/rinchsan/gosimports
+      entrypoint: cmd/gosimports
 
   # used at release to generate the changelog
   - name: chronicle
     version:
       want: v0.8.0
-    method: github-release
+    method: go-install
     with:
-      repo: anchore/chronicle
+      module: github.com/anchore/chronicle
+      entrypoint: cmd/chronicle
 
   # used during static analysis for license compliance
   - name: bouncer
@@ -86,6 +95,10 @@ tools:
     method: github-release
     with:
       repo: wagoodman/go-bouncer
+#    method: go-install
+#    with:
+#      module: github.com/wagoodman/go-bouncer
+#      entrypoint:
 
   # used for showing benchmark testing
   - name: benchstat
@@ -112,6 +125,7 @@ tools:
   - name: gh
     version:
       want: v2.51.0
-    method: github-release
+    method: go-install
     with:
-      repo: cli/cli
+      module: github.com/cli/cli/v2
+      entrypoint: cmd/gh

Makefile

@@ -1,46 +1,17 @@
-OWNER = anchore
-PROJECT = syft
+.PHONY: *
 
-TOOL_DIR = .tool
-BINNY = $(TOOL_DIR)/binny
-TASK = $(TOOL_DIR)/task
+help:
+	@go run -C buildtools . -l
 
-.DEFAULT_GOAL := make-default
+bootstrap:
+	@go run -C buildtools . bootstrap
 
-## Bootstrapping targets #################################
+unit:
+	@go run -C buildtools . $@
 
-# note: we need to assume that binny and task have not already been installed
-$(BINNY):
-	@mkdir -p $(TOOL_DIR)
-	@curl -sSfL https://raw.githubusercontent.com/$(OWNER)/binny/main/install.sh | sh -s -- -b $(TOOL_DIR)
+# for some reason test does not work without an explicit target - the dir?
+test:
+	@go run -C buildtools . $@
 
-# note: we need to assume that binny and task have not already been installed
-.PHONY: task
-$(TASK) task: $(BINNY)
-	@$(BINNY) install task -q
-
-.PHONY: ci-bootstrap-go
-ci-bootstrap-go:
-	go mod download
-
-# this is a bootstrapping catch-all, where if the target doesn't exist, we'll ensure the tools are installed and then try again
 %:
-	make $(TASK)
-	$(TASK) $@
-
-## Shim targets #################################
-
-.PHONY: make-default
-make-default: $(TASK)
-	@# run the default task in the taskfile
-	@$(TASK)
-
-# for those of us that can't seem to kick the habit of typing `make ...` lets wrap the superior `task` tool
-TASKS := $(shell bash -c "test -f $(TASK) && $(TASK) -l | grep '^\* ' | cut -d' ' -f2 | tr -d ':' | tr '\n' ' '" ) $(shell bash -c "test -f $(TASK) && $(TASK) -l | grep 'aliases:' | cut -d ':' -f 3 | tr '\n' ' ' | tr -d ','")
-
-.PHONY: $(TASKS)
-$(TASKS): $(TASK)
-	@$(TASK) $@
-
-help: $(TASK)
-	@$(TASK) -l
+	@go run -C buildtools . $@

Taskfile.yaml

@@ -68,32 +68,32 @@ tasks:
 
   ## Bootstrap tasks #################################
 
-  binny:
-    internal: true
-    # desc: Get the binny tool
-    generates:
-      - "{{ .TOOL_DIR }}/binny"
-    status:
-      - "test -f {{ .TOOL_DIR }}/binny"
-    cmd: "curl -sSfL https://raw.githubusercontent.com/anchore/binny/main/install.sh | sh -s -- -b .tool"
-    silent: true
+#  binny:
+#    internal: true
+#    # desc: Get the binny tool
+#    generates:
+#      - "{{ .TOOL_DIR }}/binny"
+#    status:
+#      - "test -f {{ .TOOL_DIR }}/binny"
+#    cmd: "curl -sSfL https://raw.githubusercontent.com/anchore/binny/main/install.sh | sh -s -- -b .tool"
+#    silent: true
 
