Align semver libs

.golangci.yml

@@ -122,7 +122,9 @@ linters-settings:
           - pkg: golang.org/x/exp/slices
             desc: 'use "slices" instead'
           - pkg: github.com/hashicorp/go-version
-            desc: 'use "golang.org/x/mod/semver" or "coreos/go-semver/semver" instead'
+            desc: 'use "coreos/go-semver/semver" instead'
+          - pkg: golang.org/x/mod/semver
+            desc: 'use "coreos/go-semver/semver" instead'
           - pkg: github.com/microsoftgraph/msgraph-sdk-go
             desc: 'use "github.com/gravitational/teleport/lib/msgraph" instead'
           - pkg: github.com/cloudflare/cfssl

build.assets/tooling/cmd/check/main.go

@@ -30,7 +30,7 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
-	"golang.org/x/mod/semver"
+	"golang.org/x/mod/semver" //nolint:depguard // Usage precedes the x/mod/semver rule.
 
 	"github.com/gravitational/teleport/build.assets/tooling/lib/github"
 )

build.assets/tooling/cmd/query-latest/main.go

@@ -37,7 +37,7 @@ import (
 	"time"
 
 	"github.com/gravitational/trace"
-	"golang.org/x/mod/semver"
+	"golang.org/x/mod/semver" //nolint:depguard // Usage precedes the x/mod/semver rule.
 
 	"github.com/gravitational/teleport/build.assets/tooling/lib/github"
 )

e_imports.go

@@ -119,7 +119,7 @@ import (
 	_ "golang.org/x/crypto/ssh"
 	_ "golang.org/x/crypto/ssh/agent"
 	_ "golang.org/x/exp/constraints"
-	_ "golang.org/x/mod/semver"
+	_ "golang.org/x/mod/semver" //nolint:depguard // Usage precedes the x/mod/semver rule.
 	_ "golang.org/x/net/html"
 	_ "golang.org/x/net/http/httpproxy"
 	_ "golang.org/x/net/http2"

integrations/kube-agent-updater/cmd/teleport-kube-agent-updater/main.go

@@ -30,7 +30,6 @@ import (
 	"github.com/distribution/reference"
 	"github.com/go-logr/logr"
 	"github.com/gravitational/trace"
-	"golang.org/x/mod/semver"
 	appsv1 "k8s.io/api/apps/v1"
 	v1 "k8s.io/api/core/v1"
 	"k8s.io/apimachinery/pkg/fields"
@@ -252,7 +251,7 @@ func main() {
 	case insecureNoVerify:
 		ctrl.Log.Info("INSECURE: Image validation disabled")
 		imageValidators = append(imageValidators, img.NewInsecureValidator("insecure always verified", kc))
-	case semver.Prerelease("v"+kubeversionupdater.Version) != "":
+	case kubeversionupdater.SemVersion != nil && kubeversionupdater.SemVersion.PreRelease != "":
 		ctrl.Log.Info("This is a pre-release updater version, the key used to sign dev and pre-release builds of Teleport will be trusted.")
 		validator, err := img.NewCosignSingleKeyValidator(teleportStageOCIPubKey, "staging cosign signature validator", kc)
 		if err != nil {

integrations/kube-agent-updater/pkg/controller/updater.go

@@ -20,8 +20,8 @@ package controller
 
 import (
 	"context"
-	"strings"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/distribution/reference"
 	"github.com/gravitational/trace"
 	"sigs.k8s.io/controller-runtime/pkg/client"
@@ -44,7 +44,7 @@ type VersionUpdater struct {
 // validating the new image signature.
 // If all steps are successfully executed and there's a new version, it returns
 // a digested reference to the new image that should be deployed.
-func (r *VersionUpdater) GetVersion(ctx context.Context, obj client.Object, currentVersion string) (img.NamedTaggedDigested, error) {
+func (r *VersionUpdater) GetVersion(ctx context.Context, obj client.Object, currentVersion *semver.Version) (img.NamedTaggedDigested, error) {
 	// Those are debug logs only
 	log := ctrllog.FromContext(ctx).V(1)
 
