fix(v1alpha1): correct struct tag typo in RepositoryStatus (#6575)

Signed-off-by: Yash Raj <kyashraj991@gmail.com>

A

.gitignore

@@ -21,6 +21,11 @@ bin/
 .vscode/
 __debug_bin
 
+# This is where the result of the go build goes
+/output*/
+/_output*/
+/_output
+
 # OSX trash
 .DS_Store
 api.json

.go-version

@@ -0,0 +1 @@
+1.24.3

.licenserc.yaml

@@ -1,61 +1,25 @@
-# Please refer to the LICENSE file in the root directory of the project.
-# https://github.com/kubesphere/kubesphere/blob/master/LICENSE
-
+# Copyright 2025 The KubeSphere Authors.
+# SPDX-License-Identifier: LicenseRef-KubeSphere-Open-Source
 header:
   license:
-    spdx-id: Apache-2.0
+    spdx-id: LicenseRef-KubeSphere-Open-Source
+    copyright-year: '2025'
     copyright-owner: KubeSphere Authors
-
     content: |
-      Please refer to the LICENSE file in the root directory of the project.
-      https://github.com/kubesphere/kubesphere/blob/master/LICENSE
-
+      Copyright [year] The [owner].
+      SPDX-License-Identifier: LicenseRef-KubeSphere-Open-Source
+  paths:
+    - "pkg"
+    - "staging"
+    - "tools"
   paths-ignore:
-    - 'api'
-    - 'build'
-    - 'docs'
-    - 'config'
-    - 'test'
-    - 'install'
-    - 'hack'
-    - 'vendor'
-    - 'staging'
-    - 'LICENSE'
-    - 'OWNERS'
-    - 'Makefile'
-    - 'pkg/client/**'
-    - 'pkg/simple/client/**'
-    - '**/*.md'
-    - '**/*.json'
-    - '**/go.mod'
-    - '**/go.sum'
-    - '.github/**'
-    - '.gitignore'
-    - '.gitattributes'
-    - 'pkg/controller/application/status.go'
-    - '.golangci.yaml'
-    - 'kube/pkg/apis/**'
-    - 'kube/pkg/openapi/merge/**'
-    - 'kube/pkg/features/**'
-    - 'kube/pkg/quota/**'
-    - 'kube/plugin/**'
-    - 'pkg/apiserver/request/context.go'
-    - 'pkg/apiserver/request/context_test.go'
-    - 'pkg/apiserver/authentication/request/basictoken/**'
-    - 'pkg/apiserver/authentication/request/bearertoken/**'
-    - 'pkg/apiserver/authorization/**'
-    - 'pkg/controller/k8sapplication/condition.go'
-    - 'pkg/controller/k8sapplication/status.go'
-    - 'pkg/models/iam/am/rbac/evaluation_helpers.go'
-    - 'pkg/utils/conversions/core/v1/conversion.go'
-    - 'pkg/utils/signals/**'
-    - 'tools/tools.go'
-
+    - "LICENSE"
+    - "OWNERS"
+    - "go.sum"
   comment: on-failure
   license-location-threshold: 80
-
   language:
     Go:
       extensions:
         - ".go"
-      comment_style_id: SlashAsterisk
+      comment_style_id: DoubleSlash

LICENSES/vendor/cel.dev/expr/LICENSE

@@ -0,0 +1,206 @@
+= vendor/cel.dev/expr licensed under: =
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+= vendor/cel.dev/expr/LICENSE 3b83ef96387f14655fc854ddc3c6bd57

LICENSES/vendor/github.com/Azure/go-ntlmssp/LICENSE

@@ -0,0 +1,25 @@
+= vendor/github.com/Azure/go-ntlmssp licensed under: =
+
+The MIT License (MIT)
+
+Copyright (c) 2016 Microsoft
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+= vendor/github.com/Azure/go-ntlmssp/LICENSE 7f7cc56311d298677f304d0ffce374d8

LICENSES/vendor/github.com/cenkalti/backoff/v5/LICENSE

@@ -1,4 +1,4 @@
-= vendor/github.com/cenkalti/backoff/v4 licensed under: =
+= vendor/github.com/cenkalti/backoff/v5 licensed under: =
 
 The MIT License (MIT)
 
@@ -21,4 +21,4 @@ COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER
 IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN
 CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
 
-= vendor/github.com/cenkalti/backoff/v4/LICENSE 1571d94433e3f3aa05267efd4dbea68b
+= vendor/github.com/cenkalti/backoff/v5/LICENSE 1571d94433e3f3aa05267efd4dbea68b

LICENSES/vendor/github.com/containerd/errdefs/pkg/LICENSE

@@ -0,0 +1,195 @@
+= vendor/github.com/containerd/errdefs/pkg licensed under: =
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        https://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   Copyright The containerd Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       https://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+= vendor/github.com/containerd/errdefs/LICENSE 1269f40c0d099c21a871163984590d89

LICENSES/vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSE

@@ -0,0 +1,206 @@
+= vendor/github.com/containerd/stargz-snapshotter/estargz licensed under: =
+
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+= vendor/github.com/containerd/stargz-snapshotter/estargz/LICENSE 3b83ef96387f14655fc854ddc3c6bd57

LICENSES/vendor/github.com/go-asn1-ber/asn1-ber/LICENSE

@@ -1,4 +1,4 @@
-= vendor/gopkg.in/asn1-ber.v1 licensed under: =
+= vendor/github.com/go-asn1-ber/asn1-ber licensed under: =
 
 The MIT License (MIT)
 
@@ -23,4 +23,4 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-= vendor/gopkg.in/asn1-ber.v1/LICENSE db7dfd3c609df968396fa379c3851eb5
+= vendor/github.com/go-asn1-ber/asn1-ber/LICENSE db7dfd3c609df968396fa379c3851eb5

LICENSES/vendor/github.com/go-ldap/ldap/v3/LICENSE

@@ -1,9 +1,9 @@
-= vendor/github.com/go-ldap/ldap licensed under: =
+= vendor/github.com/go-ldap/ldap/v3 licensed under: =
 
 The MIT License (MIT)
 
 Copyright (c) 2011-2015 Michael Mitton (mmitton@gmail.com)
-Portions copyright (c) 2015-2016 go-ldap Authors
+Portions copyright (c) 2015-2024 go-ldap Authors
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal
@@ -23,4 +23,4 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
-= vendor/github.com/go-ldap/ldap/LICENSE c3fcb38ec828f70d87d00a1c64cd9c2b
+= vendor/github.com/go-ldap/ldap/v3/LICENSE c7a6808207397b21163fe9167c375c09

LICENSES/vendor/github.com/go-viper/mapstructure/v2/LICENSE

@@ -0,0 +1,25 @@
+= vendor/github.com/go-viper/mapstructure/v2 licensed under: =
+
+The MIT License (MIT)
+
+Copyright (c) 2013 Mitchell Hashimoto
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+
+= vendor/github.com/go-viper/mapstructure/v2/LICENSE 3f7765c3d4f58e1f84c4313cecf0f5bd

LICENSES/vendor/github.com/gorilla/websocket/LICENSE

@@ -1,31 +1,26 @@
 = vendor/github.com/gorilla/websocket licensed under: =
 
-Copyright (c) 2023 The Gorilla Authors. All rights reserved.
+Copyright (c) 2013 The Gorilla WebSocket Authors. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
+modification, are permitted provided that the following conditions are met:
 
-	 * Redistributions of source code must retain the above copyright
-notice, this list of conditions and the following disclaimer.
-	 * Redistributions in binary form must reproduce the above
-copyright notice, this list of conditions and the following disclaimer
-in the documentation and/or other materials provided with the
-distribution.
-	 * Neither the name of Google Inc. nor the names of its
-contributors may be used to endorse or promote products derived from
-this software without specific prior written permission.
+  Redistributions of source code must retain the above copyright notice, this
+  list of conditions and the following disclaimer.
 
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+  Redistributions in binary form must reproduce the above copyright notice,
+  this list of conditions and the following disclaimer in the documentation
+  and/or other materials provided with the distribution.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-= vendor/github.com/gorilla/websocket/LICENSE c30eee78985cf2584cded5f89ba3d787
+= vendor/github.com/gorilla/websocket/LICENSE c007b54a1743d596f46b2748d9f8c044

LICENSES/vendor/github.com/hashicorp/golang-lru/LICENSE

@@ -1,368 +0,0 @@
-= vendor/github.com/hashicorp/golang-lru licensed under: =
-
-Copyright (c) 2014 HashiCorp, Inc.
-
-Mozilla Public License, version 2.0
-
-1. Definitions
-
-1.1. "Contributor"
-
-     means each individual or legal entity that creates, contributes to the
-     creation of, or owns Covered Software.
-
-1.2. "Contributor Version"
-
-     means the combination of the Contributions of others (if any) used by a
-     Contributor and that particular Contributor's Contribution.
-
-1.3. "Contribution"
-
-     means Covered Software of a particular Contributor.
-
-1.4. "Covered Software"
-
-     means Source Code Form to which the initial Contributor has attached the
-     notice in Exhibit A, the Executable Form of such Source Code Form, and
-     Modifications of such Source Code Form, in each case including portions
-     thereof.
-
-1.5. "Incompatible With Secondary Licenses"
-     means
-
-     a. that the initial Contributor has attached the notice described in
-        Exhibit B to the Covered Software; or
-
-     b. that the Covered Software was made available under the terms of
-        version 1.1 or earlier of the License, but not also under the terms of
-        a Secondary License.
-
-1.6. "Executable Form"
-
-     means any form of the work other than Source Code Form.
-
-1.7. "Larger Work"
-
-     means a work that combines Covered Software with other material, in a
-     separate file or files, that is not Covered Software.
-
-1.8. "License"
-
-     means this document.
-
-1.9. "Licensable"
-
-     means having the right to grant, to the maximum extent possible, whether
-     at the time of the initial grant or subsequently, any and all of the
-     rights conveyed by this License.
-
-1.10. "Modifications"
-
-     means any of the following:
-
-     a. any file in Source Code Form that results from an addition to,
-        deletion from, or modification of the contents of Covered Software; or
-
-     b. any new file in Source Code Form that contains any Covered Software.
-
-1.11. "Patent Claims" of a Contributor
-
-      means any patent claim(s), including without limitation, method,
-      process, and apparatus claims, in any patent Licensable by such
-      Contributor that would be infringed, but for the grant of the License,
-      by the making, using, selling, offering for sale, having made, import,
-      or transfer of either its Contributions or its Contributor Version.
-
-1.12. "Secondary License"
-
-      means either the GNU General Public License, Version 2.0, the GNU Lesser
-      General Public License, Version 2.1, the GNU Affero General Public
-      License, Version 3.0, or any later versions of those licenses.
-
-1.13. "Source Code Form"
-
-      means the form of the work preferred for making modifications.
-
-1.14. "You" (or "Your")
-
-      means an individual or a legal entity exercising rights under this
-      License. For legal entities, "You" includes any entity that controls, is
-      controlled by, or is under common control with You. For purposes of this
-      definition, "control" means (a) the power, direct or indirect, to cause
-      the direction or management of such entity, whether by contract or
-      otherwise, or (b) ownership of more than fifty percent (50%) of the
-      outstanding shares or beneficial ownership of such entity.
-
-
-2. License Grants and Conditions
-
-2.1. Grants
-
-     Each Contributor hereby grants You a world-wide, royalty-free,
-     non-exclusive license:
-
-     a. under intellectual property rights (other than patent or trademark)
-        Licensable by such Contributor to use, reproduce, make available,
-        modify, display, perform, distribute, and otherwise exploit its
-        Contributions, either on an unmodified basis, with Modifications, or
-        as part of a Larger Work; and
-
-     b. under Patent Claims of such Contributor to make, use, sell, offer for
-        sale, have made, import, and otherwise transfer either its
-        Contributions or its Contributor Version.
-
-2.2. Effective Date
-
-     The licenses granted in Section 2.1 with respect to any Contribution
-     become effective for each Contribution on the date the Contributor first
-     distributes such Contribution.
-
-2.3. Limitations on Grant Scope
-
-     The licenses granted in this Section 2 are the only rights granted under
-     this License. No additional rights or licenses will be implied from the
-     distribution or licensing of Covered Software under this License.
-     Notwithstanding Section 2.1(b) above, no patent license is granted by a
-     Contributor:
-
-     a. for any code that a Contributor has removed from Covered Software; or
-
-     b. for infringements caused by: (i) Your and any other third party's
-        modifications of Covered Software, or (ii) the combination of its
-        Contributions with other software (except as part of its Contributor
-        Version); or
-
-     c. under Patent Claims infringed by Covered Software in the absence of
-        its Contributions.
-
-     This License does not grant any rights in the trademarks, service marks,
-     or logos of any Contributor (except as may be necessary to comply with
-     the notice requirements in Section 3.4).
-
-2.4. Subsequent Licenses
-
-     No Contributor makes additional grants as a result of Your choice to
-     distribute the Covered Software under a subsequent version of this
-     License (see Section 10.2) or under the terms of a Secondary License (if
-     permitted under the terms of Section 3.3).
-
-2.5. Representation
-
-     Each Contributor represents that the Contributor believes its
-     Contributions are its original creation(s) or it has sufficient rights to
-     grant the rights to its Contributions conveyed by this License.
-
-2.6. Fair Use
-
-     This License is not intended to limit any rights You have under
-     applicable copyright doctrines of fair use, fair dealing, or other
-     equivalents.
-
-2.7. Conditions
-
-     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
-     Section 2.1.
-
-
-3. Responsibilities
-
-3.1. Distribution of Source Form
-
-     All distribution of Covered Software in Source Code Form, including any
-     Modifications that You create or to which You contribute, must be under
-     the terms of this License. You must inform recipients that the Source
-     Code Form of the Covered Software is governed by the terms of this
-     License, and how they can obtain a copy of this License. You may not
-     attempt to alter or restrict the recipients' rights in the Source Code
-     Form.
-
-3.2. Distribution of Executable Form
-
-     If You distribute Covered Software in Executable Form then:
-
-     a. such Covered Software must also be made available in Source Code Form,
-        as described in Section 3.1, and You must inform recipients of the
-        Executable Form how they can obtain a copy of such Source Code Form by
-        reasonable means in a timely manner, at a charge no more than the cost
-        of distribution to the recipient; and
-
-     b. You may distribute such Executable Form under the terms of this
-        License, or sublicense it under different terms, provided that the
-        license for the Executable Form does not attempt to limit or alter the
-        recipients' rights in the Source Code Form under this License.
-
-3.3. Distribution of a Larger Work
-
-     You may create and distribute a Larger Work under terms of Your choice,
-     provided that You also comply with the requirements of this License for
-     the Covered Software. If the Larger Work is a combination of Covered
-     Software with a work governed by one or more Secondary Licenses, and the
-     Covered Software is not Incompatible With Secondary Licenses, this
-     License permits You to additionally distribute such Covered Software
-     under the terms of such Secondary License(s), so that the recipient of
-     the Larger Work may, at their option, further distribute the Covered
-     Software under the terms of either this License or such Secondary
-     License(s).
-
-3.4. Notices
-
-     You may not remove or alter the substance of any license notices
-     (including copyright notices, patent notices, disclaimers of warranty, or
-     limitations of liability) contained within the Source Code Form of the
-     Covered Software, except that You may alter any license notices to the
-     extent required to remedy known factual inaccuracies.
-
-3.5. Application of Additional Terms
-
-     You may choose to offer, and to charge a fee for, warranty, support,
-     indemnity or liability obligations to one or more recipients of Covered
-     Software. However, You may do so only on Your own behalf, and not on
-     behalf of any Contributor. You must make it absolutely clear that any
-     such warranty, support, indemnity, or liability obligation is offered by
-     You alone, and You hereby agree to indemnify every Contributor for any
-     liability incurred by such Contributor as a result of warranty, support,
-     indemnity or liability terms You offer. You may include additional
-     disclaimers of warranty and limitations of liability specific to any
-     jurisdiction.
-
-4. Inability to Comply Due to Statute or Regulation
-
-   If it is impossible for You to comply with any of the terms of this License
-   with respect to some or all of the Covered Software due to statute,
-   judicial order, or regulation then You must: (a) comply with the terms of
-   this License to the maximum extent possible; and (b) describe the
-   limitations and the code they affect. Such description must be placed in a
-   text file included with all distributions of the Covered Software under
-   this License. Except to the extent prohibited by statute or regulation,
-   such description must be sufficiently detailed for a recipient of ordinary
-   skill to be able to understand it.
-
-5. Termination
-
-5.1. The rights granted under this License will terminate automatically if You
-     fail to comply with any of its terms. However, if You become compliant,
-     then the rights granted under this License from a particular Contributor
-     are reinstated (a) provisionally, unless and until such Contributor
-     explicitly and finally terminates Your grants, and (b) on an ongoing
-     basis, if such Contributor fails to notify You of the non-compliance by
-     some reasonable means prior to 60 days after You have come back into
-     compliance. Moreover, Your grants from a particular Contributor are
-     reinstated on an ongoing basis if such Contributor notifies You of the
-     non-compliance by some reasonable means, this is the first time You have
-     received notice of non-compliance with this License from such
-     Contributor, and You become compliant prior to 30 days after Your receipt
-     of the notice.
-
-5.2. If You initiate litigation against any entity by asserting a patent
-     infringement claim (excluding declaratory judgment actions,
-     counter-claims, and cross-claims) alleging that a Contributor Version
-     directly or indirectly infringes any patent, then the rights granted to
-     You by any and all Contributors for the Covered Software under Section
-     2.1 of this License shall terminate.
-
-5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
-     license agreements (excluding distributors and resellers) which have been
-     validly granted by You or Your distributors under this License prior to
-     termination shall survive termination.
-
-6. Disclaimer of Warranty
-
-   Covered Software is provided under this License on an "as is" basis,
-   without warranty of any kind, either expressed, implied, or statutory,
-   including, without limitation, warranties that the Covered Software is free
-   of defects, merchantable, fit for a particular purpose or non-infringing.
-   The entire risk as to the quality and performance of the Covered Software
-   is with You. Should any Covered Software prove defective in any respect,
-   You (not any Contributor) assume the cost of any necessary servicing,
-   repair, or correction. This disclaimer of warranty constitutes an essential
-   part of this License. No use of  any Covered Software is authorized under
-   this License except under this disclaimer.
-
-7. Limitation of Liability
-
-   Under no circumstances and under no legal theory, whether tort (including
-   negligence), contract, or otherwise, shall any Contributor, or anyone who
-   distributes Covered Software as permitted above, be liable to You for any
-   direct, indirect, special, incidental, or consequential damages of any
-   character including, without limitation, damages for lost profits, loss of
-   goodwill, work stoppage, computer failure or malfunction, or any and all
-   other commercial damages or losses, even if such party shall have been
-   informed of the possibility of such damages. This limitation of liability
-   shall not apply to liability for death or personal injury resulting from
-   such party's negligence to the extent applicable law prohibits such
-   limitation. Some jurisdictions do not allow the exclusion or limitation of
-   incidental or consequential damages, so this exclusion and limitation may
-   not apply to You.
-
-8. Litigation
-
-   Any litigation relating to this License may be brought only in the courts
-   of a jurisdiction where the defendant maintains its principal place of
-   business and such litigation shall be governed by laws of that
-   jurisdiction, without reference to its conflict-of-law provisions. Nothing
-   in this Section shall prevent a party's ability to bring cross-claims or
-   counter-claims.
-
-9. Miscellaneous
-
-   This License represents the complete agreement concerning the subject
-   matter hereof. If any provision of this License is held to be
-   unenforceable, such provision shall be reformed only to the extent
-   necessary to make it enforceable. Any law or regulation which provides that
-   the language of a contract shall be construed against the drafter shall not
-   be used to construe this License against a Contributor.
-
-
-10. Versions of the License
-
-10.1. New Versions
-
-      Mozilla Foundation is the license steward. Except as provided in Section
-      10.3, no one other than the license steward has the right to modify or
-      publish new versions of this License. Each version will be given a
-      distinguishing version number.
-
-10.2. Effect of New Versions
-
-      You may distribute the Covered Software under the terms of the version
-      of the License under which You originally received the Covered Software,
-      or under the terms of any subsequent version published by the license
-      steward.
-
-10.3. Modified Versions
-
-      If you create software not governed by this License, and you want to
-      create a new license for such software, you may create and use a
-      modified version of this License if you rename the license and remove
-      any references to the name of the license steward (except to note that
-      such modified license differs from this License).
-
-10.4. Distributing Source Code Form that is Incompatible With Secondary
-      Licenses If You choose to distribute Source Code Form that is
-      Incompatible With Secondary Licenses under the terms of this version of
-      the License, the notice described in Exhibit B of this License must be
-      attached.
-
-Exhibit A - Source Code Form License Notice
-
-      This Source Code Form is subject to the
-      terms of the Mozilla Public License, v.
-      2.0. If a copy of the MPL was not
-      distributed with this file, You can
-      obtain one at
-      http://mozilla.org/MPL/2.0/.
-
-If it is not possible or desirable to put the notice in a particular file,
-then You may include the notice in a location (such as a LICENSE file in a
-relevant directory) where a recipient would be likely to look for such a
-notice.
-
-You may add additional accurate notices of copyright ownership.
-
-Exhibit B - "Incompatible With Secondary Licenses" Notice
-
-      This Source Code Form is "Incompatible
-      With Secondary Licenses", as defined by
-      the Mozilla Public License, v. 2.0.
-
-= vendor/github.com/hashicorp/golang-lru/LICENSE dc2f3ee49116a594755b22b853cc8b6b