   tools:
     desc: Install all tools needed for CI and local development
-    deps: [binny]
+#    deps: [binny]
     aliases:
       - bootstrap
-    generates:
-      - ".binny.yaml"
-      - "{{ .TOOL_DIR }}/*"
-    status:
-      - "{{ .TOOL_DIR }}/binny check -v"
-    cmd: "{{ .TOOL_DIR }}/binny install -v"
+#    generates:
+#      - ".binny.yaml"
+#      - "{{ .TOOL_DIR }}/*"
+#    status:
+#      - "{{ .TOOL_DIR }}/binny check -v"
+#    cmd: "{{ .TOOL_DIR }}/binny install -v"
     silent: true
 
   update-tools:
     desc: Update pinned versions of all tools to their latest available versions
-    deps: [binny]
+#    deps: [binny]
     generates:
       - ".binny.yaml"
       - "{{ .TOOL_DIR }}/*"
@@ -102,13 +102,13 @@ tasks:
 
   list-tools:
     desc: List all tools needed for CI and local development
-    deps: [binny]
+#    deps: [binny]
     cmd: "{{ .TOOL_DIR }}/binny list"
     silent: true
 
   list-tool-updates:
     desc: List all tools that are not up to date relative to the binny config
-    deps: [binny]
+#    deps: [binny]
     cmd: "{{ .TOOL_DIR }}/binny list --updates"
     silent: true
 
@@ -118,19 +118,22 @@ tasks:
       - "{{ .TMP_DIR }}"
     cmd: "mkdir -p {{ .TMP_DIR }}"
 
+  ci-bootstrap-go:
+    cmd: "go mod download"
+
   ## Static analysis tasks #################################
 
   format:
     desc: Auto-format all source code
-    deps: [tools]
+#    deps: [tools]
     cmds:
       - gofmt -w -s .
       - "{{ .TOOL_DIR }}/gosimports -local github.com/anchore -w ."
       - go mod tidy
 
   lint-fix:
     desc: Auto-format all source code + run golangci lint fixers
-    deps: [tools]
+#    deps: [tools]
     cmds:
       - task: format
       - "{{ .TOOL_DIR }}/golangci-lint run --tests=false --fix"
@@ -142,7 +145,7 @@ tasks:
         sh: gofmt -l -s .
       BAD_FILE_NAMES:
         sh: "find . | grep -e ':' || true"
-    deps: [tools]
+#    deps: [tools]
     cmds:
       # ensure there are no go fmt differences
       - cmd: 'test -z "{{ .BAD_FMT_FILES }}" || (echo "files with gofmt issues: [{{ .BAD_FMT_FILES }}]"; exit 1)'
@@ -156,7 +159,7 @@ tasks:
 
   check-licenses:
     # desc: Ensure transitive dependencies are compliant with the current license policy
-    deps: [tools]
+#    deps: [tools]
     cmd: "{{ .TOOL_DIR }}/bouncer check ./..."
 
   check-go-mod-tidy:
@@ -211,7 +214,7 @@ tasks:
     # note: we don't want to regenerate the snapshot unless we have to. In CI it's probable
     # that the cache being restored with the correct binary will be rebuilt since the timestamps
     # and local checksums will not line up.
-    deps: [tools, snapshot]
+    deps: [snapshot]
     sources:
       - "{{ .SNAPSHOT_BIN }}"
       - ./test/cli/**
@@ -399,7 +402,7 @@ tasks:
 
   build:
     desc: Build the project
-    deps: [tools, tmpdir]
+    deps: [tmpdir]
     generates:
       - "{{ .PROJECT }}"
     cmds:
@@ -414,7 +417,7 @@ tasks:
     desc: Create a snapshot release
     aliases:
       - build
-    deps: [tools, tmpdir]
+    deps: [tmpdir]
     sources:
       - cmd/**/*.go
       - syft/**/*.go
@@ -432,7 +435,7 @@ tasks:
 