@@ -68,7 +68,7 @@ func (r *VersionUpdater) GetVersion(ctx context.Context, obj client.Object, curr
 
 	log.Info("Version change is valid, building img candidate")
 	// We tag our img candidate with the version
-	image, err := reference.WithTag(r.baseImage, strings.TrimPrefix(nextVersion, "v"))
+	image, err := reference.WithTag(r.baseImage, nextVersion.String())
 	if err != nil {
 		return nil, trace.Wrap(err)
 	}

integrations/kube-agent-updater/pkg/controller/updater_test.go

@@ -23,6 +23,7 @@ import (
 	"fmt"
 	"testing"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/distribution/reference"
 	"github.com/gravitational/trace"
 	"github.com/opencontainers/go-digest"
@@ -63,14 +64,21 @@ func errorIsType(errType interface{}) require.ErrorAssertionFunc {
 	}
 }
 
+func mustNewStaticGetter(t *testing.T, versionMock string, errMock error) version.Getter {
+	t.Helper()
+	getter, err := version.NewStaticGetter(versionMock, errMock)
+	require.NoError(t, err)
+	return getter
+}
+
 func Test_VersionUpdater_GetVersion(t *testing.T) {
 	ctx := context.Background()
 
 	tests := []struct {
 		name                string
 		releaseRegistry     string
 		releasePath         string
-		currentVersion      string
+		currentVersion      *semver.Version
 		versionGetter       version.Getter
 		maintenanceTriggers []maintenance.Trigger
 		imageCheckers       []img.Validator
@@ -81,8 +89,8 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 			name:                "all good",
 			releaseRegistry:     defaultTestRegistry,
 			releasePath:         defaultTestPath,
-			currentVersion:      versionMid,
-			versionGetter:       version.NewStaticGetter(versionHigh, nil),
+			currentVersion:      semver.Must(version.EnsureSemver(versionMid)),
+			versionGetter:       mustNewStaticGetter(t, versionHigh, nil),
 			maintenanceTriggers: []maintenance.Trigger{alwaysTrigger},
 			imageCheckers:       []img.Validator{alwaysValid},
 			assertErr:           require.NoError,
@@ -92,8 +100,8 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 			name:                "all good but no current version",
 			releaseRegistry:     defaultTestRegistry,
 			releasePath:         defaultTestPath,
-			currentVersion:      "",
-			versionGetter:       version.NewStaticGetter(versionHigh, nil),
+			currentVersion:      nil,
+			versionGetter:       mustNewStaticGetter(t, versionHigh, nil),
 			maintenanceTriggers: []maintenance.Trigger{alwaysTrigger},
 			imageCheckers:       []img.Validator{alwaysValid},
 			assertErr:           require.NoError,
@@ -103,8 +111,8 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 			name:                "same version",
 			releaseRegistry:     defaultTestRegistry,
 			releasePath:         defaultTestPath,
-			currentVersion:      versionMid,
-			versionGetter:       version.NewStaticGetter(versionMid, nil),
+			currentVersion:      semver.Must(version.EnsureSemver(versionMid)),
+			versionGetter:       mustNewStaticGetter(t, versionMid, nil),
 			maintenanceTriggers: []maintenance.Trigger{alwaysTrigger},
 			imageCheckers:       []img.Validator{alwaysValid},
 			assertErr:           errorIsType(&version.NoNewVersionError{}),
@@ -114,8 +122,8 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 			name:                "no version",
 			releaseRegistry:     defaultTestRegistry,
 			releasePath:         defaultTestPath,
-			currentVersion:      versionMid,
-			versionGetter:       version.NewStaticGetter("", &version.NoNewVersionError{Message: "version server did not advertise a version"}),
+			currentVersion:      semver.Must(version.EnsureSemver(versionMid)),
+			versionGetter:       mustNewStaticGetter(t, "", &version.NoNewVersionError{Message: "version server did not advertise a version"}),
 			maintenanceTriggers: []maintenance.Trigger{alwaysTrigger},
 			imageCheckers:       []img.Validator{alwaysValid},
 			assertErr:           errorIsType(&version.NoNewVersionError{}),
@@ -125,8 +133,8 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 			name:                "no maintenance triggered",
 			releaseRegistry:     defaultTestRegistry,
 			releasePath:         defaultTestPath,
-			currentVersion:      versionMid,
-			versionGetter:       version.NewStaticGetter(versionHigh, nil),
+			currentVersion:      semver.Must(version.EnsureSemver(versionMid)),
+			versionGetter:       mustNewStaticGetter(t, versionHigh, nil),
 			maintenanceTriggers: []maintenance.Trigger{neverTrigger},
 			imageCheckers:       []img.Validator{alwaysValid},
 			assertErr:           errorIsType(&MaintenanceNotTriggeredError{}),
@@ -136,8 +144,8 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 			name:                "invalid signature",
 			releaseRegistry:     defaultTestRegistry,
 			releasePath:         defaultTestPath,
-			currentVersion:      versionMid,
-			versionGetter:       version.NewStaticGetter(versionHigh, nil),
+			currentVersion:      semver.Must(version.EnsureSemver(versionMid)),
+			versionGetter:       mustNewStaticGetter(t, versionHigh, nil),
 			maintenanceTriggers: []maintenance.Trigger{alwaysTrigger},
 			imageCheckers:       []img.Validator{neverValid},
 			assertErr:           errorIsType(&trace.TrustError{}),
@@ -147,8 +155,8 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 			name:                "error getting version",
 			releaseRegistry:     defaultTestRegistry,
 			releasePath:         defaultTestPath,
-			currentVersion:      versionMid,
-			versionGetter:       version.NewStaticGetter("", &trace.ConnectionProblemError{}),
+			currentVersion:      semver.Must(version.EnsureSemver(versionMid)),
+			versionGetter:       mustNewStaticGetter(t, "", &trace.ConnectionProblemError{}),
 			maintenanceTriggers: []maintenance.Trigger{alwaysTrigger},
 			imageCheckers:       []img.Validator{neverValid},
 			assertErr:           errorIsType(&trace.ConnectionProblemError{}),
@@ -176,7 +184,7 @@ func Test_VersionUpdater_GetVersion(t *testing.T) {
 			obj := &core.Pod{}
 