LICENSES/vendor/github.com/hashicorp/hcl/LICENSE

@@ -1,358 +0,0 @@
-= vendor/github.com/hashicorp/hcl licensed under: =
-
-Mozilla Public License, version 2.0
-
-1. Definitions
-
-1.1. “Contributor”
-
-     means each individual or legal entity that creates, contributes to the
-     creation of, or owns Covered Software.
-
-1.2. “Contributor Version”
-
-     means the combination of the Contributions of others (if any) used by a
-     Contributor and that particular Contributor’s Contribution.
-
-1.3. “Contribution”
-
-     means Covered Software of a particular Contributor.
-
-1.4. “Covered Software”
-
-     means Source Code Form to which the initial Contributor has attached the
-     notice in Exhibit A, the Executable Form of such Source Code Form, and
-     Modifications of such Source Code Form, in each case including portions
-     thereof.
-
-1.5. “Incompatible With Secondary Licenses”
-     means
-
-     a. that the initial Contributor has attached the notice described in
-        Exhibit B to the Covered Software; or
-
-     b. that the Covered Software was made available under the terms of version
-        1.1 or earlier of the License, but not also under the terms of a
-        Secondary License.
-
-1.6. “Executable Form”
-
-     means any form of the work other than Source Code Form.
-
-1.7. “Larger Work”
-
-     means a work that combines Covered Software with other material, in a separate
-     file or files, that is not Covered Software.
-
-1.8. “License”
-
-     means this document.
-
-1.9. “Licensable”
-
-     means having the right to grant, to the maximum extent possible, whether at the
-     time of the initial grant or subsequently, any and all of the rights conveyed by
-     this License.
-
-1.10. “Modifications”
-
-     means any of the following:
-
-     a. any file in Source Code Form that results from an addition to, deletion
-        from, or modification of the contents of Covered Software; or
-
-     b. any new file in Source Code Form that contains any Covered Software.
-
-1.11. “Patent Claims” of a Contributor
-
-      means any patent claim(s), including without limitation, method, process,
-      and apparatus claims, in any patent Licensable by such Contributor that
-      would be infringed, but for the grant of the License, by the making,
-      using, selling, offering for sale, having made, import, or transfer of
-      either its Contributions or its Contributor Version.
-
-1.12. “Secondary License”
-
-      means either the GNU General Public License, Version 2.0, the GNU Lesser
-      General Public License, Version 2.1, the GNU Affero General Public
-      License, Version 3.0, or any later versions of those licenses.
-
-1.13. “Source Code Form”
-
-      means the form of the work preferred for making modifications.
-
-1.14. “You” (or “Your”)
-
-      means an individual or a legal entity exercising rights under this
-      License. For legal entities, “You” includes any entity that controls, is
-      controlled by, or is under common control with You. For purposes of this
-      definition, “control” means (a) the power, direct or indirect, to cause
-      the direction or management of such entity, whether by contract or
-      otherwise, or (b) ownership of more than fifty percent (50%) of the
-      outstanding shares or beneficial ownership of such entity.
-
-
-2. License Grants and Conditions
-
-2.1. Grants
-
-     Each Contributor hereby grants You a world-wide, royalty-free,
-     non-exclusive license:
-
-     a. under intellectual property rights (other than patent or trademark)
-        Licensable by such Contributor to use, reproduce, make available,
-        modify, display, perform, distribute, and otherwise exploit its
-        Contributions, either on an unmodified basis, with Modifications, or as
-        part of a Larger Work; and
-
-     b. under Patent Claims of such Contributor to make, use, sell, offer for
-        sale, have made, import, and otherwise transfer either its Contributions
-        or its Contributor Version.
-
-2.2. Effective Date
-
-     The licenses granted in Section 2.1 with respect to any Contribution become
-     effective for each Contribution on the date the Contributor first distributes
-     such Contribution.
-
-2.3. Limitations on Grant Scope
-
-     The licenses granted in this Section 2 are the only rights granted under this
-     License. No additional rights or licenses will be implied from the distribution
-     or licensing of Covered Software under this License. Notwithstanding Section
-     2.1(b) above, no patent license is granted by a Contributor:
-
-     a. for any code that a Contributor has removed from Covered Software; or
-
-     b. for infringements caused by: (i) Your and any other third party’s
-        modifications of Covered Software, or (ii) the combination of its
-        Contributions with other software (except as part of its Contributor
-        Version); or
-
-     c. under Patent Claims infringed by Covered Software in the absence of its
-        Contributions.
-
-     This License does not grant any rights in the trademarks, service marks, or
-     logos of any Contributor (except as may be necessary to comply with the
-     notice requirements in Section 3.4).
-
-2.4. Subsequent Licenses
-
-     No Contributor makes additional grants as a result of Your choice to
-     distribute the Covered Software under a subsequent version of this License
-     (see Section 10.2) or under the terms of a Secondary License (if permitted
-     under the terms of Section 3.3).
-
-2.5. Representation
-
-     Each Contributor represents that the Contributor believes its Contributions
-     are its original creation(s) or it has sufficient rights to grant the
-     rights to its Contributions conveyed by this License.
-
-2.6. Fair Use
-
-     This License is not intended to limit any rights You have under applicable
-     copyright doctrines of fair use, fair dealing, or other equivalents.
-
-2.7. Conditions
-
-     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
-     Section 2.1.
-
-
-3. Responsibilities
-
-3.1. Distribution of Source Form
-
-     All distribution of Covered Software in Source Code Form, including any
-     Modifications that You create or to which You contribute, must be under the
-     terms of this License. You must inform recipients that the Source Code Form
-     of the Covered Software is governed by the terms of this License, and how
-     they can obtain a copy of this License. You may not attempt to alter or
-     restrict the recipients’ rights in the Source Code Form.
-
-3.2. Distribution of Executable Form
-
-     If You distribute Covered Software in Executable Form then:
-
-     a. such Covered Software must also be made available in Source Code Form,
-        as described in Section 3.1, and You must inform recipients of the
-        Executable Form how they can obtain a copy of such Source Code Form by
-        reasonable means in a timely manner, at a charge no more than the cost
-        of distribution to the recipient; and
-
-     b. You may distribute such Executable Form under the terms of this License,
-        or sublicense it under different terms, provided that the license for
-        the Executable Form does not attempt to limit or alter the recipients’
-        rights in the Source Code Form under this License.
-
-3.3. Distribution of a Larger Work
-
-     You may create and distribute a Larger Work under terms of Your choice,
-     provided that You also comply with the requirements of this License for the
-     Covered Software. If the Larger Work is a combination of Covered Software
-     with a work governed by one or more Secondary Licenses, and the Covered
-     Software is not Incompatible With Secondary Licenses, this License permits
-     You to additionally distribute such Covered Software under the terms of
-     such Secondary License(s), so that the recipient of the Larger Work may, at
-     their option, further distribute the Covered Software under the terms of
-     either this License or such Secondary License(s).
-
-3.4. Notices
-
-     You may not remove or alter the substance of any license notices (including
-     copyright notices, patent notices, disclaimers of warranty, or limitations
-     of liability) contained within the Source Code Form of the Covered
-     Software, except that You may alter any license notices to the extent
-     required to remedy known factual inaccuracies.
-
-3.5. Application of Additional Terms
-
-     You may choose to offer, and to charge a fee for, warranty, support,
-     indemnity or liability obligations to one or more recipients of Covered
-     Software. However, You may do so only on Your own behalf, and not on behalf
-     of any Contributor. You must make it absolutely clear that any such
-     warranty, support, indemnity, or liability obligation is offered by You
-     alone, and You hereby agree to indemnify every Contributor for any
-     liability incurred by such Contributor as a result of warranty, support,
-     indemnity or liability terms You offer. You may include additional
-     disclaimers of warranty and limitations of liability specific to any
-     jurisdiction.
-
-4. Inability to Comply Due to Statute or Regulation
-
-   If it is impossible for You to comply with any of the terms of this License
-   with respect to some or all of the Covered Software due to statute, judicial
-   order, or regulation then You must: (a) comply with the terms of this License
-   to the maximum extent possible; and (b) describe the limitations and the code
-   they affect. Such description must be placed in a text file included with all
-   distributions of the Covered Software under this License. Except to the
-   extent prohibited by statute or regulation, such description must be
-   sufficiently detailed for a recipient of ordinary skill to be able to
-   understand it.
-
-5. Termination
-
-5.1. The rights granted under this License will terminate automatically if You
-     fail to comply with any of its terms. However, if You become compliant,
-     then the rights granted under this License from a particular Contributor
-     are reinstated (a) provisionally, unless and until such Contributor
-     explicitly and finally terminates Your grants, and (b) on an ongoing basis,
-     if such Contributor fails to notify You of the non-compliance by some
-     reasonable means prior to 60 days after You have come back into compliance.
-     Moreover, Your grants from a particular Contributor are reinstated on an
-     ongoing basis if such Contributor notifies You of the non-compliance by
-     some reasonable means, this is the first time You have received notice of
-     non-compliance with this License from such Contributor, and You become
-     compliant prior to 30 days after Your receipt of the notice.
-
-5.2. If You initiate litigation against any entity by asserting a patent
-     infringement claim (excluding declaratory judgment actions, counter-claims,
-     and cross-claims) alleging that a Contributor Version directly or
-     indirectly infringes any patent, then the rights granted to You by any and
-     all Contributors for the Covered Software under Section 2.1 of this License
-     shall terminate.
-
-5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
-     license agreements (excluding distributors and resellers) which have been
-     validly granted by You or Your distributors under this License prior to
-     termination shall survive termination.
-
-6. Disclaimer of Warranty
-
-   Covered Software is provided under this License on an “as is” basis, without
-   warranty of any kind, either expressed, implied, or statutory, including,
-   without limitation, warranties that the Covered Software is free of defects,
-   merchantable, fit for a particular purpose or non-infringing. The entire
-   risk as to the quality and performance of the Covered Software is with You.
-   Should any Covered Software prove defective in any respect, You (not any
-   Contributor) assume the cost of any necessary servicing, repair, or
-   correction. This disclaimer of warranty constitutes an essential part of this
-   License. No use of  any Covered Software is authorized under this License
-   except under this disclaimer.
-
-7. Limitation of Liability
-
-   Under no circumstances and under no legal theory, whether tort (including
-   negligence), contract, or otherwise, shall any Contributor, or anyone who
-   distributes Covered Software as permitted above, be liable to You for any
-   direct, indirect, special, incidental, or consequential damages of any
-   character including, without limitation, damages for lost profits, loss of
-   goodwill, work stoppage, computer failure or malfunction, or any and all
-   other commercial damages or losses, even if such party shall have been
-   informed of the possibility of such damages. This limitation of liability
-   shall not apply to liability for death or personal injury resulting from such
-   party’s negligence to the extent applicable law prohibits such limitation.
-   Some jurisdictions do not allow the exclusion or limitation of incidental or
-   consequential damages, so this exclusion and limitation may not apply to You.
-
-8. Litigation
-
-   Any litigation relating to this License may be brought only in the courts of
-   a jurisdiction where the defendant maintains its principal place of business
-   and such litigation shall be governed by laws of that jurisdiction, without
-   reference to its conflict-of-law provisions. Nothing in this Section shall
-   prevent a party’s ability to bring cross-claims or counter-claims.
-
-9. Miscellaneous
-
-   This License represents the complete agreement concerning the subject matter
-   hereof. If any provision of this License is held to be unenforceable, such
-   provision shall be reformed only to the extent necessary to make it
-   enforceable. Any law or regulation which provides that the language of a
-   contract shall be construed against the drafter shall not be used to construe
-   this License against a Contributor.
-
-
-10. Versions of the License
-
-10.1. New Versions
-
-      Mozilla Foundation is the license steward. Except as provided in Section
-      10.3, no one other than the license steward has the right to modify or
-      publish new versions of this License. Each version will be given a
-      distinguishing version number.
-
-10.2. Effect of New Versions
-
-      You may distribute the Covered Software under the terms of the version of
-      the License under which You originally received the Covered Software, or
-      under the terms of any subsequent version published by the license
-      steward.
-
-10.3. Modified Versions
-
-      If you create software not governed by this License, and you want to
-      create a new license for such software, you may create and use a modified
-      version of this License if you rename the license and remove any
-      references to the name of the license steward (except to note that such
-      modified license differs from this License).
-
-10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
-      If You choose to distribute Source Code Form that is Incompatible With
-      Secondary Licenses under the terms of this version of the License, the
-      notice described in Exhibit B of this License must be attached.
-
-Exhibit A - Source Code Form License Notice
-
-      This Source Code Form is subject to the
-      terms of the Mozilla Public License, v.
-      2.0. If a copy of the MPL was not
-      distributed with this file, You can
-      obtain one at
-      http://mozilla.org/MPL/2.0/.
-
-If it is not possible or desirable to put the notice in a particular file, then
-You may include the notice in a location (such as a LICENSE file in a relevant
-directory) where a recipient would be likely to look for such a notice.
-
-You may add additional accurate notices of copyright ownership.
-
-Exhibit B - “Incompatible With Secondary Licenses” Notice
-
-      This Source Code Form is “Incompatible
-      With Secondary Licenses”, as defined by
-      the Mozilla Public License, v. 2.0.
-
-
-= vendor/github.com/hashicorp/hcl/LICENSE b278a92d2c1509760384428817710378

LICENSES/vendor/github.com/magiconair/properties/LICENSE

@@ -1,28 +0,0 @@
-= vendor/github.com/magiconair/properties licensed under: =
-
-Copyright (c) 2013-2020, Frank Schroeder
-
-All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are met:
-
- * Redistributions of source code must retain the above copyright notice, this
-   list of conditions and the following disclaimer.
-
- * Redistributions in binary form must reproduce the above copyright notice,
-   this list of conditions and the following disclaimer in the documentation
-   and/or other materials provided with the distribution.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
-ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
-WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
-DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR
-ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
-(INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
-LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND
-ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
-SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-= vendor/github.com/magiconair/properties/LICENSE.md 714beb7325ffa89d5a68d936a3bb04e5

LICENSES/vendor/github.com/pjbgf/sha1cd/LICENSE

@@ -188,7 +188,7 @@
       same "printed page" as the copyright notice for easier
       identification within third-party archives.
 
-   Copyright [yyyy] [name of copyright owner]
+   Copyright 2023 pjbgf
 
    Licensed under the Apache License, Version 2.0 (the "License");
    you may not use this file except in compliance with the License.
@@ -202,4 +202,4 @@
    See the License for the specific language governing permissions and
    limitations under the License.
 
-= vendor/github.com/pjbgf/sha1cd/LICENSE 86d3f3a95c324c9479bd8986968f4327
+= vendor/github.com/pjbgf/sha1cd/LICENSE f7d808645abc302dd11f3fb43c14e119

LICENSES/vendor/github.com/rivo/uniseg/LICENSE

@@ -0,0 +1,25 @@
+= vendor/github.com/rivo/uniseg licensed under: =
+
+MIT License
+
+Copyright (c) 2019 Oliver Kuederle
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.
+
+= vendor/github.com/rivo/uniseg/LICENSE.txt 4393c339bf180cf6e188b6ea32d8b93c

LICENSES/vendor/github.com/vbatts/tar-split/LICENSE

@@ -0,0 +1,32 @@
+= vendor/github.com/vbatts/tar-split licensed under: =
+
+Copyright (c) 2015 Vincent Batts, Raleigh, NC, USA
+
+All rights reserved.
+
+Redistribution and use in source and binary forms, with or without
+modification, are permitted provided that the following conditions are met:
+
+1. Redistributions of source code must retain the above copyright notice, this
+list of conditions and the following disclaimer.
+
+2. Redistributions in binary form must reproduce the above copyright notice,
+this list of conditions and the following disclaimer in the documentation
+and/or other materials provided with the distribution.
+
+3. Neither the name of the copyright holder nor the names of its contributors
+may be used to endorse or promote products derived from this software without
+specific prior written permission.
+
+THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
+ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE
+FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
+SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
+CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
+OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+= vendor/github.com/vbatts/tar-split/LICENSE 19cd0ecd0a6c26052aec628b72e72881

LICENSES/vendor/go.opentelemetry.io/auto/sdk/LICENSE

@@ -0,0 +1,205 @@
+= vendor/go.opentelemetry.io/auto/sdk licensed under: =
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright [yyyy] [name of copyright owner]
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+= vendor/go.opentelemetry.io/auto/sdk/LICENSE 86d3f3a95c324c9479bd8986968f4327

LICENSES/vendor/go.starlark.net/LICENSE

@@ -1,33 +0,0 @@
-= vendor/go.starlark.net licensed under: =
-
-Copyright (c) 2017 The Bazel Authors.  All rights reserved.
-
-Redistribution and use in source and binary forms, with or without
-modification, are permitted provided that the following conditions are
-met:
-
-1. Redistributions of source code must retain the above copyright
-   notice, this list of conditions and the following disclaimer.
-
-2. Redistributions in binary form must reproduce the above copyright
-   notice, this list of conditions and the following disclaimer in the
-   documentation and/or other materials provided with the
-   distribution.
-
-3. Neither the name of the copyright holder nor the names of its
-   contributors may be used to endorse or promote products derived
-   from this software without specific prior written permission.
-
-THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-"AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-(INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-= vendor/go.starlark.net/LICENSE 30237ff6085f287d7c65ec084235a89e

LICENSES/vendor/go.uber.org/automaxprocs/LICENSE

@@ -0,0 +1,22 @@
+= vendor/go.uber.org/automaxprocs licensed under: =
+
+Copyright (c) 2017 Uber Technologies, Inc.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in
+all copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+THE SOFTWARE.
+= vendor/go.uber.org/automaxprocs/LICENSE 513f1cf32c6e4e3236a335fa13bb1c89

LICENSES/vendor/go.uber.org/zap/LICENSE

@@ -20,4 +20,4 @@ LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 THE SOFTWARE.
 
-= vendor/go.uber.org/zap/LICENSE.txt 5e8153e456a82529ea845e0d511abb69
+= vendor/go.uber.org/zap/LICENSE 5e8153e456a82529ea845e0d511abb69

LICENSES/vendor/golang.org/x/oauth2/LICENSE

@@ -1,6 +1,6 @@
 = vendor/golang.org/x/oauth2 licensed under: =
 
-Copyright (c) 2009 The Go Authors. All rights reserved.
+Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -12,7 +12,7 @@ notice, this list of conditions and the following disclaimer.
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
-   * Neither the name of Google Inc. nor the names of its
+   * Neither the name of Google LLC nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 
@@ -28,4 +28,4 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-= vendor/golang.org/x/oauth2/LICENSE 5d4950ecb7b26d2c5e4e7b4e0dd74707
+= vendor/golang.org/x/oauth2/LICENSE 7998cb338f82d15c0eff93b7004d272a

LICENSES/vendor/golang.org/x/sync/LICENSE

@@ -1,6 +1,6 @@
 = vendor/golang.org/x/sync licensed under: =
 
-Copyright (c) 2009 The Go Authors. All rights reserved.
+Copyright 2009 The Go Authors.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -12,7 +12,7 @@ notice, this list of conditions and the following disclaimer.
 copyright notice, this list of conditions and the following disclaimer
 in the documentation and/or other materials provided with the
 distribution.
-   * Neither the name of Google Inc. nor the names of its
+   * Neither the name of Google LLC nor the names of its
 contributors may be used to endorse or promote products derived from
 this software without specific prior written permission.
 
@@ -28,4 +28,4 @@ THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-= vendor/golang.org/x/sync/LICENSE 5d4950ecb7b26d2c5e4e7b4e0dd74707
+= vendor/golang.org/x/sync/LICENSE 7998cb338f82d15c0eff93b7004d272a

LICENSES/vendor/gopkg.in/ini.v1/LICENSE

@@ -1,195 +0,0 @@
-= vendor/gopkg.in/ini.v1 licensed under: =
-
-Apache License
-Version 2.0, January 2004
-http://www.apache.org/licenses/
-
-TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-1. Definitions.
-
-"License" shall mean the terms and conditions for use, reproduction, and
-distribution as defined by Sections 1 through 9 of this document.
-
-"Licensor" shall mean the copyright owner or entity authorized by the copyright
-owner that is granting the License.
-
-"Legal Entity" shall mean the union of the acting entity and all other entities
-that control, are controlled by, or are under common control with that entity.
-For the purposes of this definition, "control" means (i) the power, direct or
-indirect, to cause the direction or management of such entity, whether by
-contract or otherwise, or (ii) ownership of fifty percent (50%) or more of the
-outstanding shares, or (iii) beneficial ownership of such entity.
-
-"You" (or "Your") shall mean an individual or Legal Entity exercising
-permissions granted by this License.
-
-"Source" form shall mean the preferred form for making modifications, including
-but not limited to software source code, documentation source, and configuration
-files.
-
-"Object" form shall mean any form resulting from mechanical transformation or
-translation of a Source form, including but not limited to compiled object code,
-generated documentation, and conversions to other media types.
-
-"Work" shall mean the work of authorship, whether in Source or Object form, made
-available under the License, as indicated by a copyright notice that is included
-in or attached to the work (an example is provided in the Appendix below).
-
-"Derivative Works" shall mean any work, whether in Source or Object form, that
-is based on (or derived from) the Work and for which the editorial revisions,
-annotations, elaborations, or other modifications represent, as a whole, an
-original work of authorship. For the purposes of this License, Derivative Works
-shall not include works that remain separable from, or merely link (or bind by
-name) to the interfaces of, the Work and Derivative Works thereof.
-
-"Contribution" shall mean any work of authorship, including the original version
-of the Work and any modifications or additions to that Work or Derivative Works
-thereof, that is intentionally submitted to Licensor for inclusion in the Work
-by the copyright owner or by an individual or Legal Entity authorized to submit
-on behalf of the copyright owner. For the purposes of this definition,
-"submitted" means any form of electronic, verbal, or written communication sent
-to the Licensor or its representatives, including but not limited to
-communication on electronic mailing lists, source code control systems, and
-issue tracking systems that are managed by, or on behalf of, the Licensor for
-the purpose of discussing and improving the Work, but excluding communication
-that is conspicuously marked or otherwise designated in writing by the copyright
-owner as "Not a Contribution."
-
-"Contributor" shall mean Licensor and any individual or Legal Entity on behalf
-of whom a Contribution has been received by Licensor and subsequently
-incorporated within the Work.
-
-2. Grant of Copyright License.
-
-Subject to the terms and conditions of this License, each Contributor hereby
-grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
-irrevocable copyright license to reproduce, prepare Derivative Works of,
-publicly display, publicly perform, sublicense, and distribute the Work and such
-Derivative Works in Source or Object form.
-
-3. Grant of Patent License.
-
-Subject to the terms and conditions of this License, each Contributor hereby
-grants to You a perpetual, worldwide, non-exclusive, no-charge, royalty-free,
-irrevocable (except as stated in this section) patent license to make, have
-made, use, offer to sell, sell, import, and otherwise transfer the Work, where
-such license applies only to those patent claims licensable by such Contributor
-that are necessarily infringed by their Contribution(s) alone or by combination
-of their Contribution(s) with the Work to which such Contribution(s) was
-submitted. If You institute patent litigation against any entity (including a
-cross-claim or counterclaim in a lawsuit) alleging that the Work or a
-Contribution incorporated within the Work constitutes direct or contributory
-patent infringement, then any patent licenses granted to You under this License
-for that Work shall terminate as of the date such litigation is filed.
-
-4. Redistribution.
-
-You may reproduce and distribute copies of the Work or Derivative Works thereof
-in any medium, with or without modifications, and in Source or Object form,
-provided that You meet the following conditions:
-
-You must give any other recipients of the Work or Derivative Works a copy of
-this License; and
-You must cause any modified files to carry prominent notices stating that You
-changed the files; and
-You must retain, in the Source form of any Derivative Works that You distribute,
-all copyright, patent, trademark, and attribution notices from the Source form
-of the Work, excluding those notices that do not pertain to any part of the
-Derivative Works; and
-If the Work includes a "NOTICE" text file as part of its distribution, then any
-Derivative Works that You distribute must include a readable copy of the
-attribution notices contained within such NOTICE file, excluding those notices
-that do not pertain to any part of the Derivative Works, in at least one of the
-following places: within a NOTICE text file distributed as part of the
-Derivative Works; within the Source form or documentation, if provided along
-with the Derivative Works; or, within a display generated by the Derivative
-Works, if and wherever such third-party notices normally appear. The contents of
-the NOTICE file are for informational purposes only and do not modify the
-License. You may add Your own attribution notices within Derivative Works that
-You distribute, alongside or as an addendum to the NOTICE text from the Work,
-provided that such additional attribution notices cannot be construed as
-modifying the License.
-You may add Your own copyright statement to Your modifications and may provide
-additional or different license terms and conditions for use, reproduction, or
-distribution of Your modifications, or for any such Derivative Works as a whole,
-provided Your use, reproduction, and distribution of the Work otherwise complies
-with the conditions stated in this License.
-
-5. Submission of Contributions.
-
-Unless You explicitly state otherwise, any Contribution intentionally submitted
-for inclusion in the Work by You to the Licensor shall be under the terms and
-conditions of this License, without any additional terms or conditions.
-Notwithstanding the above, nothing herein shall supersede or modify the terms of
-any separate license agreement you may have executed with Licensor regarding
-such Contributions.
-
-6. Trademarks.
-
-This License does not grant permission to use the trade names, trademarks,
-service marks, or product names of the Licensor, except as required for
-reasonable and customary use in describing the origin of the Work and
-reproducing the content of the NOTICE file.
-
-7. Disclaimer of Warranty.
-
-Unless required by applicable law or agreed to in writing, Licensor provides the
-Work (and each Contributor provides its Contributions) on an "AS IS" BASIS,
-WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied,
-including, without limitation, any warranties or conditions of TITLE,
-NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. You are
-solely responsible for determining the appropriateness of using or
-redistributing the Work and assume any risks associated with Your exercise of
-permissions under this License.
-
-8. Limitation of Liability.
-
-In no event and under no legal theory, whether in tort (including negligence),
-contract, or otherwise, unless required by applicable law (such as deliberate
-and grossly negligent acts) or agreed to in writing, shall any Contributor be
-liable to You for damages, including any direct, indirect, special, incidental,
-or consequential damages of any character arising as a result of this License or
-out of the use or inability to use the Work (including but not limited to
-damages for loss of goodwill, work stoppage, computer failure or malfunction, or
-any and all other commercial damages or losses), even if such Contributor has
-been advised of the possibility of such damages.
-
-9. Accepting Warranty or Additional Liability.
-
-While redistributing the Work or Derivative Works thereof, You may choose to
-offer, and charge a fee for, acceptance of support, warranty, indemnity, or
-other liability obligations and/or rights consistent with this License. However,
-in accepting such obligations, You may act only on Your own behalf and on Your
-sole responsibility, not on behalf of any other Contributor, and only if You
-agree to indemnify, defend, and hold each Contributor harmless for any liability
-incurred by, or claims asserted against, such Contributor by reason of your
-accepting any such warranty or additional liability.
-
-END OF TERMS AND CONDITIONS
-
-APPENDIX: How to apply the Apache License to your work
-
-To apply the Apache License to your work, attach the following boilerplate
-notice, with the fields enclosed by brackets "[]" replaced with your own
-identifying information. (Don't include the brackets!) The text should be
-enclosed in the appropriate comment syntax for the file format. We also
-recommend that a file or class name and description of purpose be included on
-the same "printed page" as the copyright notice for easier identification within
-third-party archives.
-
-   Copyright 2014 Unknwon
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-     http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-   See the License for the specific language governing permissions and
-   limitations under the License.
-
-= vendor/gopkg.in/ini.v1/LICENSE 4e2a8d8f9935d6a766a5879a77ddc24d

LICENSES/vendor/k8s.io/client-go/third_party/forked/golang/LICENSE

@@ -1,5 +1,3 @@
-= vendor/github.com/sagikazarmark/slog-shim licensed under: =
-
 Copyright (c) 2009 The Go Authors. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
@@ -27,5 +25,3 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-= vendor/github.com/sagikazarmark/slog-shim/LICENSE 5d4950ecb7b26d2c5e4e7b4e0dd74707

LICENSES/vendor/k8s.io/kube-openapi/pkg/internal/third_party/go-json-experiment/json/LICENSE

@@ -1,7 +1,4 @@
-= vendor/github.com/imdario/mergo licensed under: =
-
-Copyright (c) 2013 Dario Castañé. All rights reserved.
-Copyright (c) 2012 The Go Authors. All rights reserved.
+Copyright (c) 2020 The Go Authors. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without
 modification, are permitted provided that the following conditions are
@@ -28,5 +25,3 @@ DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
 THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-= vendor/github.com/imdario/mergo/LICENSE ff13e03bb57bf9c52645f2f942afa28b

LICENSES/vendor/k8s.io/kube-openapi/pkg/internal/third_party/govalidator/LICENSE

@@ -0,0 +1,21 @@
+The MIT License (MIT)
+
+Copyright (c) 2014 Alex Saskevich
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

LICENSES/vendor/k8s.io/utils/internal/third_party/forked/golang/LICENSE

@@ -1,4 +1,3 @@
-Copyright (c) 2013 Dario Castañé. All rights reserved.
 Copyright (c) 2012 The Go Authors. All rights reserved.
 
 Redistribution and use in source and binary forms, with or without

LICENSES/vendor/oras.land/oras-go/v2/LICENSE

@@ -0,0 +1,205 @@
+= vendor/oras.land/oras-go/v2 licensed under: =
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "[]"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2021 ORAS Authors.
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+= vendor/oras.land/oras-go/LICENSE 019fcb726ce54798fc2e56a02520dae8