   changelog:
     desc: Generate a changelog
-    deps: [tools]
+#    deps: [tools]
     generates:
       - "{{ .CHANGELOG }}"
       - "{{ .NEXT_VERSION }}"
@@ -446,7 +449,7 @@ tasks:
   release:
     desc: Create a release
     interactive: true
-    deps: [tools]
+#    deps: [tools]
     cmds:
       - cmd: .github/scripts/trigger-release.sh
         silent: true
@@ -462,7 +465,7 @@ tasks:
 
   ci-release:
     # desc: "[CI only] Create a release"
-    deps: [tools]
+#    deps: [tools]
     cmds:
       - task: ci-check
       - "{{ .TOOL_DIR }}/chronicle -vvv > CHANGELOG.md"
@@ -472,7 +475,7 @@ tasks:
 
   ci-release-version-file:
     # desc: "[CI only] Update the version file"
-    deps: [tools]
+#    deps: [tools]
     cmds:
       - task: ci-check
       - ".github/scripts/update-version-file.sh {{ .RELEASE_VERSION }}"

buildtools/go.mod

@@ -0,0 +1,11 @@
+module github.com/anchore/syft/buildtools
+
+go 1.22.0
+
+require github.com/kzantow/go-build v0.0.0-20240621190357-037e1844f43f
+
+require (
+	github.com/kr/text v0.2.0 // indirect
+	golang.org/x/mod v0.14.0 // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
+)

buildtools/go.sum

@@ -0,0 +1,16 @@
+github.com/creack/pty v1.1.9/go.mod h1:oKZEueFk5CKHvIhNR5MUki03XCEU+Q6VDXinZuGJ33E=
+github.com/kr/pretty v0.3.1 h1:flRD4NNwYAUpkphVc1HcthR4KEIFJ65n8Mw5qdRn3LE=
+github.com/kr/pretty v0.3.1/go.mod h1:hoEshYVHaxMs3cyo3Yncou5ZscifuDolrwPKZanG3xk=
+github.com/kr/text v0.2.0 h1:5Nx0Ya0ZqY2ygV366QzturHI13Jq95ApcVaJBhpS+AY=
+github.com/kr/text v0.2.0/go.mod h1:eLer722TekiGuMkidMxC/pM04lWEeraHUUmBw8l2grE=
+github.com/kzantow/go-build v0.0.0-20240621190357-037e1844f43f h1:BTLfdsCjHKo58S3ULdG0pn2VLHjlYrWUvzwypjwNp+g=
+github.com/kzantow/go-build v0.0.0-20240621190357-037e1844f43f/go.mod h1:A2nQV6Y2eb8juxo8yN+tZ+YxJ8hDtQzKSScBvJC8zXk=
+github.com/rogpeppe/go-internal v1.12.0 h1:exVL4IDcn6na9z1rAb56Vxr+CgyK3nn3O+epU5NdKM8=
+github.com/rogpeppe/go-internal v1.12.0/go.mod h1:E+RYuTGaKKdloAfM02xzb0FW3Paa99yedzYV+kq4uf4=
+golang.org/x/mod v0.14.0 h1:dGoOF9QVLYng8IHTm7BAyWqCqSheQ5pYWGhzW00YJr0=
+golang.org/x/mod v0.14.0/go.mod h1:hTbmBsO62+eylJbnUtE2MGJUyE7QWk4xUqPFrRgJ+7c=
+gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c h1:Hei/4ADfdWqJk1ZMxUNpqntNwaWcugrBjAiHlqqRiVk=
+gopkg.in/check.v1 v1.0.0-20201130134442-10cb98267c6c/go.mod h1:JHkPIbrfpd72SG/EVd6muEfDQjcINNoR0C8j2r3qZ4Q=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=

buildtools/main.go

@@ -0,0 +1,9 @@
+package main
+
+import (
+	"github.com/kzantow/go-build"
+)
+
+func main() {
+	build.RunTools()
+}