 			// Doing the test
-			image, err := updater.GetVersion(ctx, obj, "v"+tt.currentVersion)
+			image, err := updater.GetVersion(ctx, obj, tt.currentVersion)
 			tt.assertErr(t, err)
 			if tt.expectedImage == "" {
 				require.Nil(t, image)

integrations/kube-agent-updater/pkg/controller/utils.go

@@ -21,6 +21,7 @@ package controller
 import (
 	"strconv"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/distribution/reference"
 	"github.com/gravitational/trace"
 	v1 "k8s.io/api/core/v1"
@@ -29,27 +30,26 @@ import (
 	"github.com/gravitational/teleport/lib/automaticupgrades/version"
 )
 
-func getWorkloadVersion(podSpec v1.PodSpec) (string, error) {
-	var current string
+func getWorkloadVersion(podSpec v1.PodSpec) (*semver.Version, error) {
 	image, err := getContainerImageFromPodSpec(podSpec, teleportContainerName)
 	if err != nil {
-		return current, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 
 	imageRef, err := reference.ParseNamed(image)
 	if err != nil {
-		return current, trace.Wrap(err)
+		return nil, trace.Wrap(err)
 	}
 	taggedImageRef, ok := imageRef.(reference.Tagged)
 	if !ok {
-		return "", trace.BadParameter("imageRef %s is not tagged", imageRef)
+		return nil, trace.BadParameter("imageRef %s is not tagged", imageRef)
 	}
-	current = taggedImageRef.Tag()
-	current, err = version.EnsureSemver(current)
+	currentTag := taggedImageRef.Tag()
+	currentVersion, err := version.EnsureSemver(currentTag)
 	if err != nil {
-		return "", trace.Wrap(err)
+		return nil, trace.BadParameter("failed to parse image version: %v", err)
 	}
-	return current, nil
+	return currentVersion, nil
 }
 
 func getContainerImageFromPodSpec(spec v1.PodSpec, container string) (string, error) {

integrations/kube-agent-updater/pkg/controller/utils_test.go

@@ -21,9 +21,12 @@ package controller
 import (
 	"testing"
 