LICENSES/vendor/sigs.k8s.io/randfill/LICENSE

@@ -0,0 +1,206 @@
+= vendor/sigs.k8s.io/randfill licensed under: =
+
+                                 Apache License
+                           Version 2.0, January 2004
+                        http://www.apache.org/licenses/
+
+   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
+
+   1. Definitions.
+
+      "License" shall mean the terms and conditions for use, reproduction,
+      and distribution as defined by Sections 1 through 9 of this document.
+
+      "Licensor" shall mean the copyright owner or entity authorized by
+      the copyright owner that is granting the License.
+
+      "Legal Entity" shall mean the union of the acting entity and all
+      other entities that control, are controlled by, or are under common
+      control with that entity. For the purposes of this definition,
+      "control" means (i) the power, direct or indirect, to cause the
+      direction or management of such entity, whether by contract or
+      otherwise, or (ii) ownership of fifty percent (50%) or more of the
+      outstanding shares, or (iii) beneficial ownership of such entity.
+
+      "You" (or "Your") shall mean an individual or Legal Entity
+      exercising permissions granted by this License.
+
+      "Source" form shall mean the preferred form for making modifications,
+      including but not limited to software source code, documentation
+      source, and configuration files.
+
+      "Object" form shall mean any form resulting from mechanical
+      transformation or translation of a Source form, including but
+      not limited to compiled object code, generated documentation,
+      and conversions to other media types.
+
+      "Work" shall mean the work of authorship, whether in Source or
+      Object form, made available under the License, as indicated by a
+      copyright notice that is included in or attached to the work
+      (an example is provided in the Appendix below).
+
+      "Derivative Works" shall mean any work, whether in Source or Object
+      form, that is based on (or derived from) the Work and for which the
+      editorial revisions, annotations, elaborations, or other modifications
+      represent, as a whole, an original work of authorship. For the purposes
+      of this License, Derivative Works shall not include works that remain
+      separable from, or merely link (or bind by name) to the interfaces of,
+      the Work and Derivative Works thereof.
+
+      "Contribution" shall mean any work of authorship, including
+      the original version of the Work and any modifications or additions
+      to that Work or Derivative Works thereof, that is intentionally
+      submitted to Licensor for inclusion in the Work by the copyright owner
+      or by an individual or Legal Entity authorized to submit on behalf of
+      the copyright owner. For the purposes of this definition, "submitted"
+      means any form of electronic, verbal, or written communication sent
+      to the Licensor or its representatives, including but not limited to
+      communication on electronic mailing lists, source code control systems,
+      and issue tracking systems that are managed by, or on behalf of, the
+      Licensor for the purpose of discussing and improving the Work, but
+      excluding communication that is conspicuously marked or otherwise
+      designated in writing by the copyright owner as "Not a Contribution."
+
+      "Contributor" shall mean Licensor and any individual or Legal Entity
+      on behalf of whom a Contribution has been received by Licensor and
+      subsequently incorporated within the Work.
+
+   2. Grant of Copyright License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      copyright license to reproduce, prepare Derivative Works of,
+      publicly display, publicly perform, sublicense, and distribute the
+      Work and such Derivative Works in Source or Object form.
+
+   3. Grant of Patent License. Subject to the terms and conditions of
+      this License, each Contributor hereby grants to You a perpetual,
+      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
+      (except as stated in this section) patent license to make, have made,
+      use, offer to sell, sell, import, and otherwise transfer the Work,
+      where such license applies only to those patent claims licensable
+      by such Contributor that are necessarily infringed by their
+      Contribution(s) alone or by combination of their Contribution(s)
+      with the Work to which such Contribution(s) was submitted. If You
+      institute patent litigation against any entity (including a
+      cross-claim or counterclaim in a lawsuit) alleging that the Work
+      or a Contribution incorporated within the Work constitutes direct
+      or contributory patent infringement, then any patent licenses
+      granted to You under this License for that Work shall terminate
+      as of the date such litigation is filed.
+
+   4. Redistribution. You may reproduce and distribute copies of the
+      Work or Derivative Works thereof in any medium, with or without
+      modifications, and in Source or Object form, provided that You
+      meet the following conditions:
+
+      (a) You must give any other recipients of the Work or
+          Derivative Works a copy of this License; and
+
+      (b) You must cause any modified files to carry prominent notices
+          stating that You changed the files; and
+
+      (c) You must retain, in the Source form of any Derivative Works
+          that You distribute, all copyright, patent, trademark, and
+          attribution notices from the Source form of the Work,
+          excluding those notices that do not pertain to any part of
+          the Derivative Works; and
+
+      (d) If the Work includes a "NOTICE" text file as part of its
+          distribution, then any Derivative Works that You distribute must
+          include a readable copy of the attribution notices contained
+          within such NOTICE file, excluding those notices that do not
+          pertain to any part of the Derivative Works, in at least one
+          of the following places: within a NOTICE text file distributed
+          as part of the Derivative Works; within the Source form or
+          documentation, if provided along with the Derivative Works; or,
+          within a display generated by the Derivative Works, if and
+          wherever such third-party notices normally appear. The contents
+          of the NOTICE file are for informational purposes only and
+          do not modify the License. You may add Your own attribution
+          notices within Derivative Works that You distribute, alongside
+          or as an addendum to the NOTICE text from the Work, provided
+          that such additional attribution notices cannot be construed
+          as modifying the License.
+
+      You may add Your own copyright statement to Your modifications and
+      may provide additional or different license terms and conditions
+      for use, reproduction, or distribution of Your modifications, or
+      for any such Derivative Works as a whole, provided Your use,
+      reproduction, and distribution of the Work otherwise complies with
+      the conditions stated in this License.
+
+   5. Submission of Contributions. Unless You explicitly state otherwise,
+      any Contribution intentionally submitted for inclusion in the Work
+      by You to the Licensor shall be under the terms and conditions of
+      this License, without any additional terms or conditions.
+      Notwithstanding the above, nothing herein shall supersede or modify
+      the terms of any separate license agreement you may have executed
+      with Licensor regarding such Contributions.
+
+   6. Trademarks. This License does not grant permission to use the trade
+      names, trademarks, service marks, or product names of the Licensor,
+      except as required for reasonable and customary use in describing the
+      origin of the Work and reproducing the content of the NOTICE file.
+
+   7. Disclaimer of Warranty. Unless required by applicable law or
+      agreed to in writing, Licensor provides the Work (and each
+      Contributor provides its Contributions) on an "AS IS" BASIS,
+      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+      implied, including, without limitation, any warranties or conditions
+      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
+      PARTICULAR PURPOSE. You are solely responsible for determining the
+      appropriateness of using or redistributing the Work and assume any
+      risks associated with Your exercise of permissions under this License.
+
+   8. Limitation of Liability. In no event and under no legal theory,
+      whether in tort (including negligence), contract, or otherwise,
+      unless required by applicable law (such as deliberate and grossly
+      negligent acts) or agreed to in writing, shall any Contributor be
+      liable to You for damages, including any direct, indirect, special,
+      incidental, or consequential damages of any character arising as a
+      result of this License or out of the use or inability to use the
+      Work (including but not limited to damages for loss of goodwill,
+      work stoppage, computer failure or malfunction, or any and all
+      other commercial damages or losses), even if such Contributor
+      has been advised of the possibility of such damages.
+
+   9. Accepting Warranty or Additional Liability. While redistributing
+      the Work or Derivative Works thereof, You may choose to offer,
+      and charge a fee for, acceptance of support, warranty, indemnity,
+      or other liability obligations and/or rights consistent with this
+      License. However, in accepting such obligations, You may act only
+      on Your own behalf and on Your sole responsibility, not on behalf
+      of any other Contributor, and only if You agree to indemnify,
+      defend, and hold each Contributor harmless for any liability
+      incurred by, or claims asserted against, such Contributor by reason
+      of your accepting any such warranty or additional liability.
+
+   END OF TERMS AND CONDITIONS
+
+   APPENDIX: How to apply the Apache License to your work.
+
+      To apply the Apache License to your work, attach the following
+      boilerplate notice, with the fields enclosed by brackets "{}"
+      replaced with your own identifying information. (Don't include
+      the brackets!)  The text should be enclosed in the appropriate
+      comment syntax for the file format. We also recommend that a
+      file or class name and description of purpose be included on the
+      same "printed page" as the copyright notice for easier
+      identification within third-party archives.
+
+   Copyright 2014 The gofuzz Authors
+   Copyright 2025 The Kubernetes Authors
+
+   Licensed under the Apache License, Version 2.0 (the "License");
+   you may not use this file except in compliance with the License.
+   You may obtain a copy of the License at
+
+       http://www.apache.org/licenses/LICENSE-2.0
+
+   Unless required by applicable law or agreed to in writing, software
+   distributed under the License is distributed on an "AS IS" BASIS,
+   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+   See the License for the specific language governing permissions and
+   limitations under the License.
+
+= vendor/sigs.k8s.io/randfill/LICENSE 8f245a894b7d4f5880176fafd88faad8

Makefile

@@ -2,18 +2,6 @@
 CRD_OPTIONS ?= "crd:allowDangerousTypes=true"
 MANIFESTS="cluster/v1alpha1 iam/... quota/v1alpha2 storage/v1alpha1 tenant/... extensions/v1alpha1 core/v1alpha1 gateway/v1alpha2 application/v2"
 
-# Get the currently used golang install path (in GOPATH/bin, unless GOBIN is set)
-ifeq (,$(shell go env GOBIN))
-GOBIN=$(shell go env GOPATH)/bin
-else
-GOBIN=$(shell go env GOBIN)
-endif
-
-OUTPUT_DIR=bin
-ifeq (${GOFLAGS},)
-	# go build with vendor by default.
-	export GOFLAGS=-mod=vendor
-endif
 define ALL_HELP_INFO
 # Build code.
 #
@@ -44,14 +32,6 @@ help:
 # Build all of binary
 binary: | ks-apiserver ks-controller-manager; $(info $(M)...Build all of binary.) @ ## Build all of binary.
 
-# Build ks-apiserver binary
-ks-apiserver: ; $(info $(M)...Begin to build ks-apiserver binary.)  @ ## Build ks-apiserver.
-	hack/gobuild.sh cmd/ks-apiserver;
-
-# Build ks-controller-manager binary
-ks-controller-manager: ; $(info $(M)...Begin to build ks-controller-manager binary.)  @ ## Build ks-controller-manager.
-	hack/gobuild.sh cmd/controller-manager
-
 # Run all verify scripts hack/verify-*.sh
 verify-all: ; $(info $(M)...Begin to run all verify scripts hack/verify-*.sh.)  @ ## Run all verify scripts hack/verify-*.sh.
 	hack/verify-all.sh
@@ -121,13 +101,11 @@ helm-uninstall: ; $(info $(M)...Begin to helm-uninstall.)  @ ## Helm-uninstall.
 
 # Run tests
 test: vet test-env ;$(info $(M)...Begin to run tests.)  @ ## Run tests.
-	go test ./pkg/... ./cmd/... -covermode=atomic -coverprofile=coverage.txt
-	cd staging/src/kubesphere.io/api ; GOFLAGS="" go test ./...
-	cd staging/src/kubesphere.io/client-go ; GOFLAGS="" go test ./...
+	hack/test-go.sh
 
 .PHONY: test-env
 test-env: ;$(info $(M)...Begin to setup test env) @ ## Download unit test libraries e.g. kube-apiserver etcd.
-	@hack/setup-envtest.sh
+	hack/setup-envtest.sh
 
 .PHONY: clean
 clean: ;$(info $(M)...Begin to clean.)  @ ## Clean.
@@ -138,5 +116,34 @@ clean: ;$(info $(M)...Begin to clean.)  @ ## Clean.
 update-licenses: ;$(info $(M)...Begin to update licenses.)
 	@hack/update-licenses.sh
 
-golint:
-	@hack/verify-golangci-lint.sh
+define LINT_HELP_INFO
+# Run golangci-lint
+#
+# Example:
+#   make lint
+endef
+.PHONY: lint
+ifeq ($(PRINT_HELP),y)
+lint:
+	echo "$$LINT_HELP_INFO"
+else
+lint:
+	hack/verify-golangci-lint.sh
+endif
+
+define CMD_HELP_INFO
+# Add rules for all directories in cmd/
+#
+# Example:
+#   make ks-apiserver
+endef
+EXCLUDE_TARGET=OWNERS
+CMD_TARGET = $(filter-out %$(EXCLUDE_TARGET),$(notdir $(abspath $(wildcard cmd/*/))))
+.PHONY: $(CMD_TARGET)
+ifeq ($(PRINT_HELP),y)
+$(CMD_TARGET):
+	echo "$$CMD_HELP_INFO"
+else
+$(CMD_TARGET):
+	hack/make-rules/build.sh cmd/$@
+endif

README.md

@@ -11,7 +11,7 @@
 <a href="https://hub.docker.com/r/kubesphere/ks-installer"><img src="https://img.shields.io/docker/pulls/kubesphere/ks-installer"></a>
 <a href="https://github.com/kubesphere/kubesphere/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3A%22good+first+issue%22"><img src="https://img.shields.io/github/issues/kubesphere/kubesphere/good%20first%20issue?logo=github" alt="good first issue"></a>
 <a href="https://twitter.com/intent/follow?screen_name=KubeSphere"><img src="https://img.shields.io/twitter/follow/KubeSphere?style=social" alt="follow on Twitter"></a>
-<a href="https://join.slack.com/t/kubesphere/shared_invite/zt-219hq0b5y-el~FMRrJxGM1Egf5vX6QiA"><img src="https://img.shields.io/badge/Slack-2000%2B-blueviolet?logo=slack&amp;logoColor=white"></a>
+<a href="https://join.slack.com/t/kubesphere/shared_invite/zt-2b4t6rdb4-ico_4UJzCln_S2c1pcrIpQ"><img src="https://img.shields.io/badge/Slack-2000%2B-blueviolet?logo=slack&amp;logoColor=white"></a>
 <a href="https://www.youtube.com/channel/UCyTdUQUYjf7XLjxECx63Hpw"><img src="https://img.shields.io/youtube/channel/subscribers/UCyTdUQUYjf7XLjxECx63Hpw?style=social"></a>
 </p>
 
@@ -61,9 +61,14 @@ KubeSphere installed in only 5 seconds and experience feature-rich KubeSphere.
 
 ## Features
 
+<details>
+<summary><b>🧩 Extensible Architecture</b></summary>  
+Designed for flexibility, supporting plugin-based extensions and seamless integrations. Easily customize and expand functionalities to meet evolving needs. <a href="https://kubesphere.io/docs/v4.1/01-intro/02-architecture/">Learn more</a>.  
+</details>
+
 <details>
   <summary><b>🕸 Provisioning Kubernetes Cluster</b></summary>
-  Support deploy Kubernetes on any infrastructure, support online and air-gapped installation. <a href="https://kubesphere.io/docs/installing-on-linux/introduction/intro/">Learn more</a>.
+  Support deploy Kubernetes on any infrastructure, support online and air-gapped installation. <a href="https://kubesphere.io/docs/v4.1/03-installation-and-upgrade/02-install-kubesphere/">Learn more</a>.
   </details>
 
 <details>
@@ -73,32 +78,27 @@ KubeSphere installed in only 5 seconds and experience feature-rich KubeSphere.
 
 <details>
   <summary><b>🤖 Kubernetes DevOps</b></summary>
-  Provide GitOps-based CD solutions and use Argo CD to provide the underlying support, collecting CD status information in real time. With the mainstream CI engine Jenkins integrated, DevOps has never been easier. <a href="https://kubesphere.io/devops/">Learn more</a>.
+  Provide GitOps-based CD solutions and use Argo CD to provide the underlying support, collecting CD status information in real time. With the mainstream CI engine Jenkins integrated, DevOps has never been easier. <a href="https://kubesphere.io/docs/v4.1/11-use-extensions/01-devops/01-overview/">Learn more</a>.
   </details>
 
 <details>
   <summary><b>🔎 Cloud Native Observability</b></summary>
-  Multi-dimensional monitoring, events and auditing logs are supported; multi-tenant log query and collection, alerting and notification are built-in. <a href="https://kubesphere.io/observability/">Learn more</a>.
+  Multi-dimensional monitoring, events and auditing logs are supported; multi-tenant log query and collection, alerting and notification are built-in. <a href="https://kubesphere.io/docs/v4.1/11-use-extensions/05-observability-platform/">Learn more</a>.
   </details>
 
 <details>
-  <summary><b>🧩 Service Mesh (Istio-based)</b></summary>
-  Provide fine-grained traffic management, observability and tracing for distributed microservice applications, provides visualization for traffic topology. <a href="https://kubesphere.io/service-mesh/">Learn more</a>.
+  <summary><b>🌐 Service Mesh (Istio-based)</b></summary>
+  Provide fine-grained traffic management, observability and tracing for distributed microservice applications, provides visualization for traffic topology. <a href="https://kubesphere.io/docs/v4.1/11-use-extensions/03-service-mesh/">Learn more</a>.
   </details>
 
 <details>
   <summary><b>💻 App Store</b></summary>
-  Provide an App Store for Helm-based applications, and offer application lifecycle management on Kubernetes platform. <a href="https://kubesphere.io/docs/pluggable-components/app-store/">Learn more</a>.
+  Provide an App Store for Helm-based applications, and offer application lifecycle management on Kubernetes platform. <a href="https://kubesphere.io/docs/v4.1/11-use-extensions/02-app-store/02-app-management/">Learn more</a>.
   </details>
 
 <details>
   <summary><b>💡 Edge Computing Platform</b></summary>
-  KubeSphere integrates <a href="https://kubeedge.io/en/">KubeEdge</a> to enable users to deploy applications on the edge devices and view logs and monitoring metrics of them on the console. <a href="https://kubesphere.io/docs/pluggable-components/kubeedge/">Learn more</a>.
-  </details>
-
-<details>
-  <summary><b>📊 Metering and Billing</b></summary>
-  Track resource consumption at different levels on a unified dashboard, which helps you make better-informed decisions on planning and reduce the cost. <a href="https://kubesphere.io/docs/toolbox/metering-and-billing/view-resource-consumption/">Learn more</a>.
+  KubeSphere integrates <a href="https://kubeedge.io/en/">KubeEdge</a> to enable users to deploy applications on the edge devices and view logs and monitoring metrics of them on the console. <a href="https://kubesphere.io/docs/v4.1/11-use-extensions/17-kubeedge/">Learn more</a>.
   </details>
 
 <details>
@@ -107,9 +107,9 @@ KubeSphere installed in only 5 seconds and experience feature-rich KubeSphere.
   </details>
 
 <details>
-  <summary><b>🏘 Multi-tenancy</b></summary>
-  Provide unified authentication with fine-grained roles and three-tier authorization system, and support AD/LDAP authentication.
-  </details>
+<summary><b>🏢 Multi-Tenancy</b></summary>  
+Isolated workspaces with role-based access control ensure secure resource sharing across multiple tenants. Supports fine-grained permissions and quota management. <a href="https://kubesphere.io/docs/v4.1/08-workspace-management/">Learn more</a>.  
+</details>
 
 <details>
   <summary><b>🧠 GPU Workloads Scheduling and Monitoring</b></summary>
@@ -118,9 +118,7 @@ KubeSphere installed in only 5 seconds and experience feature-rich KubeSphere.
 
 ## Architecture
 
-KubeSphere uses a loosely-coupled architecture that separates the [frontend](https://github.com/kubesphere/console) from
-the [backend](https://github.com/kubesphere/kubesphere). External systems can access the components of the backend
-through the REST APIs.
+KubeSphere 4.x adopts a microkernel + extension components architecture ([codename LuBan](https://kubesphere.io/docs/v4.1/01-intro/01-introduction/)). The core part (KubeSphere Core) only includes the essential basic functions required for system operation, with independent functional modules split and provided in the form of extension components. Users can dynamically manage the extension components during system operation. With the extension capabilities, KubeSphere can support more application scenarios and meet the needs of different users.
 
 ![Architecture](docs/images/architecture.png)
 
@@ -128,71 +126,25 @@ through the REST APIs.
 
 ## Latest release
 
-🎉 KubeSphere v3.4.0 was released! It brings enhancements and better user experience, see
-the [Release Notes For 3.4.0](https://kubesphere.io/docs/release/release-v340/) for the updates.
-
-#### Component supported versions table
-
-| Component      | Version                                                                       | K8s supported version         |
-|----------------|-------------------------------------------------------------------------------|-------------------------------|
-| Alerting       | N/A                                                                           | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Auditing	      | v0.2.0                                                                        | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Monitoring     | N/A		                                                                         | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| DevOps         | v3.4.0                                                                        | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| EdgeRuntime    | v1.13.0                                                                       | 1.21,1.22,1.23                |
-| Events         | N/A                                                                           | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Logging        | opensearch：v2.6.0<br/>fluentbit-operator: v0.14.0<br/> fluent-bit-tag: v1.9.4 | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Metrics Server | v0.4.2                                                                        | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Network        | N/A                                                                           | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Notification   | v2.3.0                                                                        | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| AppStore       | N/A                                                                           | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Storage        | pvc-autoresizer: v0.3.0<br/>storageclass-accessor: v0.2.2                     | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| ServiceMesh    | Istio: v1.14.6                                                                | 1.21,1.22,1.23,1.24           |
-| Gateway        | Ingress NGINX Controller: v1.3.1                                              | 1.21,1.22,1.23,1.24           |
-
+🎉 KubeSphere v4.1.2 was released! It brings enhancements and better user experience, see
+the [Release Notes For 4.1.2](https://kubesphere.io/docs/v4.1/20-release-notes/release-v412/) for the updates.
 
 ## Installation
 
 KubeSphere can run anywhere from on-premise datacenter to any cloud to edge. In addition, it can be deployed on any
-version-compatible Kubernetes cluster. The installer will start a minimal installation by default, you
-can [enable other pluggable components before or after installation](https://kubesphere.io/docs/quick-start/enable-pluggable-components/).
+version-compatible Kubernetes cluster. KubeSphere consumes very few resources, and you can
+optionally [install additional extensions after installation](https://kubesphere.io/docs/v4.1/02-quickstart/03-install-an-extension/).
 
 ### Quick start
 
-#### Installing on K8s/K3s
-
-Ensure that your cluster has installed Kubernetes v1.21.x, v1.22.x, v1.23.x, * v1.24.x, * v1.25.x, or * v1.26.x. For Kubernetes versions with an asterisk, some features may be unavailable due to incompatibility.
+#### Installing on K8s
 
 Run the following commands to install KubeSphere on an existing Kubernetes cluster:
 
-```yaml
-kubectl apply -f https://github.com/kubesphere/ks-installer/releases/download/v3.4.0/kubesphere-installer.yaml
-
-kubectl apply -f https://github.com/kubesphere/ks-installer/releases/download/v3.4.0/cluster-configuration.yaml
+```bash
+helm upgrade --install -n kubesphere-system --create-namespace ks-core https://charts.kubesphere.io/main/ks-core-1.1.3.tgz --debug --wait
 ```
 
-#### All-in-one
-
-👨‍💻 No Kubernetes? You can use [KubeKey](https://github.com/kubesphere/kubekey) to install both KubeSphere and
-Kubernetes/K3s in single-node mode on your Linux machine. Let's take K3s as an example:
-
-```yaml
-# Download KubeKey
-curl -sfL https://get-kk.kubesphere.io | VERSION=v3.0.10 sh -
-# Make kk executable
-chmod +x kk
-# Create a cluster
-./kk create cluster --with-kubernetes v1.24.14 --container-manager containerd --with-kubesphere v3.4.0
-```
-
-You can run the following command to view the installation logs. After KubeSphere is successfully installed, you can
-access the KubeSphere web console at `http://IP:30880` and log in using the default administrator account (
-admin/P@88w0rd).
-
-```yaml
-kubectl logs -n kubesphere-system $(kubectl get pod -n kubesphere-system -l 'app in (ks-install, ks-installer)' -o jsonpath='{.items[0].metadata.name}') -f
-``` 
-
 ### KubeSphere for hosted Kubernetes services
 
 KubeSphere is hosted on the following cloud providers, and you can try KubeSphere by one-click installation on their
@@ -204,25 +156,19 @@ hosted Kubernetes services.
 - [KubeSphere on QingCloud AppCenter(QKE)](https://www.qingcloud.com/products/kubesphereqke)
 
 You can also install KubeSphere on other hosted Kubernetes services within minutes, see
-the [step-by-step guides](https://kubesphere.io/docs/installing-on-kubernetes/) to get started.
+the [step-by-step guides](https://kubesphere.io/docs/v4.1/02-quickstart/01-install-kubesphere/) to get started.
 
 > 👨‍💻 No internet access? Refer to
->
-the [Air-gapped Installation on Kubernetes](https://kubesphere.io/docs/installing-on-kubernetes/on-prem-kubernetes/install-ks-on-linux-airgapped/)
->
-or [Air-gapped Installation on Linux](https://kubesphere.io/docs/installing-on-linux/introduction/air-gapped-installation/)
-> for instructions on how to use private registry to install KubeSphere.
+> the [Air-gapped Installation](https://kubesphere.io/docs/v4.1/03-installation-and-upgrade/02-install-kubesphere/04-offline-installation/).
 
 ## Guidance, discussion, contribution, and support
 
-We :heart: your contribution. The [community](https://github.com/kubesphere/community) walks you through how to get
-started contributing KubeSphere.
-The [development guide](https://github.com/kubesphere/community/tree/master/developer-guide/development) explains how to
-set up development environment.
+You can reach the KubeSphere [community](https://github.com/kubesphere/community) and developers via the following
+channels:
 
-- [Slack Channel](https://join.slack.com/t/kubesphere/shared_invite/zt-219hq0b5y-el~FMRrJxGM1Egf5vX6QiA)
+- [Slack Channel](https://join.slack.com/t/kubesphere/shared_invite/zt-2b4t6rdb4-ico_4UJzCln_S2c1pcrIpQ)
 - [Youtube](https://www.youtube.com/channel/UCyTdUQUYjf7XLjxECx63Hpw)
-- [Twitter](https://twitter.com/KubeSphere)
+- [X/Twitter](https://x.com/KubeSphere)
 
 :hugs: Please submit any KubeSphere bugs, issues, and feature requests
 to [KubeSphere GitHub Issue](https://github.com/kubesphere/kubesphere/issues).
@@ -230,18 +176,34 @@ to [KubeSphere GitHub Issue](https://github.com/kubesphere/kubesphere/issues).
 :heart_decoration: The KubeSphere team also provides efficient official ticket support to respond in hours. For more
 information, click [KubeSphere Online Support](https://kubesphere.cloud/en/ticket/).
 
+## Contribution
+
+- [KubeSphere Development Guide](https://github.com/kubesphere/community/tree/master/developer-guide/development)
+  explains how to build and develop KubeSphere.
+- [KubeSphere Extension Development Guide](https://dev-guide.kubesphere.io/extension-dev-guide/en/) explains how to
+  develop KubeSphere extensions.
+
+## Code of conduct
+
+Participation in the KubeSphere community is governed by
+the [Code of Conduct](https://github.com/kubesphere/community/blob/master/code-of-conduct.md).
+
+## Security
+
+The security process for reporting vulnerabilities is described in [SECURITY.md](./SECURITY.md).
+
 ## Who are using KubeSphere
 
 The [user case studies](https://kubesphere.io/case/) page includes the user list of the project. You
 can [leave a comment](https://github.com/kubesphere/kubesphere/issues/4123) to let us know your use case.
 
-## Landscapes
+---
 
 <p align="center">
 <br/><br/>
-<img src="https://landscape.cncf.io/images/left-logo.svg" width="150"/>&nbsp;&nbsp;<img src="https://landscape.cncf.io/images/right-logo.svg" width="200"/>&nbsp;&nbsp;
+<img src="https://raw.githubusercontent.com/cncf/artwork/refs/heads/main/other/cncf-landscape/horizontal/color/cncf-landscape-horizontal-color.svg" width="150"/>&nbsp;&nbsp;<img src="https://raw.githubusercontent.com/cncf/artwork/refs/heads/main/other/cncf/horizontal/color/cncf-color.svg" width="200"/>&nbsp;&nbsp;
 <br/><br/>
 KubeSphere is a member of CNCF and a <a href="https://www.cncf.io/certification/software-conformance/#logos">Kubernetes Conformance Certified platform
-</a>, which enriches the <a href="https://landscape.cncf.io/?landscape=observability-and-analysis&license=apache-license-2-0">CNCF CLOUD NATIVE Landscape.
+</a>, which enriches the <a href="https://landscape.cncf.io/?landscape=observability-and-analysis&group=certified-partners-and-providers&item=platform--certified-kubernetes-distribution--kubesphere">CNCF CLOUD NATIVE Landscape.
 </a>
 </p>

README_zh.md

@@ -11,7 +11,7 @@
 <a href="https://hub.docker.com/r/kubesphere/ks-installer"><img src="https://img.shields.io/docker/pulls/kubesphere/ks-installer"></a>
 <a href="https://github.com/kubesphere/kubesphere/issues?q=is%3Aissue+is%3Aopen+sort%3Aupdated-desc+label%3A%22good+first+issue%22"><img src="https://img.shields.io/github/issues/kubesphere/kubesphere/good%20first%20issue?logo=github" alt="good first issue"></a>
 <a href="https://twitter.com/intent/follow?screen_name=KubeSphere"><img src="https://img.shields.io/twitter/follow/KubeSphere?style=social" alt="follow on Twitter"></a>
-<a href="https://join.slack.com/t/kubesphere/shared_invite/zt-219hq0b5y-el~FMRrJxGM1Egf5vX6QiA"><img src="https://img.shields.io/badge/Slack-2000%2B-blueviolet?logo=slack&amp;logoColor=white"></a>
+<a href="https://join.slack.com/t/kubesphere/shared_invite/zt-2b4t6rdb4-ico_4UJzCln_S2c1pcrIpQ"><img src="https://img.shields.io/badge/Slack-2000%2B-blueviolet?logo=slack&amp;logoColor=white"></a>
 <a href="https://www.youtube.com/channel/UCyTdUQUYjf7XLjxECx63Hpw"><img src="https://img.shields.io/youtube/channel/subscribers/UCyTdUQUYjf7XLjxECx63Hpw?style=social"></a>
 </p>
 
@@ -53,9 +53,15 @@
 
 ## 平台功能
 
+<details>
+<summary><b>🧩 可扩展架构</b></summary>  
+旨在提供灵活性，支持基于插件的扩展和无缝集成。轻松定制和扩展功能，以满足不断变化的需求， <a href="https://kubesphere.io/docs/v4.1/01-intro/02-architecture/">了解更多</a>.  
+</details>
+
+
 <details>
   <summary><b>🕸 部署 Kubernetes 集群</b></summary>
-  支持在任何基础设施上部署 Kubernetes，支持在线安装和离线安装，<a href="https://kubesphere.io/zh/docs/installing-on-linux/introduction/intro/">了解更多</a>。
+  支持在任何基础设施上部署 Kubernetes，支持在线安装和离线安装，<a href="https://kubesphere.io/docs/v4.1/03-installation-and-upgrade/02-install-kubesphere/">了解更多</a>。
   </details>
 
 <details>
@@ -65,32 +71,27 @@
 
 <details>
   <summary><b>🤖 Kubernetes DevOps</b></summary>
-  提供基于 GitOps 的 CD 方案，底层支持 Argo CD，可实时统计 CD 状态。结合主流 CI 引擎 Jenkins，让 DevOps 更加易用。<a href="https://kubesphere.io/zh/devops/">了解更多</a>。
+  提供基于 GitOps 的 CD 方案，底层支持 Argo CD，可实时统计 CD 状态。结合主流 CI 引擎 Jenkins，让 DevOps 更加易用。<a href="https://kubesphere.io/docs/v4.1/11-use-extensions/01-devops/01-overview/">了解更多</a>。
   </details>
 
 <details>
   <summary><b>🔎 云原生可观测性</b></summary>
-  支持多维度监控、事件和审计日志；内置多租户日志查询和收集，告警和通知，<a href="https://kubesphere.io/zh/observability/">了解更多</a>。
+  支持多维度监控、事件和审计日志；内置多租户日志查询和收集，告警和通知，<a href="https://kubesphere.io/docs/v4.1/11-use-extensions/05-observability-platform/">了解更多</a>。
   </details>
 
 <details>
-  <summary><b>🧩 基于 Istio 的微服务治理</b></summary>
-  为分布式微服务应用程序提供细粒度的流量管理、可观测性和服务跟踪，支持可视化的流量拓扑，<a href="https://kubesphere.io/zh/service-mesh/">了解更多</a>。
+  <summary><b>🌐 基于 Istio 的微服务治理</b></summary>
+  为分布式微服务应用程序提供细粒度的流量管理、可观测性和服务跟踪，支持可视化的流量拓扑，<a href="https://kubesphere.io/docs/v4.1/11-use-extensions/03-service-mesh/">了解更多</a>。
   </details>
 
 <details>
   <summary><b>💻 应用商店</b></summary>
-  为基于 Helm 的应用程序提供应用商店，并在 Kubernetes 平台上提供应用程序生命周期管理功能，<a href="https://kubesphere.io/zh/docs/pluggable-components/app-store/">了解更多</a>。
+  为基于 Helm 的应用程序提供应用商店，并在 Kubernetes 平台上提供应用程序生命周期管理功能，<a href="https://kubesphere.io/docs/v4.1/11-use-extensions/02-app-store/02-app-management/">了解更多</a>。
   </details>
 
 <details>
   <summary><b>💡 Kubernetes 边缘节点管理</b></summary>
-  基于 <a href="https://kubeedge.io/zh/">KubeEdge</a> 实现应用与工作负载在云端与边缘节点的统一分发与管理，解决在海量边、端设备上完成应用交付、运维、管控的需求，<a href= "https://kubesphere.io/zh/docs/pluggable-components/kubeedge/">了解更多</a>。
-  </details>
-
-<details>
-  <summary><b>📊 多维度计量与计费</b></summary>
-  提供基于集群与租户的多维度资源计量与计费的监控报表，让 Kubernetes 运营成本更透明，<a href="https://kubesphere.io/zh/docs/toolbox/metering-and-billing/view-resource-consumption/">了解更多</a>。
+  基于 <a href="https://kubeedge.io/zh/">KubeEdge</a> 实现应用与工作负载在云端与边缘节点的统一分发与管理，解决在海量边、端设备上完成应用交付、运维、管控的需求，<a href= "https://kubesphere.io/docs/v4.1/11-use-extensions/17-kubeedge/">了解更多</a>。
   </details>
 
 <details>
@@ -99,8 +100,8 @@
   </details>
 
 <details>
-  <summary><b>🏘 多租户与统一鉴权认证</b></summary>
-  提供统一的认证鉴权与细粒度的基于角色的授权系统，支持对接 AD/LDAP 。
+  <summary><b>🏢 多租户与统一鉴权认证</b></summary>
+  具有基于角色的访问控制的逻辑隔离可确保跨多个租户的安全资源共享。支持细粒度的权限和配额管理，<a href="https://kubesphere.io/docs/v4.1/08-workspace-management/">了解更多</a>。
   </details>
 
 <details>
@@ -110,7 +111,7 @@
 
 ## 架构说明
 
-KubeSphere 使用前后端分离的架构，将 [前端](https://github.com/kubesphere/console) 与 [后端](https://github.com/kubesphere/kubesphere) 分开。后端的各个功能组件可通过 REST API 对接外部系统。
+KubeSphere 4.x，采用了微内核 + 扩展组件的架构（[代号 LuBan](https://kubesphere.io/docs/v4.1/01-intro/01-introduction/)）。其中内核部分（KubeSphere Core）仅包含系统运行的必备基础功能，将独立的功能模块拆分通过扩展组件（Extensions）的形式提供。用户可在系统运行时动态地管理扩展组件，借助扩展能力，KubeSphere 可以支持更多的应用场景，满足不同用户的需求。
 
 ![Architecture](docs/images/architecture.png)
 
@@ -118,59 +119,19 @@ KubeSphere 使用前后端分离的架构，将 [前端](https://github.com/kube
 
 ## 最新版本
 
-🎉 KubeSphere 3.4.0 全新发布！！多项功能与体验优化，带来更好的产品体验，详见 [v3.4.0 版本说明](https://www.kubesphere.io/zh/news/kubesphere-3.4.0-ga-announcement/) 。
-
-#### 组件支持版本列表
-
-| Component      | Version                                                                       | K8s supported version         |
-|----------------|-------------------------------------------------------------------------------|-------------------------------|
-| Alerting       | N/A                                                                           | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Auditing	      | v0.2.0                                                                        | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Monitoring     | N/A		                                                                         | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| DevOps         | v3.4.0                                                                        | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| EdgeRuntime    | v1.13.0                                                                       | 1.21,1.22,1.23                |
-| Events         | N/A                                                                           | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Logging        | opensearch：v2.6.0<br/>fluentbit-operator: v0.14.0<br/> fluent-bit-tag: v1.9.4 | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Metrics Server | v0.4.2                                                                        | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Network        | N/A                                                                           | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Notification   | v2.3.0                                                                        | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| AppStore       | N/A                                                                           | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| Storage        | pvc-autoresizer: v0.3.0<br/>storageclass-accessor: v0.2.2                     | 1.21,1.22,1.23,1.24,1.25,1.26 |
-| ServiceMesh    | Istio: v1.14.6                                                                | 1.21,1.22,1.23,1.24           |
-| Gateway        | Ingress NGINX Controller: v1.3.1      
+🎉 KubeSphere 4.1.2 全新发布！！多项功能与体验优化，带来更好的产品体验，详见 [v4.1.2 版本说明](https://kubesphere.io/docs/v4.1/20-release-notes/release-v412/) 。
 
 ## 安装
 
-KubeSphere 支持在任意平台运行，从本地数据中心到混合多云再走向边缘。此外，KubeSphere 可以部署在任何版本兼容的 Kubernetes 集群上。Installer 默认将执行最小化安装，您可以在安装前或安装后自定义[安装可插拔功能组件](https://kubesphere.io/zh/docs/quick-start/enable-pluggable-components/)。
-### 快速入门
-#### 在 K8s/K3s 上安装
+KubeSphere 支持在任意平台运行，从本地数据中心到混合多云再走向边缘。此外，KubeSphere 可以部署在任何版本兼容的 Kubernetes 集群上。KubeSphere 的资源消耗很少, 你可以在安装完成后[安装其他的扩展组件](https://kubesphere.io/docs/v4.1/02-quickstart/03-install-an-extension/)。
 
-请确保您的集群已经安装 Kubernetes v1.21.x, v1.22.x, v1.23.x, * v1.24.x, * v1.25.x, 或 * v1.26.x。带星号的版本可能出现边缘节点部分功能不可用的情况。
+### 快速入门
+#### 在 K8s 上安装
 
 运行以下命令以在现有 Kubernetes 集群上安装 KubeSphere：
 
-```yaml
-kubectl apply -f https://github.com/kubesphere/ks-installer/releases/download/v3.4.0/kubesphere-installer.yaml
-   
-kubectl apply -f https://github.com/kubesphere/ks-installer/releases/download/v3.4.0/cluster-configuration.yaml
-```
-#### All-in-one（Linux 单节点安装）
-
-👨‍💻 没有 Kubernetes 集群? 可以用 [KubeKey](https://github.com/kubesphere/kubekey) 在 Linux 环境以 All-in-one 快速安装单节点 K8s/K3s 和 KubeSphere，下面以 K3s 为例：
-
-```yaml
-# 下载 KubeKey
-curl -sfL https://get-kk.kubesphere.io | VERSION=v3.0.10 sh -
-# 为 kk 赋予可执行权限
-chmod +x kk
-# 创建集群
-./kk create cluster --with-kubernetes v1.24.14 --container-manager containerd --with-kubesphere v3.4.0
-```
-
-可使用以下命令查看安装日志。如果安装成功，可使用 `http://IP:30880` 访问 KubeSphere Console，管理员登录帐密为 `admin/P@88w0rd`。
-
-```yaml
-kubectl logs -n kubesphere-system $(kubectl get pod -n kubesphere-system -l 'app in (ks-install, ks-installer)' -o jsonpath='{.items[0].metadata.name}') -f
+```bash
+helm upgrade --install -n kubesphere-system --create-namespace ks-core https://charts.kubesphere.io/main/ks-core-1.1.3.tgz --debug --wait
 ```
 
