How to control the full version of the go compilers and how to trigger rebuilds

[rhuss]

For golang based formulas, I wonder what is the best strategies to tackle golang related CVEs (like those described in knative/homebrew-client#32 (comment)). My concretes questions would be:

• Is it possible to configure the golang compiler up to the patchlevel (like e.g. 1.15.15) when doing golang builds ?
• What would be the best strategy if a new build is required where only the compiler version is updated but nothing from the code. I guess that one would have to create a new tag in the upstream source repo and simultaneously update the golang version in the formula (if this is possible of course) ?

Thanks a lot !

[SMillerDev]

Is it possible to configure the golang compiler up to the patchlevel (like e.g. 1.15.15) when doing golang builds ?

Not in Homebrew, but you're free to install Go another way for your own CI.

What would be the best strategy if a new build is required where only the compiler version is updated but nothing from the code. I guess that one would have to create a new tag in the upstream source repo and simultaneously update the golang version in the formula (if this is possible of course) ?

https://docs.brew.sh/Formula-Cookbook#formulae-revisions seems to be what you want

[rhuss]

Thanks for the super fast answers, that's awesome ! (really appreciated)

Not in Homebrew, but you're free to install Go another way for your own CI.

But this would require a 'binary formula' (i.e. a formula reusing a binary built elsewhere) like we do in knative/homebrew-client but afaik homebrew-core accepts only 'source formulas' (building the binary as part of the formula). (sorry for my ignorance, not super deep in Homebrew's policy). So for a formula running from homebrew-core, you are not able to fully control the golang version with which the source is compiled, correct ?

[SMillerDev]

No, for homebrew-core the Formula will always be build with the newest possible Go version. As upstream you have just as much control as everyone else, you can make a PR to fix things if they're broken.

[rhuss]

Thanks for clarifying this, much appreciated.