myxce/.wolf/bugs/bug-1910.md

id	status	status_updated	status_note	component	severity	timestamp	last_seen	occurrences	files	tags	related	fix_commits
bug-1910	fixed	2026-10-03		tooling	wrong-result	2026-10-03T12:14:03Z	2026-10-03T12:14:03Z	1	src/tools/test-version-startup-consistency.sh src/tools/test-dirty-fingerprint-startup-log-unchanged.sh	test-script apiserver go vendor	bug-1607 bug-1608 bug-1909	ef6e562c

bug-1910: version scripts' apiserver go build uses -mod=readonly and fails without a Go module cache

Description

Observed:

models/auth.go:4:2: module lookup disabled by GOPROXY=off
utils/utils.go:18:2: module lookup disabled by GOPROXY=off
...
FATAL: command failed (line 383)

Both test-version-startup-consistency.sh and test-dirty-fingerprint-startup-log-unchanged.sh build the apiserver with GOPROXY=off go build -mod=readonly .... -mod=readonly makes Go ignore the committed src/frontend/apiserver/vendor/ tree and resolve modules from the module cache, which this machine does not have, so the build fails and the scripts never reach their apiserver checks.

Expected: the scripts build the apiserver the way the canonical meson build does (GOFLAGS=-mod=vendor, src/frontend/apiserver/meson.build:89), which needs no module cache and never modifies go.mod/go.sum (the concern -mod=readonly was added for, bug-1607). Impact: both scripts exit 1 on any machine without a populated Go module cache; their apiserver halves are never exercised. Test-only. Found by: spec task (controller-peers-env-fallback tasks 5.2/5.3)

Environment

• OS: no /etc/os-release; Docker container; NixOS kernel; kernel Linux 6.18.33 x86_64
• libc: glibc 2.42-47 (nix devShell, /nix/store/wb6rhpznjfczwlwx23zmdrrw74bayxw4-glibc-2.42-47)
• Toolchain: gcc (GCC) 15.2.0, meson 1.9.1
• Build: debug (the scripts' own lib/scheduler builds) + direct go build of the apiserver
• Code: scheduler-framework @ 66520e6b-dirty
• Deployment: n/a — local script builds, no cluster

Reproduction

1. On a machine with no Go module cache, run bash src/tools/test-dirty-fingerprint-startup-log-unchanged.sh (or test-version-startup-consistency.sh).
2. The apiserver step fails with module lookup disabled by GOPROXY=off.

• Frequency: deterministic on this machine, 2026-10-03 (every run during controller-peers-env-fallback 5.2/5.3)
• Evidence: not kept (scratchpad logs from the 5.3 run)

Root cause

Both scripts build the apiserver with GOPROXY=off go build -mod=readonly. -mod=readonly makes Go ignore the committed src/frontend/apiserver/vendor/ tree and resolve modules from the module cache; the scripts were written on a machine whose cache was already populated, so on a machine without one every import fails with module lookup disabled by GOPROXY=off.

Fix

Use -mod=vendor, as the canonical meson build does (GOFLAGS=-mod=vendor, src/frontend/apiserver/meson.build:89). Vendor mode needs no module cache and never modifies go.mod/go.sum, so the bug-1607 no-repo-mutation property still holds. Header comments updated in both scripts.

Verification

• Test: bash src/tools/test-dirty-fingerprint-startup-log-unchanged.sh — RED before (FATAL at the apiserver go build, 12x module lookup disabled by GOPROXY=off), GREEN after (exit 0, apiserver checks PASS); same for test-version-startup-consistency.sh (exit 0, PASS [apiserver]), 2026-10-03.
• Suites: go.mod/go.sum unchanged (md5 and git status src/frontend checked by the reviewer); xce-build.sh all --incremental (asan) green.
• Live: n/a (test-script defect)

References

• Related: none