 ### 在托管 Kubernetes 上部署 KubeSphere
@@ -182,33 +143,47 @@ KubeSphere 托管在以下云供应商上，您可以通过在其托管的 Kuber
 - [在 DigitalOcean 上部署 KubeSphere](https://marketplace.digitalocean.com/apps/kubesphere)
 - [在青云QingCloud QKE 上部署 KubeSphere](https://www.qingcloud.com/products/kubesphereqke)
 
-您还可以在几分钟内在其他托管的 Kubernetes 服务上安装 KubeSphere，请参阅 [官方文档](https://kubesphere.io/zh/docs/installing-on-kubernetes/) 以开始使用。
+您还可以在几分钟内在其他托管的 Kubernetes 服务上安装 KubeSphere，请参阅 [官方文档](https://kubesphere.io/docs/v4.1/02-quickstart/01-install-kubesphere/) 以开始使用。
 
-> 👨‍💻 不能访问网络？参考 [在Kubernetes上离线安装](https://kubesphere.io/zh/docs/installing-on-kubernetes/on-prem-kubernetes/install-ks-on-linux-airgapped/) 或者 [在 Linux 上离线安装](https://kubesphere.io/zh/docs/installing-on-linux/introduction/air-gapped-installation/) 了解如何使用私有仓库来安装 KubeSphere。
+> 👨‍💻 不能访问网络？参考[在离线环境中安装 KubeSphere](https://kubesphere.io/docs/v4.1/03-installation-and-upgrade/02-install-kubesphere/04-offline-installation/)。
 
 ## 指引、讨论、贡献与支持
 
-我们 :heart: 您的贡献。[社区](https://github.com/kubesphere/community) 将引导您了解如何开始贡献 KubeSphere。[开发指南](https://github.com/kubesphere/community/tree/master/developer-guide/development) 说明了如何安装开发环境。
+您可以通过以下渠道联系 KubeSphere [社区](https://github.com/kubesphere/community) 和开发者：
 
 - [中文论坛](https://kubesphere.com.cn/forum/)
 - [社区微信群（见官网底部）](https://kubesphere.com.cn/)
-- [Slack Channel](https://join.slack.com/t/kubesphere/shared_invite/zt-219hq0b5y-el~FMRrJxGM1Egf5vX6QiA)
+- [Slack Channel](https://join.slack.com/t/kubesphere/shared_invite/zt-2b4t6rdb4-ico_4UJzCln_S2c1pcrIpQ)
 - [Bilibili](https://space.bilibili.com/438908638)
-- [Twitter](https://twitter.com/KubeSphere)
+- [X/Twitter](https://twitter.com/KubeSphere)
 
 :hugs: 请将任何 KubeSphere 的 Bug、问题和需求提交到 [KubeSphere GitHub Issue](https://github.com/kubesphere/kubesphere/issues)。
 
 :heart_decoration: 若您期待官方、高效的技术服务，青云科技也为 KubeSphere 开源版本提供全程可靠、小时响应的工单支持，详情垂询 [KubeSphere 在线技术支持](https://kubesphere.cloud/ticket/)。
 
+## 贡献
+
+- [KubeSphere 开发指南](https://github.com/kubesphere/community/tree/master/developer-guide/development) 介绍了如何进行
+  KubeSphere 的构建和开发。
+- [KubeSphere 扩展组件开发指南](https://dev-guide.kubesphere.io/extension-dev-guide/zh/) 介绍了如何开发 KubeSphere 扩展组件。
+
+## 行为准则
+
+参与 KubeSphere 社区需遵守[行为准则](https://github.com/kubesphere/community/blob/master/code-of-conduct.md)。
+
+## 安全
+
+有关报告漏洞的安全流程，请参阅 [SECURITY.md](./SECURITY.md)。
+
 ## 谁在使用 KubeSphere
 
 [用户案例学习](https://kubesphere.io/zh/case/) 列出了哪些企业在使用 KubeSphere。欢迎 [发表评论](https://github.com/kubesphere/kubesphere/issues/4123) 来分享您的使用案例。
 
-## Landscapes
+---
 
 <p align="center">
 <br/><br/>
-<img src="https://landscape.cncf.io/images/left-logo.svg" width="150"/>&nbsp;&nbsp;<img src="https://landscape.cncf.io/images/right-logo.svg" width="200"/>&nbsp;&nbsp;
+<img src="https://raw.githubusercontent.com/cncf/artwork/refs/heads/main/other/cncf-landscape/horizontal/color/cncf-landscape-horizontal-color.svg" width="150"/>&nbsp;&nbsp;<img src="https://raw.githubusercontent.com/cncf/artwork/refs/heads/main/other/cncf/horizontal/color/cncf-color.svg" width="200"/>&nbsp;&nbsp;
 <br/><br/>
 KubeSphere 是 CNCF 基金会成员并且通过了 <a href="https://www.cncf.io/certification/software-conformance/#logos">Kubernetes 一致性认证
 </a>，进一步丰富了 <a href="https://landscape.cncf.io/?landscape=observability-and-analysis&license=apache-license-2-0">CNCF 云原生的生态。

SECURITY.md

@@ -2,18 +2,32 @@
 
 ## Supported Versions
 
-Use this section to tell people about which versions of your project are
-currently being supported with security updates.
+We follow an **End-of-Life (EOL)** policy to provide security and bug fix support for KubeSphere versions.
 
-| Version | Supported          |
-| ------- | ------------------ |
-| 3.4.x   | :white_check_mark: |
-| 3.3.x   | :white_check_mark: |
-| 3.2.x   | :white_check_mark: |
-| 3.1.x   | :white_check_mark: |
-| 3.0.x   | :x: |
-| 2.1.x   | :x: |
-| < 2.1.x   | :x:                |
+We regularly release patch versions to address security vulnerabilities and critical bugs for supported KubeSphere
+releases. The support period for each version is determined by its **EOL date**, rather than by a fixed number of minor
+versions.
+
+The current support plan is as follows:
+
+| KubeSphere Version            | End of Life (EOL) Date |
+|-------------------------------|------------------------|
+| **KubeSphere v4.2**           | ---                    |
+| **KubeSphere v4.1**           | Sep 12, 2027           |
+| **KubeSphere v3.4**           | Dec 25, 2025           |
+| **KubeSphere v3.3 & earlier** | Oct 31, 2025           |
+
+Once a version reaches its EOL date, it will no longer receive official security updates or bug fixes. Older versions
+may receive **critical security fixes on a best-effort basis**, but we cannot guarantee that all security patches will
+be backported to unsupported versions.
+
+In rare cases, where a security fix requires significant architectural changes or is otherwise highly intrusive, and a
+feasible workaround exists, we may choose to **apply the fix only in a future release**, rather than backporting it to a
+patch version for currently supported releases.
+
+For long-term stability, we recommend users plan their upgrades according to the EOL schedule.
+
+Let me know if you'd like any refinements!
 
 ## Reporting a Vulnerability
 
@@ -27,7 +41,7 @@ If you find a vulnerability or encounter a security incident involving vulnerabi
 
 Please kindly help provide as much vulnerability information as possible in the following format:
 
-- Issue title(Please add 'Security' lable)*:
+- Issue title (Please add `Security` label)*:
 
 - Overview*:
 

build/ks-apiserver/Dockerfile

@@ -1,24 +1,17 @@
 # Build
-FROM golang:1.23.7 AS build_context
-
-ENV OUTDIR=/out
-RUN mkdir -p ${OUTDIR}/usr/local/bin/
+FROM golang:1.24.3 AS build_context
 
+RUN apt-get update && apt-get install -y rsync
 WORKDIR /workspace
 ADD . /workspace/
 
 RUN make ks-apiserver
-RUN mv /workspace/bin/cmd/ks-apiserver ${OUTDIR}/usr/local/bin/
-
-##############
-# Final image
-#############
 
 FROM alpine:3.21.3
 
-COPY --from=build_context /out/ /
+COPY --from=build_context /workspace/_output/bin/ks-apiserver /usr/local/bin/
 
-WORKDIR /
+WORKDIR /app
 
 EXPOSE 9090
 CMD ["sh"]

build/ks-controller-manager/Dockerfile

@@ -1,38 +1,23 @@
-# Download dependencies
-FROM alpine:3.21.3 AS base_os_context
-
-RUN apk add --no-cache ca-certificates curl
-
-ENV OUTDIR=/out
-RUN mkdir -p ${OUTDIR}/usr/local/bin/
+FROM golang:1.24.3 AS build_context
 
 ARG TELEMETRY_VERSION=1.0.2
 ARG TARGETARCH
-RUN curl -LO https://github.com/kubesphere/telemetry/releases/download/v${TELEMETRY_VERSION}/telemetry_${TELEMETRY_VERSION}_linux_${TARGETARCH}.tar.gz && \
-    tar -zxvf telemetry_${TELEMETRY_VERSION}_linux_${TARGETARCH}.tar.gz -C ${OUTDIR}/usr/local/bin/ telemetry
-
-# Add KS Core Helm Chart
-COPY config/ks-core ${OUTDIR}/var/helm-charts/ks-core
-
-# Build
-FROM golang:1.23.7 AS build_context
-
-ENV OUTDIR=/out
-RUN mkdir -p ${OUTDIR}/usr/local/bin/
 
+RUN apt-get update && apt-get install -y rsync
 WORKDIR /workspace
 ADD . /workspace/
 
 RUN make ks-controller-manager
-RUN mv /workspace/bin/cmd/controller-manager ${OUTDIR}/usr/local/bin/
+RUN curl -LO https://github.com/kubesphere/telemetry/releases/download/v${TELEMETRY_VERSION}/telemetry_${TELEMETRY_VERSION}_linux_${TARGETARCH}.tar.gz && \
+    tar -zxvf telemetry_${TELEMETRY_VERSION}_linux_${TARGETARCH}.tar.gz -C /workspace/_output/bin telemetry
 
-# Final Image
 FROM alpine:3.21.3
 
-COPY --from=base_os_context /out/ /
-COPY --from=build_context /out/ /
+COPY --from=build_context /workspace/_output/bin/ks-controller-manager /usr/local/bin/
+COPY --from=build_context /workspace/_output/bin/telemetry /usr/local/bin/
+COPY config/ks-core /var/helm-charts/ks-core
 
-WORKDIR /
+WORKDIR /app
 
 EXPOSE 8443
-CMD ["sh"]
+CMD ["sh"]

cmd/ks-apiserver/apiserver.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

cmd/ks-apiserver/app/options/options.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

cmd/ks-apiserver/app/options/validation.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

cmd/ks-apiserver/app/server.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

cmd/ks-controller-manager/app/options/options.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

cmd/ks-controller-manager/app/options/options_test.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

cmd/ks-controller-manager/app/server.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */
@@ -17,7 +18,7 @@ import (
 	"k8s.io/klog/v2"
 	"sigs.k8s.io/controller-runtime/pkg/manager/signals"
 
-	"kubesphere.io/kubesphere/cmd/controller-manager/app/options"
+	"kubesphere.io/kubesphere/cmd/ks-controller-manager/app/options"
 	"kubesphere.io/kubesphere/pkg/config"
 	"kubesphere.io/kubesphere/pkg/controller"
 	"kubesphere.io/kubesphere/pkg/controller/application"

cmd/ks-controller-manager/controller-manager.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */
@@ -10,7 +11,7 @@ import (
 
 	"k8s.io/component-base/cli"
 
-	"kubesphere.io/kubesphere/cmd/controller-manager/app"
+	"kubesphere.io/kubesphere/cmd/ks-controller-manager/app"
 )
 
 func main() {

config/ks-core/Chart.yaml

@@ -7,12 +7,12 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 1.1.4-rc.0
+version: 1.1.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
-appVersion: "v4.1.3-rc.0"
+appVersion: "v4.1.1"
 
 dependencies:
   - name: redis-ha

config/ks-core/charts/ks-crds/crds/extensions.kubesphere.io_jsbundles.yaml

@@ -40,6 +40,112 @@ spec:
             type: object
           spec:
             properties:
+              assets:
+                properties:
+                  files:
+                    items:
+                      properties:
+                        caBundle:
+                          format: byte
+                          type: string
+                        insecureSkipVerify:
+                          type: boolean
+                        link:
+                          type: string
+                        mimeType:
+                          description: Set the MIME Type of the file, if not specified,
+                            it will be provided by the content-type response header
+                            in the upstream service by default.
+                          type: string
+                        name:
+                          type: string
+                        service:
+                          description: |-
+                            service is a reference to the service for this endpoint. Either
+                            service or url must be specified.
+                            the scheme is default to HTTPS.
+                          properties:
+                            name:
+                              description: |-
+                                name is the name of the service.
+                                Required
+                              type: string
+                            namespace:
+                              description: |-
+                                namespace is the namespace of the service.
+                                Required
+                              type: string
+                            path:
+                              description: path is an optional URL path at which the
+                                upstream will be contacted.
+                              type: string
+                            port:
+                              description: |-
+                                port is an optional service port at which the upstream will be contacted.
+                                `port` should be a valid port number (1-65535, inclusive).
+                                Defaults to 443 for backward compatibility.
+                              format: int32
+                              type: integer
+                          required:
+                          - name
+                          - namespace
+                          type: object
+                        url:
+                          description: |-
+                            `url` gives the location of the upstream, in standard URL form
+                            (`scheme://host:port/path`). Exactly one of `url` or `service`
+                            must be specified.
+                          type: string
+                      type: object
+                    type: array
+                  style:
+                    properties:
+                      caBundle:
+                        format: byte
+                        type: string
+                      insecureSkipVerify:
+                        type: boolean
+                      link:
+                        type: string
+                      service:
+                        description: |-
+                          service is a reference to the service for this endpoint. Either
+                          service or url must be specified.
+                          the scheme is default to HTTPS.
+                        properties:
+                          name:
+                            description: |-
+                              name is the name of the service.
+                              Required
+                            type: string
+                          namespace:
+                            description: |-
+                              namespace is the namespace of the service.
+                              Required
+                            type: string
+                          path:
+                            description: path is an optional URL path at which the
+                              upstream will be contacted.
+                            type: string
+                          port:
+                            description: |-
+                              port is an optional service port at which the upstream will be contacted.
+                              `port` should be a valid port number (1-65535, inclusive).
+                              Defaults to 443 for backward compatibility.
+                            format: int32
+                            type: integer
+                        required:
+                        - name
+                        - namespace
+                        type: object
+                      url:
+                        description: |-
+                          `url` gives the location of the upstream, in standard URL form
+                          (`scheme://host:port/path`). Exactly one of `url` or `service`
+                          must be specified.
+                        type: string
+                    type: object
+                type: object
               raw:
                 format: byte
                 type: string

config/ks-core/templates/extension-museum.yaml

@@ -83,4 +83,6 @@ metadata:
 spec:
   url: https://extensions-museum.{{ .Release.Namespace }}.svc
   caBundle: {{ b64enc $ca.Cert }}
+status:
+  lastSyncTime: null
 {{end}}

config/ks-core/templates/ks-console-config.yaml

@@ -22,13 +22,15 @@ data:
     {{- else }}
         url: http://ks-apiserver
         wsUrl: ws://ks-apiserver
-    {{ end }}
+    {{- end }}
     client:
       version:
         kubesphere: {{ .Chart.AppVersion }}
         kubernetes: {{ .Capabilities.KubeVersion.Version }}
-      enableKubeConfig: true
-      enableNodeListTerminal: {{ .Values.console.config.enableNodeListTerminal }}
+      isWarningHeaderNotificationEnabled: {{ not (or (empty .Values.experimental.validationDirective) (eq .Values.experimental.validationDirective "Ignore")) }}
+      {{- with .Values.console.config }}
+      {{- toYaml . | nindent 6 }}
+      {{- end }}
 kind: ConfigMap
 metadata:
   name: ks-console-config

config/ks-core/values.yaml

@@ -2,7 +2,7 @@
 ## @param global.tag Global Docker image tag
 global:
   imageRegistry: docker.io
-  tag: v4.1.3-rc.0
+  tag: v4.1.1
   imagePullSecrets: []
   # - name: "image-pull-secret"
 
