pin go mod

Signed-off-by: Roland.Ma <rolandma@yunify.com>

hack/lint-dependencies.sh

@@ -24,7 +24,7 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 # Explicitly opt into go modules, even though we're inside a GOPATH directory
 export GO111MODULE=on
 # Explicitly clear GOFLAGS, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
-export GOFLAGS=
+export GOFLAGS=-mod=mod
 # Detect problematic GOPROXY settings that prevent lookup of dependencies
 if [[ "${GOPROXY:-}" == "off" ]]; then
   kube::log::error "Cannot run with \$GOPROXY=off"

hack/update-vendor-licenses.sh

@@ -133,7 +133,9 @@ process_content () {
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
+# use modules, and use module info rather than the vendor dir for computing dependencies
 export GO111MODULE=on
+export GOFLAGS=-mod=mod
 
 # Check bash version
 if (( BASH_VERSINFO[0] < 4 )); then

hack/update-vendor.sh

@@ -11,8 +11,8 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 
 # Explicitly opt into go modules, even though we're inside a GOPATH directory
 export GO111MODULE=on
-# Explicitly clear GOFLAGS, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
-export GOFLAGS=
+# Explicitly set GOFLAGS to ignore vendor, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
+export GOFLAGS=-mod=mod
 # Ensure sort order doesn't depend on locale
 export LANG=C
 export LC_ALL=C
@@ -181,8 +181,16 @@ go mod vendor >>"${LOG_FILE}" 2>&1
 # sort recorded packages for a given vendored dependency in modules.txt.
 # `go mod vendor` outputs in imported order, which means slight go changes (or different platforms) can result in a differently ordered modules.txt.
 # scan                 | prefix comment lines with the module name       | sort field 1  | strip leading text on comment lines
-awk '{if($1=="#") print $2 " " $0; else print}' < vendor/modules.txt | sort -k1,1 -s | sed 's/.*#/#/' > "${TMP_DIR}/modules.txt.tmp"
-mv "${TMP_DIR}/modules.txt.tmp" vendor/modules.txt
+# 1. prefix '#' lines with the module name and capture the module name
+# 2. prefix '##' with the most recently captured module name
+# 3. output other lines as-is
+# sort lines
+# strip anything before '#'
+awk '{
+  if($1=="#")       { current_module=$2; print $2 " " $0;      }
+  else if($1=="##") { print current_module " " $0; }
+  else              { print }
+}' < vendor/modules.txt | sort -k1,1 -s | sed 's/[^#]*#/#/' > "${TMP_DIR}/modules.txt.tmp"
 
 # create a symlink in vendor directory pointing to the staging components.
 # This lets other packages and tools use the local staging components as if they were vendored.