+	"github.com/coreos/go-semver/semver"
 	"github.com/gravitational/trace"
 	"github.com/stretchr/testify/require"
 	v1 "k8s.io/api/core/v1"
+
+	"github.com/gravitational/teleport/lib/automaticupgrades/version"
 )
 
 const (
@@ -266,46 +269,49 @@ func newPodSpecWithImage(image string) v1.PodSpec {
 }
 
 func Test_getWorkloadVersion(t *testing.T) {
+	testVersion, err := version.EnsureSemver(versionMid)
+	require.NoError(t, err)
+
 	tests := []struct {
 		name      string
 		podSpec   v1.PodSpec
-		expected  string
+		expected  *semver.Version
 		assertErr require.ErrorAssertionFunc
 	}{
 		{
 			name:      "OK regular podSpec, semver tag no digest",
 			podSpec:   newPodSpecWithImage(defaultTestRegistry + "/" + defaultTestPath + ":" + versionMid),
-			expected:  "v" + versionMid,
+			expected:  testVersion,
 			assertErr: require.NoError,
 		},
 		{
 			name:      "OK regular podSpec, semver tag with digest",
 			podSpec:   newPodSpecWithImage(defaultTestRegistry + "/" + defaultTestPath + ":" + versionMid + "@" + defaultImageDigest.String()),
-			expected:  "v" + versionMid,
+			expected:  testVersion,
 			assertErr: require.NoError,
 		},
 		{
 			name:      "KO regular podSpec, non-semver tag no digest",
 			podSpec:   newPodSpecWithImage(defaultTestRegistry + "/" + defaultTestPath + ":" + nonSemverTag),
-			expected:  "",
+			expected:  nil,
 			assertErr: errorIsType(&trace.BadParameterError{}),
 		},
 		{
 			name:      "KO regular podSpec, non-semver tag with digest",
 			podSpec:   newPodSpecWithImage(defaultTestRegistry + "/" + defaultTestPath + ":" + nonSemverTag + "@" + defaultImageDigest.String()),
-			expected:  "",
+			expected:  nil,
 			assertErr: errorIsType(&trace.BadParameterError{}),
 		},
 		{
 			name:      "KO regular podSpec, no tag, only digest",
 			podSpec:   newPodSpecWithImage(defaultTestRegistry + "/" + defaultTestPath + "@" + defaultImageDigest.String()),
-			expected:  "",
+			expected:  nil,
 			assertErr: errorIsType(&trace.BadParameterError{}),
 		},
 		{
 			name:      "KO regular podSpec, no tag, no digest",
 			podSpec:   newPodSpecWithImage(defaultTestRegistry + "/" + defaultTestPath),
-			expected:  "",
+			expected:  nil,
 			assertErr: errorIsType(&trace.BadParameterError{}),
 		},
 		{
@@ -322,7 +328,7 @@ func Test_getWorkloadVersion(t *testing.T) {
 					},
 				},
 			},
-			expected:  "v" + versionMid,
+			expected:  testVersion,
 			assertErr: require.NoError,
 		},
 		{
@@ -335,7 +341,7 @@ func Test_getWorkloadVersion(t *testing.T) {
 					},
 				},
 			},
-			expected:  "",
+			expected:  nil,
 			assertErr: require.Error,
 		},
 	}

integrations/kube-agent-updater/version.go

@@ -21,3 +21,5 @@ package kubeversionupdater
 import "github.com/gravitational/teleport/api"
 
 const Version = api.Version
+
+var SemVersion = api.SemVersion

lib/auth/periodic.go

@@ -23,7 +23,7 @@ import (
 	"slices"
 	"strings"
 
-	"golang.org/x/mod/semver"
+	"golang.org/x/mod/semver" //nolint:depguard // Usage precedes the x/mod/semver rule.
 
 	"github.com/gravitational/teleport/api/client/proto"
 	"github.com/gravitational/teleport/api/types"