@@ -161,6 +161,7 @@ console:
     digest: ""
     pullPolicy: IfNotPresent
   config:
+    enableKubeConfig: true
     enableNodeListTerminal: true
   ## @param containerPorts [array] List of container ports to enable in the ks-console container
   ##
@@ -219,7 +220,7 @@ controller:
   ## @param command Override default container command (useful when using custom images)
   ##
   command:
-    - controller-manager
+    - ks-controller-manager
     - --logtostderr=true
     - --leader-elect=true
     - --controllers=*
@@ -443,5 +444,5 @@ ksExtensionRepository:
   image:
     registry: ""
     repository: kubesphere/ks-extensions-museum
-    tag: "1.1.3-rc.0"
+    tag: "latest"
     pullPolicy: IfNotPresent

go.mod

@@ -6,214 +6,215 @@
 
 module kubesphere.io/kubesphere
 
-go 1.23.0
+go 1.24.3
 
-toolchain go1.23.7
+godebug default=go1.24
 
 require (
-	code.cloudfoundry.org/bytefmt v0.0.0-20190710193110-1eb035ffe2b6
-	github.com/Masterminds/semver/v3 v3.3.0
+	code.cloudfoundry.org/bytefmt v0.40.0
+	github.com/Masterminds/semver/v3 v3.3.1
 	github.com/NYTimes/gziphandler v1.1.1
 	github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
-	github.com/aws/aws-sdk-go v1.55.5
+	github.com/aws/aws-sdk-go v1.55.7
 	github.com/blang/semver/v4 v4.0.0
-	github.com/coreos/go-oidc/v3 v3.11.0
+	github.com/coreos/go-oidc/v3 v3.14.1
 	github.com/distribution/reference v0.6.0
-	github.com/docker/cli v27.1.0+incompatible
+	github.com/docker/cli v28.2.1+incompatible
 	github.com/docker/distribution v2.8.3+incompatible
-	github.com/docker/docker v27.3.1+incompatible
-	github.com/emicklei/go-restful-openapi/v2 v2.9.2-0.20230928201233-d828a4fc267c
-	github.com/emicklei/go-restful/v3 v3.11.0
-	github.com/evanphx/json-patch/v5 v5.9.0
-	github.com/go-git/go-git/v5 v5.13.0
-	github.com/go-jose/go-jose/v4 v4.0.5
-	github.com/go-ldap/ldap v3.0.3+incompatible
-	github.com/go-logr/logr v1.4.2
-	github.com/go-openapi/loads v0.21.2
-	github.com/go-openapi/spec v0.20.9
-	github.com/go-openapi/strfmt v0.21.3
-	github.com/go-openapi/validate v0.22.0
-	github.com/go-redis/redis v6.15.2+incompatible
-	github.com/golang-jwt/jwt/v4 v4.5.1
+	github.com/docker/docker v28.2.1+incompatible
+	github.com/emicklei/go-restful-openapi/v2 v2.11.0
+	github.com/emicklei/go-restful/v3 v3.12.2
+	github.com/evanphx/json-patch/v5 v5.9.11
+	github.com/go-git/go-git/v5 v5.16.0
+	github.com/go-jose/go-jose/v4 v4.1.0
+	github.com/go-ldap/ldap/v3 v3.4.11
+	github.com/go-logr/logr v1.4.3
+	github.com/go-openapi/loads v0.22.0
+	github.com/go-openapi/spec v0.21.0
+	github.com/go-openapi/strfmt v0.23.0
+	github.com/go-openapi/validate v0.24.0
+	github.com/go-redis/redis v6.15.9+incompatible
+	github.com/golang-jwt/jwt/v4 v4.5.2
 	github.com/golang/example v0.0.0-20170904185048-46695d81d1fa
-	github.com/google/go-cmp v0.6.0
-	github.com/google/go-containerregistry v0.14.0
-	github.com/google/gops v0.3.23
+	github.com/google/go-cmp v0.7.0
+	github.com/google/go-containerregistry v0.20.5
+	github.com/google/gops v0.3.28
 	github.com/google/uuid v1.6.0
-	github.com/gorilla/websocket v1.5.1
-	github.com/hashicorp/golang-lru v1.0.2
+	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
 	github.com/json-iterator/go v1.1.12
 	github.com/mitchellh/mapstructure v1.5.0
-	github.com/moby/term v0.5.0
+	github.com/moby/term v0.5.2
 	github.com/modern-go/reflect2 v1.0.2
 	github.com/oliveagle/jsonpath v0.0.0-20180606110733-2e52cf6e6852
-	github.com/onsi/ginkgo/v2 v2.20.1
-	github.com/onsi/gomega v1.34.2
-	github.com/open-policy-agent/opa v0.70.0
+	github.com/onsi/ginkgo/v2 v2.23.4
+	github.com/onsi/gomega v1.37.0
+	github.com/open-policy-agent/opa v1.4.2
 	github.com/opencontainers/go-digest v1.0.0
 	github.com/pkg/errors v0.9.1
-	github.com/prometheus/client_golang v1.20.5
+	github.com/prometheus/client_golang v1.22.0
 	github.com/robfig/cron/v3 v3.0.1
-	github.com/sony/sonyflake v1.2.0
+	github.com/sony/sonyflake v1.2.1
 	github.com/speps/go-hashids v2.0.0+incompatible
-	github.com/spf13/cobra v1.8.1
-	github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper v1.18.2
+	github.com/spf13/cobra v1.9.1
+	github.com/spf13/pflag v1.0.6
+	github.com/spf13/viper v1.20.1
 	github.com/stretchr/testify v1.10.0
-	golang.org/x/crypto v0.36.0
-	golang.org/x/exp v0.0.0-20240719175910-8a7402abbf56
-	golang.org/x/net v0.37.0
-	golang.org/x/oauth2 v0.22.0
-	gopkg.in/cas.v2 v2.2.0
+	golang.org/x/crypto v0.38.0
+	golang.org/x/exp v0.0.0-20250506013437-ce4c2cf36ca6
+	golang.org/x/net v0.40.0
+	golang.org/x/oauth2 v0.30.0
+	gopkg.in/cas.v2 v2.2.2
 	gopkg.in/natefinch/lumberjack.v2 v2.2.1
 	gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 v3.16.2
-	k8s.io/api v0.31.2
-	k8s.io/apiextensions-apiserver v0.31.2
-	k8s.io/apimachinery v0.31.2
-	k8s.io/apiserver v0.31.2
-	k8s.io/cli-runtime v0.31.1
-	k8s.io/client-go v0.31.2
-	k8s.io/code-generator v0.31.2
-	k8s.io/component-base v0.31.2
+	helm.sh/helm/v3 v3.18.1
+	k8s.io/api v0.33.1
+	k8s.io/apiextensions-apiserver v0.33.1
+	k8s.io/apimachinery v0.33.1
+	k8s.io/apiserver v0.33.1
+	k8s.io/cli-runtime v0.33.1
+	k8s.io/client-go v0.33.1
+	k8s.io/code-generator v0.33.1
+	k8s.io/component-base v0.33.1
 	k8s.io/klog/v2 v2.130.1
-	k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340
-	k8s.io/kubectl v0.31.1
-	k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
+	k8s.io/kube-openapi v0.0.0-20250318190949-c8a335a9a2ff
+	k8s.io/kubectl v0.33.1
+	k8s.io/utils v0.0.0-20250502105355-0f33e8f1c979
 	kubesphere.io/api v0.0.0
 	kubesphere.io/client-go v0.0.0
 	kubesphere.io/utils v0.0.0
 	oras.land/oras-go v1.2.6
 	sigs.k8s.io/application v0.8.3
-	sigs.k8s.io/controller-runtime v0.19.1
-	sigs.k8s.io/controller-tools v0.16.5
+	sigs.k8s.io/controller-runtime v0.21.0
+	sigs.k8s.io/controller-tools v0.18.0
 	sigs.k8s.io/yaml v1.4.0
 )
 
 require (
-	dario.cat/mergo v1.0.1 // indirect
-	github.com/AdaLogics/go-fuzz-headers v0.0.0-20230811130428-ced1acdcaa24 // indirect
-	github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
-	github.com/BurntSushi/toml v1.3.2 // indirect
+	cel.dev/expr v0.24.0 // indirect
+	dario.cat/mergo v1.0.2 // indirect
+	github.com/AdaLogics/go-fuzz-headers v0.0.0-20240806141605-e8a1dd7889d6 // indirect
+	github.com/Azure/go-ansiterm v0.0.0-20250102033503-faa5f7b0171c // indirect
+	github.com/Azure/go-ntlmssp v0.0.0-20221128193559-754e69321358 // indirect
+	github.com/BurntSushi/toml v1.5.0 // indirect
 	github.com/MakeNowJust/heredoc v1.0.0 // indirect
 	github.com/Masterminds/goutils v1.1.1 // indirect
 	github.com/Masterminds/sprig/v3 v3.3.0 // indirect
 	github.com/Masterminds/squirrel v1.5.4 // indirect
 	github.com/Microsoft/go-winio v0.6.2 // indirect
-	github.com/OneOfOne/xxhash v1.2.8 // indirect
-	github.com/ProtonMail/go-crypto v1.1.3 // indirect
-	github.com/agnivade/levenshtein v1.2.0 // indirect
-	github.com/antlr4-go/antlr/v4 v4.13.0 // indirect
+	github.com/ProtonMail/go-crypto v1.3.0 // indirect
+	github.com/agnivade/levenshtein v1.2.1 // indirect
+	github.com/antlr4-go/antlr/v4 v4.13.1 // indirect
 	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cenkalti/backoff/v4 v4.3.0 // indirect
+	github.com/cenkalti/backoff/v5 v5.0.2 // indirect
 	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/chai2010/gettext-go v1.0.2 // indirect
-	github.com/cloudflare/circl v1.3.7 // indirect
+	github.com/chai2010/gettext-go v1.0.3 // indirect
+	github.com/cloudflare/circl v1.6.1 // indirect
 	github.com/containerd/containerd v1.7.27 // indirect
-	github.com/containerd/errdefs v0.3.0 // indirect
+	github.com/containerd/errdefs v1.0.0 // indirect
+	github.com/containerd/errdefs/pkg v0.3.0 // indirect
 	github.com/containerd/log v0.1.0 // indirect
 	github.com/containerd/platforms v0.2.1 // indirect
+	github.com/containerd/stargz-snapshotter/estargz v0.16.3 // indirect
 	github.com/coreos/go-semver v0.3.1 // indirect
 	github.com/coreos/go-systemd/v22 v22.5.0 // indirect
-	github.com/cyphar/filepath-securejoin v0.3.1 // indirect
+	github.com/cyphar/filepath-securejoin v0.4.1 // indirect
 	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/docker/docker-credential-helpers v0.7.0 // indirect
+	github.com/docker/docker-credential-helpers v0.9.3 // indirect
 	github.com/docker/go-connections v0.5.0 // indirect
 	github.com/docker/go-metrics v0.0.1 // indirect
 	github.com/docker/go-units v0.5.0 // indirect
 	github.com/emirpasic/gods v1.18.1 // indirect
-	github.com/evanphx/json-patch v5.9.0+incompatible // indirect
+	github.com/evanphx/json-patch v5.9.11+incompatible // indirect
 	github.com/exponent-io/jsonpath v0.0.0-20210407135951-1de76d718b3f // indirect
 	github.com/fatih/color v1.18.0 // indirect
 	github.com/felixge/httpsnoop v1.0.4 // indirect
-	github.com/fsnotify/fsnotify v1.7.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.7.0 // indirect
-	github.com/go-errors/errors v1.4.2 // indirect
+	github.com/fsnotify/fsnotify v1.9.0 // indirect
+	github.com/fxamacker/cbor/v2 v2.8.0 // indirect
+	github.com/go-asn1-ber/asn1-ber v1.5.8-0.20250403174932-29230038a667 // indirect
+	github.com/go-errors/errors v1.5.1 // indirect
 	github.com/go-git/gcfg v1.5.1-0.20230307220236-3a3c6141e376 // indirect
-	github.com/go-git/go-billy/v5 v5.6.0 // indirect
+	github.com/go-git/go-billy/v5 v5.6.2 // indirect
 	github.com/go-gorp/gorp/v3 v3.1.0 // indirect
 	github.com/go-ini/ini v1.67.0 // indirect
 	github.com/go-logr/stdr v1.2.2 // indirect
-	github.com/go-openapi/analysis v0.21.4 // indirect
-	github.com/go-openapi/errors v0.20.2 // indirect
-	github.com/go-openapi/jsonpointer v0.19.6 // indirect
-	github.com/go-openapi/jsonreference v0.20.2 // indirect
-	github.com/go-openapi/swag v0.22.4 // indirect
+	github.com/go-openapi/analysis v0.23.0 // indirect
+	github.com/go-openapi/errors v0.22.1 // indirect
+	github.com/go-openapi/jsonpointer v0.21.1 // indirect
+	github.com/go-openapi/jsonreference v0.21.0 // indirect
+	github.com/go-openapi/swag v0.23.1 // indirect
 	github.com/go-task/slim-sprig/v3 v3.0.0 // indirect
+	github.com/go-viper/mapstructure/v2 v2.2.1 // indirect
 	github.com/gobuffalo/flect v1.0.3 // indirect
 	github.com/gobwas/glob v0.2.3 // indirect
 	github.com/gogo/protobuf v1.3.2 // indirect
-	github.com/golang/glog v1.2.4 // indirect
-	github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
+	github.com/golang/glog v1.2.5 // indirect
+	github.com/golang/groupcache v0.0.0-20241129210726-2c02b8208cf8 // indirect
 	github.com/golang/protobuf v1.5.4 // indirect
-	github.com/google/btree v1.1.2 // indirect
-	github.com/google/cel-go v0.20.1 // indirect
-	github.com/google/gnostic-models v0.6.8 // indirect
-	github.com/google/gofuzz v1.2.0 // indirect
-	github.com/google/pprof v0.0.0-20240827171923-fa2c70bbbfe5 // indirect
+	github.com/google/btree v1.1.3 // indirect
+	github.com/google/cel-go v0.25.0 // indirect
+	github.com/google/gnostic-models v0.6.9 // indirect
+	github.com/google/pprof v0.0.0-20250501235452-c0086092b71a // indirect
 	github.com/google/shlex v0.0.0-20191202100458-e7afc7fbc510 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gosuri/uitable v0.0.4 // indirect
-	github.com/gregjones/httpcache v0.0.0-20181110185634-c63ab54fda8f // indirect
+	github.com/gregjones/httpcache v0.0.0-20190611155906-901d90724c79 // indirect
 	github.com/grpc-ecosystem/go-grpc-prometheus v1.2.0 // indirect
-	github.com/grpc-ecosystem/grpc-gateway/v2 v2.20.0 // indirect
+	github.com/grpc-ecosystem/grpc-gateway/v2 v2.26.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect
-	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/huandu/xstrings v1.5.0 // indirect
-	github.com/imdario/mergo v0.3.16 // indirect
 	github.com/inconshreveable/mousetrap v1.1.0 // indirect
 	github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99 // indirect
 	github.com/jmespath/go-jmespath v0.4.0 // indirect
 	github.com/jmoiron/sqlx v1.4.0 // indirect
 	github.com/josharian/intern v1.0.0 // indirect
 	github.com/kevinburke/ssh_config v1.2.0 // indirect
-	github.com/klauspost/compress v1.17.9 // indirect
+	github.com/klauspost/compress v1.18.0 // indirect
 	github.com/kylelemons/godebug v1.1.0 // indirect
 	github.com/lann/builder v0.0.0-20180802200727-47ae307949d0 // indirect
 	github.com/lann/ps v0.0.0-20150810152359-62de8c46ede0 // indirect
 	github.com/lib/pq v1.10.9 // indirect
 	github.com/liggitt/tabwriter v0.0.0-20181228230101-89fcab3d43de // indirect
-	github.com/magiconair/properties v1.8.7 // indirect
-	github.com/mailru/easyjson v0.7.7 // indirect
-	github.com/mattn/go-colorable v0.1.13 // indirect
+	github.com/mailru/easyjson v0.9.0 // indirect
+	github.com/mattn/go-colorable v0.1.14 // indirect
 	github.com/mattn/go-isatty v0.0.20 // indirect
-	github.com/mattn/go-runewidth v0.0.9 // indirect
+	github.com/mattn/go-runewidth v0.0.16 // indirect
 	github.com/mitchellh/copystructure v1.2.0 // indirect
 	github.com/mitchellh/go-homedir v1.1.0 // indirect
 	github.com/mitchellh/go-wordwrap v1.0.1 // indirect
 	github.com/mitchellh/reflectwalk v1.0.2 // indirect
 	github.com/moby/docker-image-spec v1.3.1 // indirect
 	github.com/moby/locker v1.0.1 // indirect
-	github.com/moby/spdystream v0.4.0 // indirect
+	github.com/moby/spdystream v0.5.0 // indirect
 	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
 	github.com/monochromegane/go-gitignore v0.0.0-20200626010858-205db1a8cc00 // indirect
 	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
 	github.com/mxk/go-flowrate v0.0.0-20140419014527-cca7078d478f // indirect
 	github.com/oklog/ulid v1.3.1 // indirect
-	github.com/opencontainers/image-spec v1.1.0 // indirect
-	github.com/pelletier/go-toml/v2 v2.1.0 // indirect
+	github.com/opencontainers/image-spec v1.1.1 // indirect
+	github.com/pelletier/go-toml/v2 v2.2.4 // indirect
 	github.com/peterbourgon/diskv v2.0.1+incompatible // indirect
-	github.com/pjbgf/sha1cd v0.3.0 // indirect
+	github.com/pjbgf/sha1cd v0.3.2 // indirect
 	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_model v0.6.1 // indirect
-	github.com/prometheus/common v0.55.0 // indirect
-	github.com/prometheus/procfs v0.15.1 // indirect
-	github.com/rcrowley/go-metrics v0.0.0-20200313005456-10cdbea86bc0 // indirect
-	github.com/rubenv/sql-migrate v1.7.0 // indirect
+	github.com/prometheus/client_model v0.6.2 // indirect
+	github.com/prometheus/common v0.64.0 // indirect
+	github.com/prometheus/procfs v0.16.1 // indirect
+	github.com/rcrowley/go-metrics v0.0.0-20250401214520-65e299d6c5c9 // indirect
+	github.com/rivo/uniseg v0.4.7 // indirect
+	github.com/rubenv/sql-migrate v1.8.0 // indirect
 	github.com/russross/blackfriday/v2 v2.1.0 // indirect
-	github.com/sagikazarmark/locafero v0.4.0 // indirect
-	github.com/sagikazarmark/slog-shim v0.1.0 // indirect
+	github.com/sagikazarmark/locafero v0.9.0 // indirect
 	github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 // indirect
 	github.com/shopspring/decimal v1.4.0 // indirect
 	github.com/sirupsen/logrus v1.9.3 // indirect
-	github.com/skeema/knownhosts v1.3.0 // indirect
+	github.com/skeema/knownhosts v1.3.1 // indirect
 	github.com/sourcegraph/conc v0.3.0 // indirect
-	github.com/spf13/afero v1.11.0 // indirect
-	github.com/spf13/cast v1.7.0 // indirect
-	github.com/stoewer/go-strcase v1.2.0 // indirect
+	github.com/spf13/afero v1.14.0 // indirect
+	github.com/spf13/cast v1.8.0 // indirect
+	github.com/stoewer/go-strcase v1.3.0 // indirect
 	github.com/subosito/gotenv v1.6.0 // indirect
-	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
+	github.com/tchap/go-patricia/v2 v2.3.2 // indirect
+	github.com/vbatts/tar-split v0.12.1 // indirect
 	github.com/x448/float16 v0.8.4 // indirect
 	github.com/xanzy/ssh-agent v0.3.3 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
@@ -221,159 +222,52 @@ require (
 	github.com/xeipuuv/gojsonschema v1.2.0 // indirect
 	github.com/xlab/treeprint v1.2.0 // indirect
 	github.com/yashtewari/glob-intersection v0.2.0 // indirect
-	go.etcd.io/etcd/api/v3 v3.5.14 // indirect
-	go.etcd.io/etcd/client/pkg/v3 v3.5.14 // indirect
-	go.etcd.io/etcd/client/v3 v3.5.14 // indirect
-	go.mongodb.org/mongo-driver v1.17.1 // indirect
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0 // indirect
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0 // indirect
-	go.opentelemetry.io/otel v1.28.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0 // indirect
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0 // indirect
-	go.opentelemetry.io/otel/metric v1.28.0 // indirect
-	go.opentelemetry.io/otel/sdk v1.28.0 // indirect
-	go.opentelemetry.io/otel/trace v1.28.0 // indirect
-	go.opentelemetry.io/proto/otlp v1.3.1 // indirect
-	go.starlark.net v0.0.0-20230525235612-a134d8f9ddca // indirect
+	go.etcd.io/etcd/api/v3 v3.6.0 // indirect
+	go.etcd.io/etcd/client/pkg/v3 v3.6.0 // indirect
+	go.etcd.io/etcd/client/v3 v3.6.0 // indirect
+	go.mongodb.org/mongo-driver v1.17.3 // indirect
+	go.opentelemetry.io/auto/sdk v1.1.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.60.0 // indirect
+	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.60.0 // indirect
+	go.opentelemetry.io/otel v1.36.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.36.0 // indirect
+	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.36.0 // indirect
+	go.opentelemetry.io/otel/metric v1.36.0 // indirect
+	go.opentelemetry.io/otel/sdk v1.36.0 // indirect
+	go.opentelemetry.io/otel/trace v1.36.0 // indirect
+	go.opentelemetry.io/proto/otlp v1.6.0 // indirect
+	go.uber.org/automaxprocs v1.6.0 // indirect
 	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.26.0 // indirect
-	golang.org/x/mod v0.21.0 // indirect
-	golang.org/x/sync v0.10.0 // indirect
-	golang.org/x/sys v0.31.0 // indirect
-	golang.org/x/term v0.30.0 // indirect
-	golang.org/x/text v0.23.0 // indirect
-	golang.org/x/time v0.7.0 // indirect
-	golang.org/x/tools v0.26.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/genproto/googleapis/api v0.0.0-20240814211410-ddb44dafa142 // indirect
-	google.golang.org/genproto/googleapis/rpc v0.0.0-20240814211410-ddb44dafa142 // indirect
-	google.golang.org/grpc v1.67.1 // indirect
-	google.golang.org/protobuf v1.35.2 // indirect
-	gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d // indirect
+	go.uber.org/zap v1.27.0 // indirect
+	golang.org/x/mod v0.24.0 // indirect
+	golang.org/x/sync v0.14.0 // indirect
+	golang.org/x/sys v0.33.0 // indirect
+	golang.org/x/term v0.32.0 // indirect
+	golang.org/x/text v0.25.0 // indirect
+	golang.org/x/time v0.11.0 // indirect
+	golang.org/x/tools v0.33.0 // indirect
+	gomodules.xyz/jsonpatch/v2 v2.5.0 // indirect
+	google.golang.org/genproto/googleapis/api v0.0.0-20250528174236-200df99c418a // indirect
+	google.golang.org/genproto/googleapis/rpc v0.0.0-20250528174236-200df99c418a // indirect
+	google.golang.org/grpc v1.72.2 // indirect
+	google.golang.org/protobuf v1.36.6 // indirect
 	gopkg.in/evanphx/json-patch.v4 v4.12.0 // indirect
 	gopkg.in/inf.v0 v0.9.1 // indirect
-	gopkg.in/ini.v1 v1.67.0 // indirect
 	gopkg.in/warnings.v0 v0.1.2 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	k8s.io/gengo/v2 v2.0.0-20240228010128-51d4e06bde70 // indirect
-	k8s.io/kms v0.31.2 // indirect
-	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.30.3 // indirect
-	sigs.k8s.io/json v0.0.0-20221116044647-bc3834ca7abd // indirect
-	sigs.k8s.io/kustomize/api v0.17.2 // indirect
-	sigs.k8s.io/kustomize/kyaml v0.17.1 // indirect
-	sigs.k8s.io/structured-merge-diff/v4 v4.4.1 // indirect
+	k8s.io/gengo/v2 v2.0.0-20250529001416-3d5256650f36 // indirect
+	k8s.io/kms v0.33.1 // indirect
+	oras.land/oras-go/v2 v2.6.0 // indirect
+	sigs.k8s.io/apiserver-network-proxy/konnectivity-client v0.32.1 // indirect
+	sigs.k8s.io/json v0.0.0-20241014173422-cfa47c3a1cc8 // indirect
+	sigs.k8s.io/kustomize/api v0.19.0 // indirect
+	sigs.k8s.io/kustomize/kyaml v0.19.0 // indirect
+	sigs.k8s.io/randfill v1.0.0 // indirect
+	sigs.k8s.io/structured-merge-diff/v4 v4.7.0 // indirect
 )
 
 replace (
-	code.cloudfoundry.org/bytefmt => code.cloudfoundry.org/bytefmt v0.0.0-20190710193110-1eb035ffe2b6
-	github.com/Azure/go-ansiterm => github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1
-	github.com/Masterminds/semver/v3 => github.com/Masterminds/semver/v3 v3.3.0
-	github.com/Microsoft/go-winio => github.com/Microsoft/go-winio v0.6.2
-	github.com/asaskevich/govalidator => github.com/asaskevich/govalidator v0.0.0-20230301143203-a9d515a09cc2
-	github.com/aws/aws-sdk-go => github.com/aws/aws-sdk-go v1.55.5
-	github.com/containerd/containerd => github.com/containerd/containerd v1.7.27
-	github.com/davecgh/go-spew => github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc
-	github.com/docker/cli => github.com/docker/cli v27.1.0+incompatible
-	github.com/docker/distribution => github.com/docker/distribution v2.8.3+incompatible
-	github.com/docker/docker => github.com/docker/docker v27.3.1+incompatible
-	github.com/docker/docker-credential-helpers => github.com/docker/docker-credential-helpers v0.7.0
-	github.com/docker/go-connections => github.com/docker/go-connections v0.5.0
-	github.com/docker/go-units => github.com/docker/go-units v0.5.0
-	github.com/emicklei/go-restful-openapi/v2 => github.com/emicklei/go-restful-openapi/v2 v2.9.2-0.20230928201233-d828a4fc267c
-	github.com/emicklei/go-restful/v3 => github.com/emicklei/go-restful/v3 v3.11.0
-	github.com/evanphx/json-patch/v5 => github.com/evanphx/json-patch/v5 v5.9.0
-	github.com/fsnotify/fsnotify => github.com/fsnotify/fsnotify v1.7.0
-	github.com/go-git/go-git/v5 => github.com/go-git/go-git/v5 v5.13.0
-	github.com/go-jose/go-jose/v4 => github.com/go-jose/go-jose/v4 v4.0.5
-	github.com/go-ldap/ldap => github.com/go-ldap/ldap v3.0.3+incompatible
-	github.com/go-logr/logr => github.com/go-logr/logr v1.4.2
-	github.com/go-openapi/analysis => github.com/go-openapi/analysis v0.21.4
-	github.com/go-openapi/errors => github.com/go-openapi/errors v0.20.2
-	github.com/go-openapi/jsonpointer => github.com/go-openapi/jsonpointer v0.19.6
-	github.com/go-openapi/jsonreference => github.com/go-openapi/jsonreference v0.20.2
-	github.com/go-openapi/loads => github.com/go-openapi/loads v0.21.2
-	github.com/go-openapi/spec => github.com/go-openapi/spec v0.20.9
-	github.com/go-openapi/strfmt => github.com/go-openapi/strfmt v0.21.3
-	github.com/go-openapi/swag => github.com/go-openapi/swag v0.22.4
-	github.com/go-openapi/validate => github.com/go-openapi/validate v0.22.0
-	github.com/go-redis/redis => github.com/go-redis/redis v6.15.2+incompatible
-	github.com/gogo/protobuf => github.com/gogo/protobuf v1.3.2
-	github.com/golang-jwt/jwt/v4 => github.com/golang-jwt/jwt/v4 v4.5.1
-	github.com/golang/example => github.com/golang/example v0.0.0-20170904185048-46695d81d1fa
-	github.com/golang/glog => github.com/golang/glog v1.2.4
-	github.com/golang/protobuf => github.com/golang/protobuf v1.5.4
-	github.com/google/go-cmp => github.com/google/go-cmp v0.6.0
-	github.com/google/go-containerregistry => github.com/google/go-containerregistry v0.14.0
-	github.com/google/gofuzz => github.com/google/gofuzz v1.2.0
-	github.com/google/gops => github.com/google/gops v0.3.23
-	github.com/google/uuid => github.com/google/uuid v1.6.0
-	github.com/gorilla/websocket => github.com/gorilla/websocket v1.5.1
-	github.com/hashicorp/golang-lru => github.com/hashicorp/golang-lru v1.0.2
-	github.com/inconshreveable/mousetrap => github.com/inconshreveable/mousetrap v1.1.0
-	github.com/jbenet/go-context => github.com/jbenet/go-context v0.0.0-20150711004518-d14ea06fba99
-	github.com/josharian/intern => github.com/josharian/intern v1.0.0
-	github.com/json-iterator/go => github.com/json-iterator/go v1.1.12
-	github.com/mailru/easyjson => github.com/mailru/easyjson v0.7.7
-	github.com/mitchellh/go-homedir => github.com/mitchellh/go-homedir v1.1.0
-	github.com/mitchellh/mapstructure => github.com/mitchellh/mapstructure v1.5.0
-	github.com/moby/term => github.com/moby/term v0.5.0
-	github.com/modern-go/concurrent => github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd
-	github.com/modern-go/reflect2 => github.com/modern-go/reflect2 v1.0.2
-	github.com/oklog/ulid => github.com/oklog/ulid v1.3.1
-	github.com/oliveagle/jsonpath => github.com/oliveagle/jsonpath v0.0.0-20180606110733-2e52cf6e6852
-	github.com/onsi/ginkgo/v2 => github.com/onsi/ginkgo/v2 v2.20.1
-	github.com/onsi/gomega => github.com/onsi/gomega v1.34.2
-	github.com/open-policy-agent/opa => github.com/open-policy-agent/opa v0.70.0
-	github.com/opencontainers/go-digest => github.com/opencontainers/go-digest v1.0.0
-	github.com/opencontainers/image-spec => github.com/opencontainers/image-spec v1.1.0
-	github.com/pkg/errors => github.com/pkg/errors v0.9.1
-	github.com/pmezard/go-difflib => github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2
-	github.com/sirupsen/logrus => github.com/sirupsen/logrus v1.9.3
-	github.com/sony/sonyflake => github.com/sony/sonyflake v1.2.0
-	github.com/speps/go-hashids => github.com/speps/go-hashids v2.0.0+incompatible
-	github.com/spf13/cobra => github.com/spf13/cobra v1.8.1
-	github.com/spf13/pflag => github.com/spf13/pflag v1.0.5
-	github.com/spf13/viper => github.com/spf13/viper v1.18.2
-	github.com/stretchr/testify => github.com/stretchr/testify v1.10.0
-	go.mongodb.org/mongo-driver => go.mongodb.org/mongo-driver v1.17.1
-	go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc => go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc v0.53.0
-	go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp => go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp v0.53.0
-	go.opentelemetry.io/otel => go.opentelemetry.io/otel v1.28.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace => go.opentelemetry.io/otel/exporters/otlp/otlptrace v1.28.0
-	go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc => go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc v1.28.0
-	go.opentelemetry.io/otel/metric => go.opentelemetry.io/otel/metric v1.28.0
-	go.opentelemetry.io/otel/sdk => go.opentelemetry.io/otel/sdk v1.28.0
-	go.opentelemetry.io/otel/trace => go.opentelemetry.io/otel/trace v1.28.0
-	golang.org/x/crypto => golang.org/x/crypto v0.32.0
-	golang.org/x/net => golang.org/x/net v0.37.0
-	golang.org/x/oauth2 => golang.org/x/oauth2 v0.21.0
-	golang.org/x/sync => golang.org/x/sync v0.1.0
-	golang.org/x/sys => golang.org/x/sys v0.26.0
-	golang.org/x/text => golang.org/x/text v0.19.0
-	golang.org/x/tools => golang.org/x/tools v0.26.0
-	google.golang.org/grpc => google.golang.org/grpc v1.67.1
-	google.golang.org/protobuf => google.golang.org/protobuf v1.34.2
-	gopkg.in/asn1-ber.v1 => gopkg.in/asn1-ber.v1 v1.0.0-20181015200546-f715ec2f112d
-	gopkg.in/cas.v2 => gopkg.in/cas.v2 v2.2.0
-	gopkg.in/warnings.v0 => gopkg.in/warnings.v0 v0.1.2
-	gopkg.in/yaml.v2 => gopkg.in/yaml.v2 v2.4.0
-	gopkg.in/yaml.v3 => gopkg.in/yaml.v3 v3.0.1
-	helm.sh/helm/v3 => helm.sh/helm/v3 v3.16.2
-	k8s.io/api => k8s.io/api v0.31.2
-	k8s.io/apiextensions-apiserver => k8s.io/apiextensions-apiserver v0.31.2
-	k8s.io/apimachinery => k8s.io/apimachinery v0.31.2
-	k8s.io/apiserver => k8s.io/apiserver v0.31.2
-	k8s.io/client-go => k8s.io/client-go v0.31.2
-	k8s.io/component-base => k8s.io/component-base v0.31.2
-	k8s.io/klog/v2 => k8s.io/klog/v2 v2.130.1
-	k8s.io/kms => k8s.io/kms v0.31.2
-	k8s.io/kube-openapi => k8s.io/kube-openapi v0.0.0-20240228011516-70dd3763d340
-	k8s.io/utils => k8s.io/utils v0.0.0-20240711033017-18e509b52bc8
 	kubesphere.io/api => ./staging/src/kubesphere.io/api
 	kubesphere.io/client-go => ./staging/src/kubesphere.io/client-go
 	kubesphere.io/utils => ./staging/src/kubesphere.io/utils
-	oras.land/oras-go => oras.land/oras-go v1.2.6
-	sigs.k8s.io/controller-runtime => sigs.k8s.io/controller-runtime v0.19.1
-	sigs.k8s.io/controller-tools => sigs.k8s.io/controller-tools v0.16.5
-	sigs.k8s.io/yaml => sigs.k8s.io/yaml v1.4.0
 )

go.work

@@ -0,0 +1,10 @@
+go 1.24.3
+
+godebug default=go1.24
+
+use (
+	.
+	./staging/src/kubesphere.io/api
+	./staging/src/kubesphere.io/client-go
+	./staging/src/kubesphere.io/utils
+)

go.work.sum

@@ -0,0 +1,192 @@
+cloud.google.com/go v0.38.0 h1:ROfEUZz+Gh5pa62DJWXSaonyu3StP6EA6lPEXPI6mCo=
+cloud.google.com/go/compute/metadata v0.6.0 h1:A6hENjEsCDtC1k8byVsgwvVcioamEHvZ4j01OwKxG9I=
+github.com/AdamKorcz/go-118-fuzz-build v0.0.0-20230306123547-8075edf89bb0 h1:59MxjQVfjXsBpLy+dbd2/ELV5ofnUkUZBvWSC85sheA=
+github.com/Azure/go-autorest/autorest v0.9.0 h1:MRvx8gncNaXJqOoLmhNjUAKh33JJF8LyxPhomEtOsjs=
+github.com/Azure/go-autorest/autorest/adal v0.5.0 h1:q2gDruN08/guU9vAjuPWff0+QIrpH6ediguzdAzXAUU=
+github.com/Azure/go-autorest/autorest/date v0.1.0 h1:YGrhWfrgtFs84+h0o46rJrlmsZtyZRg470CqAXTZaGM=
+github.com/Azure/go-autorest/autorest/mocks v0.2.0 h1:Ww5g4zThfD/6cLb4z6xxgeyDa7QDkizMkJKe0ysZXp0=
+github.com/Azure/go-autorest/logger v0.1.0 h1:ruG4BSDXONFRrZZJ2GUXDiUyVpayPmb1GnWeHDdaNKY=
+github.com/Azure/go-autorest/tracing v0.5.0 h1:TRn4WjSnkcSy5AEG3pnbtFSwNtwzjr4VYyQflFE619k=
+github.com/BurntSushi/xgb v0.0.0-20160522181843-27f122750802 h1:1BDTz0u9nC3//pOCMdNH+CiXJVYJh5UQNCOBG7jbELc=
+github.com/GoogleCloudPlatform/opentelemetry-operations-go/detectors/gcp v1.26.0 h1:f2Qw/Ehhimh5uO1fayV0QIW7DShEQqhtUfhYc+cBPlw=
+github.com/Masterminds/vcs v1.13.3 h1:IIA2aBdXvfbIM+yl/eTnL4hb1XwdpvuQLglAix1gweE=
+github.com/PuerkitoBio/purell v1.1.1 h1:WEQqlqaGbrPkxLJWfBwQmfEAE1Z7ONdDLqrN38tNFfI=
+github.com/PuerkitoBio/urlesc v0.0.0-20170810143723-de5bf2ad4578 h1:d+Bc7a5rLufV/sSk/8dngufqelfh6jnri85riMAaF/M=
+github.com/alecthomas/kingpin/v2 v2.4.0 h1:f48lwail6p8zpO1bC4TxtqACaGqHYA22qkHjHpqDjYY=
+github.com/alecthomas/template v0.0.0-20160405071501-a0175ee3bccc h1:cAKDfWh5VpdgMhJosfJnn5/FoN2SRZ4p7fJNX58YPaU=
+github.com/alecthomas/units v0.0.0-20211218093645-b94a6e3cc137 h1:s6gZFSlWYmbqAuRjVTiNNhvNRfY2Wxp9nhfyel4rklc=
+github.com/andreyvit/diff v0.0.0-20170406064948-c7f18ee00883 h1:bvNMNQO63//z+xNgfBlViaCIJKLlCJ6/fmUseuG0wVQ=
+github.com/antihax/optional v1.0.0 h1:xK2lYat7ZLaVVcIuj82J8kIro4V6kDe0AUDFboUCwcg=
+github.com/armon/consul-api v0.0.0-20180202201655-eb2c6b5be1b6 h1:G1bPvciwNyF7IUmKXNt9Ak3m6u9DE1rF+RmtIkBpVdA=
+github.com/armon/go-radix v1.0.0 h1:F4z6KzEeeQIMeLFa97iZU6vupzoecKdU5TX24SNppXI=
+github.com/bgentry/speakeasy v0.1.0 h1:ByYyxL9InA1OWqxJqqp2A5pYHUrCiAL6K3J+LKSsQkY=
+github.com/bwesterb/go-ristretto v1.2.3 h1:1w53tCkGhCQ5djbat3+MH0BAQ5Kfgbt56UZQ/JMzngw=
+github.com/chzyer/readline v1.5.1 h1:upd/6fQk4src78LMRzh5vItIt361/o4uq553V8B5sGI=
+github.com/cilium/ebpf v0.9.1 h1:64sn2K3UKw8NbP/blsixRpF3nXuyhz/VjRlRzvlBRu4=
+github.com/client9/misspell v0.3.4 h1:ta993UF76GwbvJcIo3Y68y/M3WxlpEHPWIGDkJYwzJI=
+github.com/cncf/xds/go v0.0.0-20250121191232-2f005788dc42 h1:Om6kYQYDUk5wWbT0t0q6pvyM49i9XZAv9dDrkDA7gjk=
+github.com/cockroachdb/datadriven v0.0.0-20190809214429-80d97fb3cbaa h1:OaNxuTZr7kxeODyLWsRMC+OD03aFUH+mW6r2d+MWa5Y=
+github.com/containerd/aufs v1.0.0 h1:2oeJiwX5HstO7shSrPZjrohJZLzK36wvpdmzDRkL/LY=
+github.com/containerd/btrfs/v2 v2.0.0 h1:FN4wsx7KQrYoLXN7uLP0vBV4oVWHOIKDRQ1G2Z0oL5M=
+github.com/containerd/cgroups/v3 v3.0.2 h1:f5WFqIVSgo5IZmtTT3qVBo6TzI1ON6sycSBKkymb9L0=
+github.com/containerd/console v1.0.3 h1:lIr7SlA5PxZyMV30bDW0MGbiOPXwc63yRuCP0ARubLw=
+github.com/containerd/containerd/api v1.8.0 h1:hVTNJKR8fMc/2Tiw60ZRijntNMd1U+JVMyTRdsD2bS0=
+github.com/containerd/fifo v1.1.0 h1:4I2mbh5stb1u6ycIABlBw9zgtlK8viPI9QkQNRQEEmY=
+github.com/containerd/go-cni v1.1.9 h1:ORi7P1dYzCwVM6XPN4n3CbkuOx/NZ2DOqy+SHRdo9rU=
+github.com/containerd/go-runc v1.0.0 h1:oU+lLv1ULm5taqgV/CJivypVODI4SUz1znWjv3nNYS0=
+github.com/containerd/imgcrypt v1.1.8 h1:ZS7TuywcRNLoHpU0g+v4/PsKynl6TYlw5xDVWWoIyFA=
+github.com/containerd/nri v0.8.0 h1:n1S753B9lX8RFrHYeSgwVvS1yaUcHjxbB+f+xzEncRI=
+github.com/containerd/ttrpc v1.2.7 h1:qIrroQvuOL9HQ1X6KHe2ohc7p+HP/0VE6XPU7elJRqQ=
+github.com/containerd/typeurl v1.0.2 h1:Chlt8zIieDbzQFzXzAeBEF92KhExuE4p9p92/QmY7aY=
+github.com/containerd/typeurl/v2 v2.2.0 h1:6NBDbQzr7I5LHgp34xAXYF5DOTQDn05X58lsPEmzLso=
+github.com/containerd/zfs v1.1.0 h1:n7OZ7jZumLIqNJqXrEc/paBM840mORnmGdJDmAmJZHM=
+github.com/containernetworking/cni v1.1.2 h1:wtRGZVv7olUHMOqouPpn3cXJWpJgM6+EUl31EQbXALQ=
+github.com/containernetworking/plugins v1.2.0 h1:SWgg3dQG1yzUo4d9iD8cwSVh1VqI+bP7mkPDoSfP9VU=
+github.com/containers/ocicrypt v1.1.10 h1:r7UR6o8+lyhkEywetubUUgcKFjOWOaWz8cEBrCPX0ic=
+github.com/coreos/bbolt v1.3.1-coreos.6 h1:uTXKg9gY70s9jMAKdfljFQcuh4e/BXOM+V+d00KFj3A=
+github.com/coreos/etcd v3.3.15+incompatible h1:+9RjdC18gMxNQVvSiXvObLu29mOFmkgdsB4cRTlV+EE=
+github.com/coreos/go-etcd v2.0.0+incompatible h1:bXhRBIXoTm9BYHS3gE0TtQuyNZyeEMux2sDi4oo5YOo=
+github.com/coreos/go-oidc v2.3.0+incompatible h1:+5vEsrgprdLjjQ9FzIKAzQz1wwPD+83hQRfUIPh7rO0=
+github.com/coreos/go-systemd v0.0.0-20190321100706-95778dfbb74e h1:Wf6HqHfScWJN9/ZjdUKyjop4mf3Qdd+1TvvltAvM3m8=
+github.com/coreos/pkg v0.0.0-20180108230652-97fdf19511ea h1:n2Ltr3SrfQlf/9nOna1DoGKxLx3qTSI8Ttl6Xrqp6mw=
+github.com/cpuguy83/go-md2man v1.0.10 h1:BSKMNlYxDvnunlTymqtgONjNnaRV1sTpcovwwjF22jk=
+github.com/cpuguy83/go-md2man/v2 v2.0.7 h1:zbFlGlXEAKlwXpmvle3d8Oe3YnkKIK4xSRTd3sHPnBo=
+github.com/danieljoos/wincred v1.2.2 h1:774zMFJrqaeYCK2W57BgAem/MLi6mtSE47MB6BOJ0i0=
+github.com/denisenkom/go-mssqldb v0.9.0 h1:RSohk2RsiZqLZ0zCjtfn3S4Gp4exhpBWHyQ7D0yGjAk=
+github.com/dgrijalva/jwt-go v3.2.0+incompatible h1:7qlOGliEKZXTDg6OTjfoBKDXWrumCAMpl/TFQ4/5kLM=
+github.com/docker/spdystream v0.0.0-20160310174837-449fdfce4d96 h1:cenwrSVm+Z7QLSV/BsnenAOcDXdX4cMv4wP0B/5QbPg=
+github.com/docopt/docopt-go v0.0.0-20180111231733-ee0de3bc6815 h1:bWDMxwH3px2JBh6AyO7hdCn/PkvCZXii8TGj7sbtEbQ=
+github.com/emicklei/go-restful v2.9.5+incompatible h1:spTtZBk5DYEvbxMVutUuTyh1Ao2r4iyvLdACqsl/Ljk=
+github.com/envoyproxy/go-control-plane v0.13.4 h1:zEqyPVyku6IvWCFwux4x9RxkLOMUL+1vC9xUFv5l2/M=
+github.com/envoyproxy/go-control-plane/envoy v1.32.4 h1:jb83lalDRZSpPWW2Z7Mck/8kXZ5CQAFYVjQcdVIr83A=
+github.com/envoyproxy/go-control-plane/ratelimit v0.1.0 h1:/G9QYbddjL25KvtKTv3an9lx6VBE2cnb8wp1vEGNYGI=
+github.com/envoyproxy/protoc-gen-validate v1.2.1 h1:DEo3O99U8j4hBFwbJfrz9VtgcDfUKS7KJ7spH3d86P8=
+github.com/fatih/camelcase v1.0.0 h1:hxNvNX/xYBp0ovncs8WyWZrOrpBNub/JfaMvbURyft8=
+github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yngAk=
+github.com/globalsign/mgo v0.0.0-20181015135952-eeefdecb41b8 h1:DujepqpGd1hyOd7aW59XpK7Qymp8iy83xq74fLr21is=
+github.com/go-jose/go-jose/v3 v3.0.3 h1:fFKWeig/irsp7XD2zBxvnmA/XaRWp5V3CBsZXJF7G7k=
+github.com/go-kit/kit v0.8.0 h1:Wz+5lgoB0kkuqLEc6NVmwRknTKP6dTGbSqvhZtBI/j0=
+github.com/go-logfmt/logfmt v0.6.0 h1:wGYYu3uicYdqXVgoYbvnkrPVXkuLM1p1ifugDMEdRi4=
+github.com/go-ole/go-ole v1.2.6 h1:/Fpf6oFPoeFik9ty7siob0G6Ke8QvQEuVcuChpwXzpY=
+github.com/go-openapi/runtime v0.19.4 h1:csnOgcgAiuGoM/Po7PEpKDoNulCcF3FGbSnbHfxgjMI=
+github.com/go-stack/stack v1.8.0 h1:5SgMzNM5HxrEjV0ww2lTmX6E2Izsfxas4+YHWRs3Lsk=
+github.com/godbus/dbus/v5 v5.1.0 h1:4KLkAxT3aOY8Li4FRJe/KvhoNFFxo0m6fNuFUO8QJUk=
+github.com/godror/godror v0.40.4 h1:X1e7hUd02GDaLWKZj40Z7L0CP0W9TrGgmPQZw6+anBg=
+github.com/godror/knownpb v0.1.1 h1:A4J7jdx7jWBhJm18NntafzSC//iZDHkDi1+juwQ5pTI=
+github.com/gofrs/flock v0.12.1 h1:MTLVXXHf8ekldpJk3AKicLij9MdwOWkZ+a/jHHZby9E=
+github.com/golang-sql/civil v0.0.0-20190719163853-cb61b32ac6fe h1:lXe2qZdvpiX5WZkZR4hgp4KJVfY3nMkvmwbVkpv1rVY=
+github.com/golang/mock v1.2.0 h1:28o5sBqPkBsMGnC6b4MvE2TzSr5/AT4c/1fLqVGIwlk=
+github.com/golang/snappy v0.0.4 h1:yAGX7huGHXlcLOEtBnF4w7FQwA26wojNCwOYAEhLjQM=
+github.com/google/martian v2.1.0+incompatible h1:/CP5g8u/VJHijgedC/Legn3BAbAaWPgecwXBIDzw5no=
+github.com/googleapis/gax-go/v2 v2.0.4 h1:hU4mGcQI4DaAYW+IbTun+2qEZVFxK0ySjQLTbS0VQKc=
+github.com/googleapis/gnostic v0.3.1 h1:WeAefnSUHlBb0iJKwxFDZdbfGwkd7xRNuV+IpXMJhYk=
+github.com/gophercloud/gophercloud v0.1.0 h1:P/nh25+rzXouhytV2pUHBb65fnds26Ghl8/391+sT5o=
+github.com/grpc-ecosystem/go-grpc-middleware/providers/prometheus v1.0.1 h1:qnpSQwGEnkcRpTqNOIR6bJbR0gAorgP9CSALpRcKoAA=
+github.com/grpc-ecosystem/go-grpc-middleware/v2 v2.1.0 h1:pRhl55Yx1eC7BZ1N+BBWwnKaMyD8uC+34TLdndZMAKk=
+github.com/hashicorp/hcl v1.0.0 h1:0Anlzjpi4vEasTeNFn2mLJgTSwt0+6sfsiTG8qcWGx4=
+github.com/hpcloud/tail v1.0.0 h1:nfCOvKYfkgYP8hkirhJocXT2+zOD8yUNjXaWfTlyFKI=
+github.com/ianlancetaylor/demangle v0.0.0-20250417193237-f615e6bd150b h1:ogbOPx86mIhFy764gGkqnkFC8m5PJA7sPzlk9ppLVQA=
+github.com/imdario/mergo v0.3.13 h1:lFzP57bqS/wsqKssCGmtLAb8A0wKjLGrve2q3PPVcBk=
+github.com/intel/goresctrl v0.5.0 h1:kcDhjE3ZF/mNrJuRzLS3LY2Hp6atFaF1XVFBT7SVL2g=
+github.com/jessevdk/go-flags v1.6.1 h1:Cvu5U8UGrLay1rZfv/zP7iLpSHGUZ/Ou68T0iX1bBK4=
+github.com/jpillora/backoff v1.0.0 h1:uvFg412JmmHBHw7iwprIxkPMI+sGQ4kzOWsMeHnm2EA=
+github.com/jstemmer/go-junit-report v0.0.0-20190106144839-af01ea7f8024 h1:rBMNdlhTLzJjJSDIjNEXX1Pz3Hmwmz91v+zycvx9PJc=
+github.com/julienschmidt/httprouter v1.3.0 h1:U0609e9tgbseu3rBINet9P48AI/D3oJs4dN7jwJOQ1U=
+github.com/keybase/go-keychain v0.0.1 h1:way+bWYa6lDppZoZcgMbYsvC7GxljxrskdNInRtuthU=
+github.com/kisielk/errcheck v1.5.0 h1:e8esj/e4R+SAOwFwN+n3zr0nYeCyeweozKfO23MvHzY=
+github.com/kisielk/gotool v1.0.0 h1:AV2c/EiW3KqPNT9ZKl07ehoAGi4C5/01Cfbblndcapg=
+github.com/klauspost/cpuid/v2 v2.0.4 h1:g0I61F2K2DjRHz1cnxlkNSBIaePVoJIjjnHui8QHbiw=
+github.com/konsorten/go-windows-terminal-sequences v1.0.1 h1:mweAR1A6xJ3oS2pRaGiHgQ4OO8tzTaLawm8vnODuwDk=
+github.com/kr/logfmt v0.0.0-20140226030751-b84e30acd515 h1:T+h1c/A9Gawja4Y9mFVWj2vyii2bbUNDw3kt9VxK2EY=
+github.com/kr/pty v1.1.5 h1:hyz3dwM5QLc1Rfoz4FuWJQG5BN7tc6K1MndAUnGpQr4=
+github.com/lithammer/dedent v1.1.0 h1:VNzHMVCBNG1j0fh3OrsFRkVUwStdDArbgBWoPAffktY=
+github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 h1:6E+4a0GO5zZEnZ81pIr0yLvtUWk2if982qA3F3QD6H4=
+github.com/magefile/mage v1.14.0 h1:6QDX3g6z1YvJ4olPhT1wksUcSa/V0a1B+pJb73fBjyo=
+github.com/magiconair/properties v1.8.0 h1:LLgXmsheXeRoUOBOjtwPQCWIYqM/LU1ayDtDePerRcY=
+github.com/mattn/go-oci8 v0.1.1 h1:aEUDxNAyDG0tv8CA3TArnDQNyc4EhnWlsfxRgDHABHM=
+github.com/mattn/go-shellwords v1.0.12 h1:M2zGm7EW6UQJvDeQxo4T51eKPurbeFbe8WtebGE2xrk=
+github.com/matttproud/golang_protobuf_extensions v1.0.4 h1:mmDVorXM7PCGKw94cs5zkfA9PSy5pEvNWRP0ET0TIVo=
+github.com/miekg/pkcs11 v1.1.1 h1:Ugu9pdy6vAYku5DEpVWVFPYnzV+bxB+iRdbuFSu7TvU=
+github.com/minio/sha256-simd v1.0.0 h1:v1ta+49hkWZyvaKwrQB8elexRqm6Y0aMLjCNsrYxo6g=
+github.com/mistifyio/go-zfs/v3 v3.0.1 h1:YaoXgBePoMA12+S1u/ddkv+QqxcfiZK4prI6HPnkFiU=
+github.com/mitchellh/cli v1.1.5 h1:OxRIeJXpAMztws/XHlN2vu6imG5Dpq+j61AzAX5fLng=
+github.com/moby/sys/signal v0.7.0 h1:25RW3d5TnQEoKvRbEKUGay6DCQ46IxAVTT9CUMgmsSI=
+github.com/moby/sys/symlink v0.2.0 h1:tk1rOM+Ljp0nFmfOIBtlV3rTDlWOwFRhjEeAhZB0nZc=
+github.com/moby/sys/user v0.3.0 h1:9ni5DlcW5an3SvRSx4MouotOygvzaXbaSrc/wGDFWPo=
+github.com/montanaflynn/stats v0.7.1 h1:etflOAAHORrCC44V+aR6Ftzort912ZU+YLiSTuV8eaE=
+github.com/mwitkow/go-conntrack v0.0.0-20190716064945-2f068394615f h1:KUppIJq7/+SVif2QVs3tOP0zanoHgBEVAwHxUSIzRqU=
+github.com/nelsam/hel/v2 v2.3.3 h1:Z3TAKd9JS3BoKi6fW+d1bKD2Mf0FzTqDUEAwLWzYPRQ=
+github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e h1:fD57ERR4JtEqsWbfPhv4DMiApHyliiK5xCTNVSPiaAs=
+github.com/olekukonko/tablewriter v0.0.5 h1:P2Ga83D34wi1o9J6Wh1mRuqd4mF/x/lgBS7N7AbDhec=
+github.com/opencontainers/runtime-spec v1.1.0 h1:HHUyrt9mwHUjtasSbXSMvs4cyFxh+Bll4AjJ9odEGpg=
+github.com/opencontainers/runtime-tools v0.9.1-0.20221107090550-2e043c6bd626 h1:DmNGcqH3WDbV5k8OJ+esPWbqUOX5rMLR2PMvziDMJi0=
+github.com/opencontainers/selinux v1.11.0 h1:+5Zbo97w3Lbmb3PeqQtpmTkMwsW5nRI3YaLpt7tQ7oU=
+github.com/pborman/uuid v1.2.0 h1:J7Q5mO4ysT1dv8hyrUGHb9+ooztCXu1D8MY8DZYsu3g=
+github.com/pelletier/go-toml v1.9.5 h1:4yBQzkHv+7BHq2PQUZF3Mx0IYxG7LsP222s7Agd3ve8=
+github.com/peterh/liner v1.2.2 h1:aJ4AOodmL+JxOZZEL2u9iJf8omNRpqHc/EbrK+3mAXw=
+github.com/planetscale/vtprotobuf v0.6.1-0.20240319094008-0393e58bdf10 h1:GFCKgmp0tecUJ0sJuv4pzYCqS9+RGSn52M3FUwPs+uo=
+github.com/posener/complete v1.2.3 h1:NP0eAhjcjImqslEwo/1hq7gpajME0fTLTezBKDqfXqo=
+github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c h1:ncq/mPwQF4JjgDlrVEn3C11VoGHZN7m8qihwgMEtzYw=
+github.com/pquerna/cachecontrol v0.1.0 h1:yJMy84ti9h/+OEWa752kBTKv4XC30OtVVHYv/8cTqKc=
+github.com/remyoudompheng/bigfft v0.0.0-20170806203942-52369c62f446 h1:/NRJ5vAYoqz+7sG51ubIDHXeWO8DlTSrToPu6q11ziA=
+github.com/rogpeppe/fastuuid v1.2.0 h1:Ppwyp6VYCF1nvBTXL3trRso7mXMlRrw9ooo375wvi2s=
+github.com/russross/blackfriday v1.6.0 h1:KqfZb0pUVN2lYqZUYRddxF4OR8ZMURnJIG5Y3VRLtww=
+github.com/santhosh-tekuri/jsonschema/v5 v5.3.1 h1:lZUw3E0/J3roVtGQ+SCrUrg3ON6NgVqpn3+iol9aGu4=
+github.com/shirou/gopsutil/v3 v3.23.7 h1:C+fHO8hfIppoJ1WdsVm1RoI0RwXoNdfTK7yWXV0wVj4=
+github.com/shoenig/go-m1cpu v0.1.6 h1:nxdKQNcEB6vzgA2E2bvzKIYRuNj7XNJ4S/aRSwKzFtM=
+github.com/spf13/jwalterweatherman v1.0.0 h1:XHEdyB+EcvlqZamSM4ZOMGlc93t6AcsBEu9Gc1vn7yk=
+github.com/spiffe/go-spiffe/v2 v2.5.0 h1:N2I01KCUkv1FAjZXJMwh95KK1ZIQLYbPfhaxw8WS0hE=
+github.com/stefanberger/go-pkcs11uri v0.0.0-20230803200340-78284954bff6 h1:pnnLyeX7o/5aX8qUQ69P/mLojDqwda8hFOCBTmP/6hw=
+github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635 h1:kdXcSzyDtseVEc4yCz2qF8ZrQvIDBJLl4S1c3GCXmoI=
+github.com/tidwall/pretty v1.0.0 h1:HsD+QiTn7sK6flMKIvNmpqz1qrpP3Ps6jOKIKMooyg4=
+github.com/tklauser/go-sysconf v0.3.11 h1:89WgdJhk5SNwJfu+GKyYveZ4IaJ7xAkecBo+KdJV0CM=
+github.com/tklauser/numcpus v0.6.0 h1:kebhY2Qt+3U6RNK7UqpYNA+tJ23IBEGKkB7JQBfDYms=
+github.com/ugorji/go/codec v0.0.0-20181204163529-d75b2dcb6bc8 h1:3SVOIvH7Ae1KRYyQWRjXWJEA9sS/c/pjvH++55Gr648=
+github.com/urfave/cli v1.22.16 h1:MH0k6uJxdwdeWQTwhSO42Pwr4YLrNLwBtg1MRgTqPdQ=
+github.com/vektah/gqlparser v1.1.2 h1:ZsyLGn7/7jDNI+y4SEhI4yAxRChlv15pUHMjijT+e68=
+github.com/vishvananda/netlink v1.2.1-beta.2 h1:Llsql0lnQEbHj0I1OuKyp8otXp0r3q0mPkuhwHfStVs=
+github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f h1:p4VB7kIXpOQvVn1ZaTIVp+3vuYAXFe3OJEvjbUYJLaA=
+github.com/xdg-go/pbkdf2 v1.0.0 h1:Su7DPu48wXMwC3bs7MCNG+z4FhcyEuz5dlvchbq0B0c=
+github.com/xdg-go/scram v1.1.2 h1:FHX5I5B4i4hKRVRBCFRxq1iQRej7WO3hhBuJf+UUySY=
+github.com/xdg-go/stringprep v1.0.4 h1:XLI/Ng3O1Atzq0oBs3TWm+5ZVgkq2aqdlvP9JtoZ6c8=
+github.com/xhit/go-str2duration/v2 v2.1.0 h1:lxklc02Drh6ynqX+DdPyp5pCKLUQpRT8bp8Ydu2Bstc=
+github.com/xordataexchange/crypt v0.0.3-0.20170626215501-b2862e3d0a77 h1:ESFSdwYZvkeru3RtdrYueztKhOBCSAAzS4Gf+k0tEow=
+github.com/youmark/pkcs8 v0.0.0-20240726163527-a2c0da244d78 h1:ilQV1hzziu+LLM3zUTJ0trRztfwgjqKnBWNtSRkbmwM=
+github.com/yuin/goldmark v1.4.13 h1:fVcFKWvrslecOb/tg+Cc05dkeYx540o0FuFt3nUVDoE=
+github.com/yusufpapurcu/wmi v1.2.3 h1:E1ctvB7uKFMOJw3fdOW32DwGE9I7t++CRUEMKvFoFiw=
+github.com/zeebo/errs v1.4.0 h1:XNdoD/RRMKP7HD0UhJnIzUy74ISdGGxURlYG8HSWSfM=
+go.mozilla.org/pkcs7 v0.0.0-20200128120323-432b2356ecb1 h1:A/5uWzF44DlIgdm/PQFwfMkW0JX+cIcQi/SwLAmZP5M=
+go.opentelemetry.io/contrib/detectors/gcp v1.34.0 h1:JRxssobiPg23otYU5SbWtQC//snGVIM3Tx6QRzlQBao=
+go.uber.org/atomic v1.9.0 h1:ECmE8Bn/WFTYwEW/bpKD3M8VtR/zQVbavAoalC1PYyE=
+golang.org/x/image v0.0.0-20190227222117-0694c2d4d067 h1:KYGJGHOQy8oSi1fDlSpcZF0+juKwk/hEMv5SiwHogR0=
+golang.org/x/lint v0.0.0-20190313153728-d0100b6bd8b3 h1:XQyxROzUlZH+WIQwySDgnISgOivlhjIEwaQaJEJrrN0=
+golang.org/x/mobile v0.0.0-20190312151609-d3739f865fa6 h1:Tus/Y4w3V77xDsGwKUC8a/QrV7jScpU557J77lFffNs=
+golang.org/x/telemetry v0.0.0-20240521205824-bda55230c457 h1:zf5N6UOrA487eEFacMePxjXAJctxKmyjKUsjA11Uzuk=
+golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 h1:go1bK/D/BFZV2I8cIQd1NKEZ+0owSTG1fDTci4IqFcE=
+gonum.org/v1/gonum v0.0.0-20190331200053-3d26580ed485 h1:OB/uP/Puiu5vS5QMRPrXCDWUPb+kt8f1KW8oQzFejQw=
+gonum.org/v1/netlib v0.0.0-20190331212654-76723241ea4e h1:jRyg0XfpwWlhEV8mDfdNGBeSJM2fuyh9Yjrnd8kF2Ts=
+google.golang.org/api v0.4.0 h1:KKgc1aqhV8wDPbDzlDtpvyjZFY3vjz85FP7p4wcQUyI=
+google.golang.org/appengine v1.6.7 h1:FZR1q0exgwxzPzp/aF+VccGrSfxfPpkBqjIIEq3ru6c=
+gopkg.in/alecthomas/kingpin.v2 v2.2.6 h1:jMFz6MfLP0/4fUyZle81rXUoxOBFi19VUFKVDOQfozc=
+gopkg.in/cheggaaa/pb.v1 v1.0.25 h1:Ev7yu1/f6+d+b3pi5vPdRPc6nNtP1umSfcWiEfRqv6I=
+gopkg.in/fsnotify.v1 v1.4.7 h1:xOHLXZwVvI9hhs+cLKq5+I5onOuwQLhQwiu63xxlHs4=
+gopkg.in/go-jose/go-jose.v2 v2.6.3 h1:nt80fvSDlhKWQgSWyHyy5CfmlQr+asih51R8PTWNKKs=
+gopkg.in/resty.v1 v1.12.0 h1:CuXP0Pjfw9rOuY6EP+UvtNvt5DSqHpIxILZKT/quCZI=
+gopkg.in/square/go-jose.v2 v2.2.2 h1:orlkJ3myw8CN1nVQHBFfloD+L3egixIa4FvUP6RosSA=
+honnef.co/go/tools v0.0.0-20190523083050-ea95bdfd59fc h1:/hemPrYIhOhy8zYrNj+069zDB68us2sMGsfkFJO0iZs=
+k8s.io/component-helpers v0.33.1 h1:DdQMww8jOr+sGhIrkz70Lp9Qerq/JzeZDBRd508DHDo=
+k8s.io/cri-api v0.27.1 h1:KWO+U8MfI9drXB/P4oU9VchaWYOlwDglJZVHWMpTT3Q=
+k8s.io/gengo v0.0.0-20190822140433-26a664648505 h1:ZY6yclUKVbZ+SdWnkfY+Je5vrMpKOxmGeKRbsXVmqYM=
+k8s.io/klog v1.0.0 h1:Pt+yjF5aB1xDSVbau4VsWe+dQNzA0qv1LlXdC2dF6Q8=
+k8s.io/metrics v0.33.1 h1:Ypd5ITCf+fM+LDNFk7hESXTc3vh02CQYGiwRoVRaGsM=
+modernc.org/cc v1.0.0 h1:nPibNuDEx6tvYrUAtvDTTw98rx5juGsa5zuDnKwEEQQ=
+modernc.org/golex v1.0.0 h1:wWpDlbK8ejRfSyi0frMyhilD3JBvtcx2AdGDnU+JtsE=
+modernc.org/mathutil v1.0.0 h1:93vKjrJopTPrtTNpZ8XIovER7iCIH1QU7wNbOQXC60I=
+modernc.org/strutil v1.0.0 h1:XVFtQwFVwc02Wk+0L/Z/zDDXO81r5Lhe6iMKmGX3KhE=
+modernc.org/xc v1.0.0 h1:7ccXrupWZIS3twbUGrtKmHS2DXY6xegFua+6O3xgAFU=
+rsc.io/goversion v1.2.0 h1:SPn+NLTiAG7w30IRK/DKp1BjvpWabYgxlLp/+kx5J8w=
+sigs.k8s.io/kustomize/kustomize/v5 v5.6.0 h1:MWtRRDWCwQEeW2rnJTqJMuV6Agy56P53SkbVoJpN7wA=
+sigs.k8s.io/structured-merge-diff v1.0.1-0.20191108220359-b1b620dd3f06 h1:zD2IemQ4LmOcAumeiyDWXKUI2SO0NYDe3H6QGvPOVgU=
+sigs.k8s.io/testing_frameworks v0.1.2 h1:vK0+tvjF0BZ/RYFeZ1E6BYBwHJJXhjuZ3TdsEKH+UQM=
+tags.cncf.io/container-device-interface v0.8.1 h1:c0jN4Mt6781jD67NdPajmZlD1qrqQyov/Xfoab37lj0=
+tags.cncf.io/container-device-interface/specs-go v0.8.0 h1:QYGFzGxvYK/ZLMrjhvY0RjpUavIn4KcmRmVP/JjdBTA=

hack/boilerplate.go.txt

@@ -0,0 +1,2 @@
+// Copyright 2025 The KubeSphere Authors.
+// SPDX-License-Identifier: LicenseRef-KubeSphere-Open-Source

hack/custom-boilerplate.go.txt

@@ -0,0 +1,5 @@
+/*
+ * Copyright 2024 the KubeSphere Authors.
+ * Please refer to the LICENSE file in the root directory of the project.
+ * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
+ */

hack/lib/golang.sh

@@ -1,10 +1,475 @@
 #!/usr/bin/env bash
 
-# This is a modified version of Kubernetes
-KUBE_GO_PACKAGE=kubesphere.io/kubesphere
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# shellcheck disable=SC2034 # Variables sourced in other scripts.
+
+readonly KUBE_GOPATH="${KUBE_GOPATH:-"${KUBE_OUTPUT}/go"}"
+export KUBE_GOPATH
+
+# The server platform we are building on.
+readonly KUBE_SUPPORTED_SERVER_PLATFORMS=(
+  linux/amd64
+  linux/arm64
+)
+
+# The node platforms we build for
+readonly KUBE_SUPPORTED_NODE_PLATFORMS=(
+  linux/amd64
+  linux/arm64
+)
+
+# If we update this we should also update the set of platforms whose standard
+# library is precompiled for in build/build-image/cross/Dockerfile
+readonly KUBE_SUPPORTED_CLIENT_PLATFORMS=(
+  linux/amd64
+  linux/arm64
+)
+
+# Which platforms we should compile test targets for.
+# Not all client platforms need these tests
+readonly KUBE_SUPPORTED_TEST_PLATFORMS=(
+  linux/amd64
+  linux/arm64
+)
+
+# The set of server targets that we are only building for Linux
+kube::golang::server_targets() {
+  local targets=()
+  echo "${targets[@]}"
+}
+
+IFS=" " read -ra KUBE_SERVER_TARGETS <<< "$(kube::golang::server_targets)"
+readonly KUBE_SERVER_TARGETS
+readonly KUBE_SERVER_BINARIES=("${KUBE_SERVER_TARGETS[@]##*/}")
+
+# The set of server targets we build docker images for
+kube::golang::server_image_targets() {
+  # NOTE: this contains cmd targets for kube::build::get_docker_wrapped_binaries
+  local targets=()
+  echo "${targets[@]}"
+}
+
+IFS=" " read -ra KUBE_SERVER_IMAGE_TARGETS <<< "$(kube::golang::server_image_targets)"
+readonly KUBE_SERVER_IMAGE_TARGETS
+readonly KUBE_SERVER_IMAGE_BINARIES=("${KUBE_SERVER_IMAGE_TARGETS[@]##*/}")
+
+# The set of conformance targets we build docker image for
+kube::golang::conformance_image_targets() {
+  # NOTE: this contains cmd targets for kube::release::build_conformance_image
+  local targets=()
+  echo "${targets[@]}"
+}
+
+IFS=" " read -ra KUBE_CONFORMANCE_IMAGE_TARGETS <<< "$(kube::golang::conformance_image_targets)"
+readonly KUBE_CONFORMANCE_IMAGE_TARGETS
+
+# The set of server targets that we are only building for Kubernetes nodes
+kube::golang::node_targets() {
+  local targets=()
+  echo "${targets[@]}"
+}
+
+IFS=" " read -ra KUBE_NODE_TARGETS <<< "$(kube::golang::node_targets)"
+readonly KUBE_NODE_TARGETS
+readonly KUBE_NODE_BINARIES=("${KUBE_NODE_TARGETS[@]##*/}")
+readonly KUBE_NODE_BINARIES_WIN=("${KUBE_NODE_BINARIES[@]/%/.exe}")
+
+# ------------
+# NOTE: All functions that return lists should use newlines.
+# bash functions can't return arrays, and spaces are tricky, so newline
+# separators are the preferred pattern.
+# To transform a string of newline-separated items to an array, use kube::util::read-array:
+# kube::util::read-array FOO < <(kube::golang::dups a b c a)
+#
+# ALWAYS remember to quote your subshells. Not doing so will break in
+# bash 4.3, and potentially cause other issues.
+# ------------
+
+# Returns a sorted newline-separated list containing only duplicated items.
+kube::golang::dups() {
+  # We use printf to insert newlines, which are required by sort.
+  printf "%s\n" "$@" | sort | uniq -d
+}
+
+# Returns a sorted newline-separated list with duplicated items removed.
+kube::golang::dedup() {
+  # We use printf to insert newlines, which are required by sort.
+  printf "%s\n" "$@" | sort -u
+}
+
+# Depends on values of user-facing KUBE_BUILD_PLATFORMS, KUBE_FASTBUILD,
+# and KUBE_BUILDER_OS.
+# Configures KUBE_SERVER_PLATFORMS, KUBE_NODE_PLATFOMRS,
+# KUBE_TEST_PLATFORMS, and KUBE_CLIENT_PLATFORMS, then sets them
+# to readonly.
+# The configured vars will only contain platforms allowed by the
+# KUBE_SUPPORTED* vars at the top of this file.
+declare -a KUBE_SERVER_PLATFORMS
+declare -a KUBE_CLIENT_PLATFORMS
+declare -a KUBE_NODE_PLATFORMS
+declare -a KUBE_TEST_PLATFORMS
+kube::golang::setup_platforms() {
+  if [[ -n "${KUBE_BUILD_PLATFORMS:-}" ]]; then
+    # KUBE_BUILD_PLATFORMS needs to be read into an array before the next
+    # step, or quoting treats it all as one element.
+    local -a platforms
+    IFS=" " read -ra platforms <<< "${KUBE_BUILD_PLATFORMS}"
+
+    # Deduplicate to ensure the intersection trick with kube::golang::dups
+    # is not defeated by duplicates in user input.
+    kube::util::read-array platforms < <(kube::golang::dedup "${platforms[@]}")
+
+    # Use kube::golang::dups to restrict the builds to the platforms in
+    # KUBE_SUPPORTED_*_PLATFORMS. Items should only appear at most once in each
+    # set, so if they appear twice after the merge they are in the intersection.
+    kube::util::read-array KUBE_SERVER_PLATFORMS < <(kube::golang::dups \
+        "${platforms[@]}" \
+        "${KUBE_SUPPORTED_SERVER_PLATFORMS[@]}" \
+      )
+    readonly KUBE_SERVER_PLATFORMS
+
+    kube::util::read-array KUBE_NODE_PLATFORMS < <(kube::golang::dups \
+        "${platforms[@]}" \
+        "${KUBE_SUPPORTED_NODE_PLATFORMS[@]}" \
+      )
+    readonly KUBE_NODE_PLATFORMS
+
+    kube::util::read-array KUBE_TEST_PLATFORMS < <(kube::golang::dups \
+        "${platforms[@]}" \
+        "${KUBE_SUPPORTED_TEST_PLATFORMS[@]}" \
+      )
+    readonly KUBE_TEST_PLATFORMS
+
+    kube::util::read-array KUBE_CLIENT_PLATFORMS < <(kube::golang::dups \
+        "${platforms[@]}" \
+        "${KUBE_SUPPORTED_CLIENT_PLATFORMS[@]}" \
+      )
+    readonly KUBE_CLIENT_PLATFORMS
+
+  elif [[ "${KUBE_FASTBUILD:-}" == "true" ]]; then
+    host_arch=$(kube::util::host_arch)
+    if [[ "${host_arch}" != "amd64" && "${host_arch}" != "arm64" && "${host_arch}" != "ppc64le" && "${host_arch}" != "s390x" ]]; then
+      # on any platform other than amd64, arm64, ppc64le and s390x, we just default to amd64
+      host_arch="amd64"
+    fi
+    KUBE_SERVER_PLATFORMS=("linux/${host_arch}")
+    readonly KUBE_SERVER_PLATFORMS
+    KUBE_NODE_PLATFORMS=("linux/${host_arch}")
+    readonly KUBE_NODE_PLATFORMS
+    if [[ "${KUBE_BUILDER_OS:-}" == "darwin"* ]]; then
+      KUBE_TEST_PLATFORMS=(
+        "darwin/${host_arch}"
+        "linux/${host_arch}"
+      )
+      readonly KUBE_TEST_PLATFORMS
+      KUBE_CLIENT_PLATFORMS=(
+        "darwin/${host_arch}"
+        "linux/${host_arch}"
+      )
+      readonly KUBE_CLIENT_PLATFORMS
+    else
+      KUBE_TEST_PLATFORMS=("linux/${host_arch}")
+      readonly KUBE_TEST_PLATFORMS
+      KUBE_CLIENT_PLATFORMS=("linux/${host_arch}")
+      readonly KUBE_CLIENT_PLATFORMS
+    fi
+  else
+    KUBE_SERVER_PLATFORMS=("${KUBE_SUPPORTED_SERVER_PLATFORMS[@]}")
+    readonly KUBE_SERVER_PLATFORMS
+
+    KUBE_NODE_PLATFORMS=("${KUBE_SUPPORTED_NODE_PLATFORMS[@]}")
+    readonly KUBE_NODE_PLATFORMS
+
+    KUBE_CLIENT_PLATFORMS=("${KUBE_SUPPORTED_CLIENT_PLATFORMS[@]}")
+    readonly KUBE_CLIENT_PLATFORMS
+
+    KUBE_TEST_PLATFORMS=("${KUBE_SUPPORTED_TEST_PLATFORMS[@]}")
+    readonly KUBE_TEST_PLATFORMS
+  fi
+}
+
+kube::golang::setup_platforms
+
+# The set of client targets that we are building for all platforms
+readonly KUBE_CLIENT_TARGETS=(
+  cmd/kubectl
+  cmd/kubectl-convert
+)
+readonly KUBE_CLIENT_BINARIES=("${KUBE_CLIENT_TARGETS[@]##*/}")
+readonly KUBE_CLIENT_BINARIES_WIN=("${KUBE_CLIENT_BINARIES[@]/%/.exe}")
+
+# The set of test targets that we are building for all platforms
+kube::golang::test_targets() {
+  local targets=()
+  echo "${targets[@]}"
+}
+IFS=" " read -ra KUBE_TEST_TARGETS <<< "$(kube::golang::test_targets)"
+readonly KUBE_TEST_TARGETS
+readonly KUBE_TEST_BINARIES=("${KUBE_TEST_TARGETS[@]##*/}")
+readonly KUBE_TEST_BINARIES_WIN=("${KUBE_TEST_BINARIES[@]/%/.exe}")
+readonly KUBE_TEST_PORTABLE=(
+  test/e2e/testing-manifests
+  test/kubemark
+  hack/e2e-internal
+  hack/get-build.sh
+  hack/ginkgo-e2e.sh
+  hack/lib
+)
+
+# Test targets which run on the Kubernetes clusters directly, so we only
+# need to target server platforms.
+# These binaries will be distributed in the kubernetes-test tarball.
+kube::golang::server_test_targets() {
+  local targets=(
+    cmd/kubemark
+    ginkgo
+  )
+
+  if [[ "${OSTYPE:-}" == "linux"* ]]; then
+    targets+=( test/e2e_node/e2e_node.test )
+  fi
+
+  echo "${targets[@]}"
+}
+
+IFS=" " read -ra KUBE_TEST_SERVER_TARGETS <<< "$(kube::golang::server_test_targets)"
+readonly KUBE_TEST_SERVER_TARGETS
+readonly KUBE_TEST_SERVER_BINARIES=("${KUBE_TEST_SERVER_TARGETS[@]##*/}")
+readonly KUBE_TEST_SERVER_PLATFORMS=("${KUBE_SERVER_PLATFORMS[@]:+"${KUBE_SERVER_PLATFORMS[@]}"}")
+
+# Gigabytes necessary for parallel platform builds.
+# As of March 2021 (go 1.16/amd64), the RSS usage is 2GiB by using cached
+# memory of 15GiB.
+# This variable can be overwritten at your own risk.
+# It's defaulting to 20G to provide some headroom.
+readonly KUBE_PARALLEL_BUILD_MEMORY=${KUBE_PARALLEL_BUILD_MEMORY:-20}
+
+readonly KUBE_ALL_TARGETS=(
+  "${KUBE_SERVER_TARGETS[@]}"
+  "${KUBE_CLIENT_TARGETS[@]}"
+  "${KUBE_TEST_TARGETS[@]}"
+  "${KUBE_TEST_SERVER_TARGETS[@]}"
+)
+readonly KUBE_ALL_BINARIES=("${KUBE_ALL_TARGETS[@]##*/}")
+
+readonly KUBE_STATIC_BINARIES=(
+  ks-apiserver
+  ks-controller-manager
+)
+
+# Fully-qualified package names that we want to instrument for coverage information.
+readonly KUBE_COVERAGE_INSTRUMENTED_PACKAGES=()
+
+# KUBE_CGO_OVERRIDES is a space-separated list of binaries which should be built
+# with CGO enabled, assuming CGO is supported on the target platform.
+# This overrides any entry in KUBE_STATIC_BINARIES.
+IFS=" " read -ra KUBE_CGO_OVERRIDES_LIST <<< "${KUBE_CGO_OVERRIDES:-}"
+readonly KUBE_CGO_OVERRIDES_LIST
+# KUBE_STATIC_OVERRIDES is a space-separated list of binaries which should be
+# built with CGO disabled. This is in addition to the list in
+# KUBE_STATIC_BINARIES.
+IFS=" " read -ra KUBE_STATIC_OVERRIDES_LIST <<< "${KUBE_STATIC_OVERRIDES:-}"
+readonly KUBE_STATIC_OVERRIDES_LIST
+
+kube::golang::is_statically_linked() {
+  local e
+  if [[ -n "${KUBE_CGO_OVERRIDES_LIST:+x}" ]]; then
+    for e in "${KUBE_CGO_OVERRIDES_LIST[@]}"; do [[ "${1}" == *"/${e}" ]] && return 1; done;
+  fi
+  for e in "${KUBE_STATIC_BINARIES[@]}"; do [[ "${1}" == *"/${e}" ]] && return 0; done;
+  if [[ -n "${KUBE_STATIC_OVERRIDES_LIST:+x}" ]]; then
+    for e in "${KUBE_STATIC_OVERRIDES_LIST[@]}"; do [[ "${1}" == *"/${e}" ]] && return 0; done;
+  fi
+  return 1;
+}
+
+# kube::golang::best_guess_go_targets takes a list of build targets, which might
+# be Go-style names (e.g. example.com/foo/bar or ./foo/bar) or just local paths
+# (e.g. foo/bar) and produces a respective list (on stdout) of our best guess at
+# Go target names.
+kube::golang::best_guess_go_targets() {
+  local target
+  for target; do
+    if [ "${target}" = "ginkgo" ] ||
+       [ "${target}" = "github.com/onsi/ginkgo/ginkgo" ] ||
+       [ "${target}" = "vendor/github.com/onsi/ginkgo/ginkgo" ]; then
+      # Aliases that build the ginkgo CLI for hack/ginkgo-e2e.sh.
+      # "ginkgo" is the one that is documented in the Makefile. The others
+      # are for backwards compatibility.
+      echo "github.com/onsi/ginkgo/v2/ginkgo"
+      continue
+    fi
+
+    if [[ "${target}" =~ ^([[:alnum:]]+".")+[[:alnum:]]+"/".+ ]]; then
+      # If the target starts with what looks like a domain name, assume it has a
+      # fully-qualified Go package name.
+      echo "${target}"
+      continue
+    fi
+
+    if [[ "${target}" =~ ^vendor/ ]]; then
+      # Strip vendor/ prefix, since we're building in gomodule mode.  This is
+      # for backwards compatibility.
+      echo "${target#"vendor/"}"
+      continue
+    fi
+
+    # If the target starts with "./", assume it is a local path which qualifies
+    # as a Go target name.
+    if [[ "${target}" =~ ^\./ ]]; then
+      echo "${target}"
+      continue
+    fi
+
+    # Otherwise assume it's a relative path (e.g. foo/bar or foo/bar/bar.test).
+    # We probably SHOULDN'T accept this, but we did in the past and it would be
+    # rude to break things if we don't NEED to.  We can't really test if it
+    # exists or not, because the last element might be an output file (e.g.
+    # bar.test) or even "...".
+    echo "./${target}"
+  done
+}
+
+kube::golang::internal::lazy_normalize() {
+  target="$1"
+
+  if [[ "${target}" =~ ^([[:alnum:]]+".")+[[:alnum:]]+"/".+ ]]; then
+    # If the target starts with what looks like a domain name, assume it has a
+    # fully-qualified Go package name.
+    echo "${target}"
+    return
+  fi
+
+  go list -find -e "${target}"
+}
+
+# kube::golang::normalize_go_targets takes a list of build targets, which might
+# be Go-style names (e.g. example.com/foo/bar or ./foo/bar) or just local paths
+# (e.g. foo/bar) and produces a respective list (on stdout) of Go package
+# names.
+#
+# If this cannot find (go list -find -e) one or more inputs, it will emit the
+# them on stdout, so callers can at least get a useful error.
+kube::golang::normalize_go_targets() {
+  local targets=()
+  kube::util::read-array targets < <(kube::golang::best_guess_go_targets "$@")
+  kube::util::read-array targets < <(kube::golang::dedup "${targets[@]}")
+  set -- "${targets[@]}"
+
+  for target; do
+    if [[ "${target}" =~ ".test"$ ]]; then
+      local dir
+      dir="$(dirname "${target}")"
+      local tst
+      tst="$(basename "${target}")"
+      local pkg
+      pkg="$(kube::golang::internal::lazy_normalize "${dir}")"
+      echo "${pkg}/${tst}"
+      continue
+    fi
+    if [[ "${target}" =~ "/..."$ ]]; then
+      local dir
+      dir="$(dirname "${target}")"
+      local pkg
+      pkg="$(kube::golang::internal::lazy_normalize "${dir}")"
+      echo "${pkg}/..."
+      continue
+    fi
+    kube::golang::internal::lazy_normalize "${target}"
+  done
+}
+
+# Asks golang what it thinks the host platform is. The go tool chain does some
+# slightly different things when the target platform matches the host platform.
+kube::golang::host_platform() {
+  echo "$(go env GOHOSTOS)/$(go env GOHOSTARCH)"
+}
+
+# Takes the platform name ($1) and sets the appropriate golang env variables
+# for that platform.
+kube::golang::set_platform_envs() {
+  [[ -n ${1-} ]] || {
+    kube::log::error_exit "!!! Internal error. No platform set in kube::golang::set_platform_envs"
+  }
+
+  export GOOS=${platform%/*}
+  export GOARCH=${platform##*/}
+
+  # Do not set CC when building natively on a platform, only if cross-compiling
+  if [[ $(kube::golang::host_platform) != "$platform" ]]; then
+    # Dynamic CGO linking for other server architectures than host architecture goes here
+    # If you want to include support for more server platforms than these, add arch-specific gcc names here
+    case "${platform}" in
+      "linux/amd64")
+        export CGO_ENABLED=1
+        export CC=${KUBE_LINUX_AMD64_CC:-x86_64-linux-gnu-gcc}
+        ;;
+      "linux/arm")
+        export CGO_ENABLED=1
+        export CC=${KUBE_LINUX_ARM_CC:-arm-linux-gnueabihf-gcc}
+        ;;
+      "linux/arm64")
+        export CGO_ENABLED=1
+        export CC=${KUBE_LINUX_ARM64_CC:-aarch64-linux-gnu-gcc}
+        ;;
+      "linux/ppc64le")
+        export CGO_ENABLED=1
+        export CC=${KUBE_LINUX_PPC64LE_CC:-powerpc64le-linux-gnu-gcc}
+        ;;
+      "linux/s390x")
+        export CGO_ENABLED=1
+        export CC=${KUBE_LINUX_S390X_CC:-s390x-linux-gnu-gcc}
+        ;;
+    esac
+  fi
+
+  # if CC is defined for platform then always enable it
+  ccenv=$(echo "$platform" | awk -F/ '{print "KUBE_" toupper($1) "_" toupper($2) "_CC"}')
+  if [ -n "${!ccenv-}" ]; then
+    export CGO_ENABLED=1
+    export CC="${!ccenv}"
+  fi
+}
 
 # Ensure the go tool exists and is a viable version.
-kube::golang::verify_go_version() {
+# Inputs:
+#   env-var GO_VERSION is the desired go version to use, downloading it if needed (defaults to content of .go-version)
+#   env-var FORCE_HOST_GO set to a non-empty value uses the go version in the $PATH and skips ensuring $GO_VERSION is used
+kube::golang::internal::verify_go_version() {
+  # default GO_VERSION to content of .go-version
+  GO_VERSION="${GO_VERSION:-"$(cat "${KUBE_ROOT}/.go-version")"}"
+  if [ "${GOTOOLCHAIN:-auto}" != 'auto' ]; then
+    # no-op, just respect GOTOOLCHAIN
+    :
+  elif [ -n "${FORCE_HOST_GO:-}" ]; then
+    # ensure existing host version is used, like before GOTOOLCHAIN existed
+    export GOTOOLCHAIN='local'
+  else
+    # otherwise, we want to ensure the go version matches GO_VERSION
+    GOTOOLCHAIN="go${GO_VERSION}"
+    export GOTOOLCHAIN
+    # if go is either not installed or too old to respect GOTOOLCHAIN then use gimme
+    if ! (command -v go >/dev/null && [ "$(go version | cut -d' ' -f3)" = "${GOTOOLCHAIN}" ]); then
+      export GIMME_ENV_PREFIX=${GIMME_ENV_PREFIX:-"${KUBE_OUTPUT}/.gimme/envs"}
+      export GIMME_VERSION_PREFIX=${GIMME_VERSION_PREFIX:-"${KUBE_OUTPUT}/.gimme/versions"}
+      # eval because the output of this is shell to set PATH etc.
+      eval "$("${KUBE_ROOT}/third_party/gimme/gimme" "${GO_VERSION}")"
+    fi
+  fi
+
   if [[ -z "$(command -v go)" ]]; then
     kube::log::usage_from_stdin <<EOF
 Can't find 'go' in PATH, please fix and retry.
@@ -14,9 +479,9 @@ EOF
   fi
 
   local go_version
-  IFS=" " read -ra go_version <<< "$(go version)"
+  IFS=" " read -ra go_version <<< "$(GOFLAGS='' go version)"
   local minimum_go_version
-  minimum_go_version=go1.20
+  minimum_go_version=go1.23
   if [[ "${minimum_go_version}" != $(echo -e "${minimum_go_version}\n${go_version[2]}" | sort -s -t. -k 1,1 -k 2,2n -k 3,3n | head -n1) && "${go_version[2]}" != "devel" ]]; then
     kube::log::usage_from_stdin <<EOF
 Detected go version: ${go_version[*]}.
@@ -27,38 +492,440 @@ EOF
   fi
 }
 
-# Prints the value that needs to be passed to the -ldflags parameter of go build
-# in order to set the Kubernetes based on the git tree status.
-# IMPORTANT: if you update any of these, also update the lists in
-# pkg/version/def.bzl and hack/print-workspace-status.sh.
-kube::version::ldflags() {
-  kube::version::get_version_vars
+# kube::golang::setup_env will check that the `go` commands is available in
+# ${PATH}. It will also check that the Go version is good enough for the
+# Kubernetes build.
+#
+# Outputs:
+#   env-var GOPATH points to our local output dir
+#   env-var GOBIN is unset (we want binaries in a predictable place)
+#   env-var PATH includes the local GOPATH
+kube::golang::setup_env() {
+  # Even in module mode, we need to set GOPATH for `go build` and `go install`
+  # to work.  We build various tools (usually via `go install`) from a lot of
+  # scripts.
+  #   * We can't just set GOBIN because that does not work on cross-compiles.
+  #   * We could always use `go build -o <something>`, but it's subtle wrt
+  #     cross-compiles and whether the <something> is a file or a directory,
+  #     and EVERY caller has to get it *just* right.
+  #   * We could leave GOPATH alone and let `go install` write binaries
+  #     wherever the user's GOPATH says (or doesn't say).
+  #
+  # Instead we set it to a phony local path and process the results ourselves.
+  # In particular, GOPATH[0]/bin will be used for `go install`, with
+  # cross-compiles adding an extra directory under that.
+  export GOPATH="${KUBE_GOPATH}"
 
-  local -a ldflags
-  function add_ldflag() {
-    local key=${1}
-    local val=${2}
-    # If you update these, also update the list component-base/version/def.bzl.
-    ldflags+=(
-      "-X '${KUBE_GO_PACKAGE}/pkg/version.${key}=${val}'"
-    )
-  }
+  # If these are not set, set them now.  This ensures that any subsequent
+  # scripts we run (which may call this function again) use the same values.
+  export GOCACHE="${GOCACHE:-"${KUBE_GOPATH}/cache/build"}"
+  export GOMODCACHE="${GOMODCACHE:-"${KUBE_GOPATH}/cache/mod"}"
 
-  add_ldflag "buildDate" "$(date ${SOURCE_DATE_EPOCH:+"--date=@${SOURCE_DATE_EPOCH}"} -u +'%Y-%m-%dT%H:%M:%SZ')"
-  if [[ -n ${KUBE_GIT_COMMIT-} ]]; then
-    add_ldflag "gitCommit" "${KUBE_GIT_COMMIT}"
-    add_ldflag "gitTreeState" "${KUBE_GIT_TREE_STATE}"
-  fi
+  # Make sure our own Go binaries are in PATH.
+  export PATH="${KUBE_GOPATH}/bin:${PATH}"
 
-  if [[ -n ${KUBE_GIT_VERSION-} ]]; then
-    add_ldflag "gitVersion" "${KUBE_GIT_VERSION}"
-  fi
+  # Unset GOBIN in case it already exists in the current session.
+  # Cross-compiles will not work with it set.
+  unset GOBIN
 
-  if [[ -n ${KUBE_GIT_MAJOR-} && -n ${KUBE_GIT_MINOR-} ]]; then
-    add_ldflag "gitMajor" "${KUBE_GIT_MAJOR}"
-    add_ldflag "gitMinor" "${KUBE_GIT_MINOR}"
-  fi
+  # Turn on modules and workspaces (both are default-on).
+  unset GO111MODULE
+  unset GOWORK
 
-  # The -ldflags parameter takes a single string, so join the output.
-  echo "${ldflags[*]-}"
+  # This may try to download our specific Go version.  Do it last so it uses
+  # the above-configured environment.
+  kube::golang::internal::verify_go_version
+}
+
+# kube::golang::hack_tools_gotoolchain outputs the value to use for $GOTOOLCHAIN,
+# using $KUBE_HACK_TOOLS_GOTOOLCHAIN if set, falling back to $GOTOOLCHAIN if set,
+# or outputting the empty string.
+#
+# Use this when installing / building tools specified in the hack/tools module:
+# GOTOOLCHAIN="$(kube::golang::hack_tools_gotoolchain)" go install ...
+kube::golang::hack_tools_gotoolchain() {
+  local hack_tools_gotoolchain="${GOTOOLCHAIN:-}"
+  if [ -n "${KUBE_HACK_TOOLS_GOTOOLCHAIN:-}" ]; then
+     hack_tools_gotoolchain="${KUBE_HACK_TOOLS_GOTOOLCHAIN}";
+  fi
+  echo -n "${hack_tools_gotoolchain}"
+}
+
+kube::golang::setup_gomaxprocs() {
+  # GOMAXPROCS by default does not reflect the number of cpu(s) available
+  # when running in a container, please see https://github.com/golang/go/issues/33803
+  if [[ -z "${GOMAXPROCS:-}" ]]; then
+    if ! command -v ncpu >/dev/null 2>&1; then
+      GOTOOLCHAIN="$(kube::golang::hack_tools_gotoolchain)" go -C "${KUBE_ROOT}/hack/tools" install ./ncpu || echo "Will not automatically set GOMAXPROCS"
+    fi
+    if command -v ncpu >/dev/null 2>&1; then
+      GOMAXPROCS=$(ncpu)
+      export GOMAXPROCS
+      kube::log::status "Set GOMAXPROCS automatically to ${GOMAXPROCS}"
+    fi
+  fi
+}
+
+# This will take binaries from $GOPATH/bin and copy them to the appropriate
+# place in ${KUBE_OUTPUT_BIN}
+#
+# Ideally this wouldn't be necessary and we could just set GOBIN to
+# KUBE_OUTPUT_BIN but that won't work in the face of cross compilation.  'go
+# install' will place binaries that match the host platform directly in $GOBIN
+# while placing cross compiled binaries into `platform_arch` subdirs.  This
+# complicates pretty much everything else we do around packaging and such.
+kube::golang::place_bins() {
+  local host_platform
+  host_platform=$(kube::golang::host_platform)
+
+  V=2 kube::log::status "Placing binaries"
+
+  local platform
+  for platform in "${KUBE_CLIENT_PLATFORMS[@]}"; do
+    # The substitution on platform_src below will replace all slashes with
+    # underscores.  It'll transform darwin/amd64 -> darwin_amd64.
+    local platform_src="/${platform//\//_}"
+    if [[ "${platform}" == "${host_platform}" ]]; then
+      platform_src=""
+      rm -f "${THIS_PLATFORM_BIN}"
+      mkdir -p "$(dirname "${THIS_PLATFORM_BIN}")"
+      ln -s "${KUBE_OUTPUT_BIN}/${platform}" "${THIS_PLATFORM_BIN}"
+    fi
+
+    V=3 kube::log::status "Placing binaries for ${platform} in ${KUBE_OUTPUT_BIN}/${platform}"
+    local full_binpath_src="${KUBE_GOPATH}/bin${platform_src}"
+    if [[ -d "${full_binpath_src}" ]]; then
+      mkdir -p "${KUBE_OUTPUT_BIN}/${platform}"
+      find "${full_binpath_src}" -maxdepth 1 -type f -exec \
+        rsync -pc {} "${KUBE_OUTPUT_BIN}/${platform}" \;
+    fi
+  done
+}
+
+# Try and replicate the native binary placement of go install without
+# calling go install.
+kube::golang::outfile_for_binary() {
+  local binary=$1
+  local platform=$2
+  local output_path="${KUBE_GOPATH}/bin"
+  local bin
+  bin=$(basename "${binary}")
+  if [[ "${platform}" != "${host_platform}" ]]; then
+    output_path="${output_path}/${platform//\//_}"
+  fi
+  if [[ ${GOOS} == "windows" ]]; then
+    bin="${bin}.exe"
+  fi
+  echo "${output_path}/${bin}"
+}
+
+# Argument: the name of a Kubernetes package.
+# Returns 0 if the binary can be built with coverage, 1 otherwise.
+# NB: this ignores whether coverage is globally enabled or not.
+kube::golang::is_instrumented_package() {
+  if kube::util::array_contains "$1" "${KUBE_COVERAGE_INSTRUMENTED_PACKAGES[@]}"; then
+    return 0
+  fi
+  # Some cases, like `make kubectl`, pass $1 as "./cmd/kubectl" rather than
+  # "k8s.io/kubernetes/kubectl".  Try to normalize and handle that.  We don't
+  # do this always because it is a bit slow.
+  pkg=$(go list -find "$1")
+  if kube::util::array_contains "${pkg}" "${KUBE_COVERAGE_INSTRUMENTED_PACKAGES[@]}"; then
+    return 0
+  fi
+  return 1
+}
+
+# Argument: the name of a Kubernetes package (e.g. k8s.io/kubernetes/cmd/kube-scheduler)
+# Echos the path to a dummy test used for coverage information.
+kube::golang::path_for_coverage_dummy_test() {
+  local package="$1"
+  local path
+  path=$(go list -find -f '{{.Dir}}' "${package}")
+  local name
+  name=$(basename "${package}")
+  echo "${path}/zz_generated_${name}_test.go"
+}
+
+# Argument: the name of a Kubernetes package (e.g. k8s.io/kubernetes/cmd/kube-scheduler).
+# Creates a dummy unit test on disk in the source directory for the given package.
+# This unit test will invoke the package's standard entry point when run.
+kube::golang::create_coverage_dummy_test() {
+  local package="$1"
+  local name
+  name="$(basename "${package}")"
+  cat <<EOF > "$(kube::golang::path_for_coverage_dummy_test "${package}")"
+package main
+import (
+  "testing"
+  "k8s.io/kubernetes/pkg/util/coverage"
+)
+
+func TestMain(m *testing.M) {
+  // Get coverage running
+  coverage.InitCoverage("${name}")
+
+  // Go!
+  main()
+
+  // Make sure we actually write the profiling information to disk, if we make it here.
+  // On long-running services, or anything that calls os.Exit(), this is insufficient,
+  // so we also flush periodically with a default period of five seconds (configurable by
+  // the KUBE_COVERAGE_FLUSH_INTERVAL environment variable).
+  coverage.FlushCoverage()
+}
+EOF
+}
+
+# Argument: the name of a Kubernetes package (e.g. k8s.io/kubernetes/cmd/kube-scheduler).
+# Deletes a test generated by kube::golang::create_coverage_dummy_test.
+# It is not an error to call this for a nonexistent test.
+kube::golang::delete_coverage_dummy_test() {
+  local package="$1"
+  rm -f "$(kube::golang::path_for_coverage_dummy_test "${package}")"
+}
+
+# Arguments: a list of kubernetes packages to build.
+# Expected variables: ${build_args} should be set to an array of Go build arguments.
+# In addition, ${package} and ${platform} should have been set earlier, and if
+# ${KUBE_BUILD_WITH_COVERAGE} is set, coverage instrumentation will be enabled.
+#
+# Invokes Go to actually build some packages. If coverage is disabled, simply invokes
+# go install. If coverage is enabled, builds covered binaries using go test, temporarily
+# producing the required unit test files and then cleaning up after itself.
+# Non-covered binaries are then built using go install as usual.
+#
+# See comments in kube::golang::setup_env regarding where built binaries go.
+kube::golang::build_some_binaries() {
+  if [[ -n "${KUBE_BUILD_WITH_COVERAGE:-}" ]]; then
+    local -a uncovered=()
+    for package in "$@"; do
+      if kube::golang::is_instrumented_package "${package}"; then
+        V=2 kube::log::info "Building ${package} with coverage..."
+
+        kube::golang::create_coverage_dummy_test "${package}"
+        kube::util::trap_add "kube::golang::delete_coverage_dummy_test \"${package}\"" EXIT
+
+        go test -c -o "$(kube::golang::outfile_for_binary "${package}" "${platform}")" \
+          -covermode count \
+          -coverpkg k8s.io/... \
+          "${build_args[@]}" \
+          -tags coverage \
+          "${package}"
+      else
+        uncovered+=("${package}")
+      fi
+    done
+    if [[ "${#uncovered[@]}" != 0 ]]; then
+      V=2 kube::log::info "Building ${uncovered[*]} without coverage..."
+      GOPROXY=off go install "${build_args[@]}" "${uncovered[@]}"
+    else
+      V=2 kube::log::info "Nothing to build without coverage."
+    fi
+  else
+    V=2 kube::log::info "Coverage is disabled."
+    GOPROXY=off go install "${build_args[@]}" "$@"
+  fi
+}
+
+# Args:
+#  $1: platform (e.g. darwin/amd64)
+kube::golang::build_binaries_for_platform() {
+  # This is for sanity.  Without it, user umasks can leak through.
+  umask 0022
+
+  local platform=$1
+
+  local -a statics=()
+  local -a nonstatics=()
+  local -a tests=()
+
+  for binary in "${binaries[@]}"; do
+    if [[ "${binary}" =~ ".test"$ ]]; then
+      tests+=("${binary}")
+      kube::log::info "    ${binary} (test)"
+    elif kube::golang::is_statically_linked "${binary}"; then
+      statics+=("${binary}")
+      kube::log::info "    ${binary} (static)"
+    else
+      nonstatics+=("${binary}")
+      kube::log::info "    ${binary} (non-static)"
+    fi
+   done
+
+  V=2 kube::log::info "Env for ${platform}: GOPATH=${GOPATH-} GOOS=${GOOS-} GOARCH=${GOARCH-} GOROOT=${GOROOT-} CGO_ENABLED=${CGO_ENABLED-} CC=${CC-}"
+  V=3 kube::log::info "Building binaries with GCFLAGS=${gogcflags} LDFLAGS=${goldflags}"
+
+  local -a build_args
+  if [[ "${#statics[@]}" != 0 ]]; then
+    build_args=(
+      -installsuffix=static
+      ${goflags:+"${goflags[@]}"}
+      -gcflags="${gogcflags}"
+      -ldflags="${goldflags}"
+      -tags="${gotags:-}"
+    )
+    CGO_ENABLED=0 kube::golang::build_some_binaries "${statics[@]}"
+  fi
+
+  if [[ "${#nonstatics[@]}" != 0 ]]; then
+    build_args=(
+      ${goflags:+"${goflags[@]}"}
+      -gcflags="${gogcflags}"
+      -ldflags="${goldflags}"
+      -tags="${gotags:-}"
+    )
+    kube::golang::build_some_binaries "${nonstatics[@]}"
+  fi
+
+  for test in "${tests[@]:+${tests[@]}}"; do
+    local outfile testpkg
+    outfile=$(kube::golang::outfile_for_binary "${test}" "${platform}")
+    testpkg=$(dirname "${test}")
+
+    mkdir -p "$(dirname "${outfile}")"
+    go test -c \
+      ${goflags:+"${goflags[@]}"} \
+      -gcflags="${gogcflags}" \
+      -ldflags="${goldflags}" \
+      -tags="${gotags:-}" \
+      -o "${outfile}" \
+      "${testpkg}"
+  done
+}
+
+# Return approximate physical memory available in gigabytes.
+kube::golang::get_physmem() {
+  local mem
+
+  # Linux kernel version >=3.14, in kb
+  if mem=$(grep MemAvailable /proc/meminfo | awk '{ print $2 }'); then
+    echo $(( mem / 1048576 ))
+    return
+  fi
+
+  # Linux, in kb
+  if mem=$(grep MemTotal /proc/meminfo | awk '{ print $2 }'); then
+    echo $(( mem / 1048576 ))
+    return
+  fi
+
+  # OS X, in bytes. Note that get_physmem, as used, should only ever
+  # run in a Linux container (because it's only used in the multiple
+  # platform case, which is a Dockerized build), but this is provided
+  # for completeness.
+  if mem=$(sysctl -n hw.memsize 2>/dev/null); then
+    echo $(( mem / 1073741824 ))
+    return
+  fi
+
+  # If we can't infer it, just give up and assume a low memory system
+  echo 1
+}
+
+# Build binaries targets specified
+#
+# Input:
+#   $@ - targets and go flags.  If no targets are set then all binaries targets
+#     are built.
+#   KUBE_BUILD_PLATFORMS - Incoming variable of targets to build for.  If unset
+#     then just the host architecture is built.
+kube::golang::build_binaries() {
+  V=2 kube::log::info "Go version: $(GOFLAGS='' go version)"
+
+  local host_platform
+  host_platform=$(kube::golang::host_platform)
+
+  # These are "local" but are visible to and relied on by functions this
+  # function calls.  They are effectively part of the calling API to
+  # build_binaries_for_platform.
+  local goflags goldflags gogcflags gotags
+
+  goflags=()
+  gogcflags="${GOGCFLAGS:-}"
+  goldflags="all=$(kube::version::ldflags) ${GOLDFLAGS:-}"
+
+  if [[ "${DBG:-}" == 1 ]]; then
+      # Debugging - disable optimizations and inlining and trimPath
+      gogcflags="${gogcflags} all=-N -l"
+  else
+      # Not debugging - disable symbols and DWARF, trim embedded paths
+      goldflags="${goldflags} -s -w"
+      goflags+=("-trimpath")
+  fi
+
+  # Extract tags if any specified in GOFLAGS
+  gotags="selinux,notest,$(echo "${GOFLAGS:-}" | sed -ne 's|.*-tags=\([^-]*\).*|\1|p')"
+
+  local -a targets=()
+  local arg
+
+  for arg; do
+    if [[ "${arg}" == -* ]]; then
+      # Assume arguments starting with a dash are flags to pass to go.
+      goflags+=("${arg}")
+    else
+      targets+=("${arg}")
+    fi
+  done
+
+  local -a platforms
+  IFS=" " read -ra platforms <<< "${KUBE_BUILD_PLATFORMS:-}"
+  if [[ ${#platforms[@]} -eq 0 ]]; then
+    platforms=("${host_platform}")
+  fi
+
+  if [[ ${#targets[@]} -eq 0 ]]; then
+    targets=("${KUBE_ALL_TARGETS[@]}")
+  fi
+  kube::util::read-array targets < <(kube::golang::dedup "${targets[@]}")
+
+  local -a binaries
+  kube::util::read-array binaries < <(kube::golang::normalize_go_targets "${targets[@]}")
+  kube::util::read-array binaries < <(kube::golang::dedup "${binaries[@]}")
+
+  local parallel=false
+  if [[ ${#platforms[@]} -gt 1 ]]; then
+    local gigs
+    gigs=$(kube::golang::get_physmem)
+
+    if [[ ${gigs} -ge ${KUBE_PARALLEL_BUILD_MEMORY} ]]; then
+      kube::log::status "Multiple platforms requested and available ${gigs}G >= threshold ${KUBE_PARALLEL_BUILD_MEMORY}G, building platforms in parallel"
+      parallel=true
+    else
+      kube::log::status "Multiple platforms requested, but available ${gigs}G < threshold ${KUBE_PARALLEL_BUILD_MEMORY}G, building platforms in serial"
+      parallel=false
+    fi
+  fi
+
+  if [[ "${parallel}" == "true" ]]; then
+    kube::log::status "Building go targets for {${platforms[*]}} in parallel (output will appear in a burst when complete):" "${targets[@]}"
+    local platform
+    for platform in "${platforms[@]}"; do (
+        kube::golang::set_platform_envs "${platform}"
+        kube::log::status "${platform}: build started"
+        kube::golang::build_binaries_for_platform "${platform}"
+        kube::log::status "${platform}: build finished"
+      ) &> "/tmp//${platform//\//_}.build" &
+    done
+
+    local fails=0
+    for job in $(jobs -p); do
+      wait "${job}" || (( fails+=1 ))
+    done
+
+    for platform in "${platforms[@]}"; do
+      cat "/tmp//${platform//\//_}.build"
+    done
+
+    return "${fails}"
+  else
+    for platform in "${platforms[@]}"; do
+      kube::log::status "Building go targets for ${platform}"
+      (
+        kube::golang::set_platform_envs "${platform}"
+        kube::golang::build_binaries_for_platform "${platform}"
+      )
+    done
+  fi
 }

hack/lib/init.sh

@@ -1,35 +1,66 @@
 #!/usr/bin/env bash
 
-# This script is modified version of Kubernetes script
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 set -o errexit
 set -o nounset
 set -o pipefail
 
-export GO111MODULE=auto
+# Short-circuit if init.sh has already been sourced
+[[ $(type -t kube::init::loaded) == function ]] && return 0
+
+# Unset CDPATH so that path interpolation can work correctly
+# https://github.com/kubernetes/kubernetes/issues/52255
+unset CDPATH
 
 # The root of the build/dist directory
 KUBE_ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd -P)"
 
-KUBE_OUTPUT_SUBPATH="${KUBE_OUTPUT_SUBPATH:-_output/local}"
-KUBE_OUTPUT="${KUBE_ROOT}/${KUBE_OUTPUT_SUBPATH}"
-KUBE_OUTPUT_BINPATH="${KUBE_OUTPUT}/bin"
-
+# Where output goes.  We should avoid redefining these anywhere else.
+#
+# KUBE_OUTPUT: the root directory (absolute) where this build should drop any
+#     files (subdirs are encouraged).
+# KUBE_OUTPUT_BIN: the directory in which compiled binaries will be placed,
+#     under OS/ARCH specific subdirs
+# THIS_PLATFORM_BIN: a symlink to the output directory for binaries built for
+#     the current host platform (e.g. build/test tools).
+#
+# Compat: The KUBE_OUTPUT_SUBPATH variable is sometimes passed in by callers.
+# If it is specified, we'll use it in KUBE_OUTPUT.
+_KUBE_OUTPUT_SUBPATH="${KUBE_OUTPUT_SUBPATH:-_output/local}"
+export KUBE_OUTPUT="${KUBE_ROOT}/${_KUBE_OUTPUT_SUBPATH}"
+export KUBE_OUTPUT_BIN="${KUBE_OUTPUT}/bin"
 export THIS_PLATFORM_BIN="${KUBE_ROOT}/_output/bin"
 
+# This controls rsync compression. Set to a value > 0 to enable rsync
+# compression for build container
+KUBE_RSYNC_COMPRESS="${KUBE_RSYNC_COMPRESS:-0}"
+
+# Set no_proxy for localhost if behind a proxy, otherwise,
+# the connections to localhost in scripts will time out
+export no_proxy="127.0.0.1,localhost${no_proxy:+,${no_proxy}}"
+
 source "${KUBE_ROOT}/hack/lib/util.sh"
 source "${KUBE_ROOT}/hack/lib/logging.sh"
-source "${KUBE_ROOT}/hack/lib/version.sh"
-
 
 kube::log::install_errexit
+kube::util::ensure-bash-version
 
+source "${KUBE_ROOT}/hack/lib/version.sh"
 source "${KUBE_ROOT}/hack/lib/golang.sh"
 
-KUBE_OUTPUT_HOSTBIN="${KUBE_OUTPUT_BINPATH}/$(kube::util::host_platform)"
-export KUBE_OUTPUT_HOSTBIN
-
-
 # This emulates "readlink -f" which is not available on MacOS X.
 # Test:
 # T=/tmp/$$.$RANDOM
@@ -109,4 +140,9 @@ kube::realpath() {
     return 1
   fi
   kube::readlinkdashf "${1}"
-}
+}
+
+# Marker function to indicate init.sh has been fully sourced
+kube::init::loaded() {
+  return 0
+}

hack/lib/util.sh

@@ -54,7 +54,7 @@ kube::util::wait_for_url() {
   local i
   for i in $(seq 1 "${times}"); do
     local out
-    if out=$(curl --max-time "${maxtime}" -gkfs "${url}" 2>/dev/null); then
+    if out=$(curl --max-time "${maxtime}" -gkfs "${@:6}" "${url}" 2>/dev/null); then
       kube::log::status "On try ${i}, ${prefix}: ${out}"
       return 0
     fi
@@ -64,6 +64,35 @@ kube::util::wait_for_url() {
   return 1
 }
 
+kube::util::wait_for_url_with_bearer_token() {
+  local url=$1
+  local token=$2
+  local prefix=${3:-}
+  local wait=${4:-1}
+  local times=${5:-30}
+  local maxtime=${6:-1}
+
+  kube::util::wait_for_url "${url}" "${prefix}" "${wait}" "${times}" "${maxtime}" -H "Authorization: Bearer ${token}"
+}
+
+# Example:  kube::util::wait_for_success 120 5 "kubectl get nodes|grep localhost"
+# arguments: wait time, sleep time, shell command
+# returns 0 if the shell command get output, 1 otherwise.
+kube::util::wait_for_success(){
+  local wait_time="$1"
+  local sleep_time="$2"
+  local cmd="$3"
+  while [ "$wait_time" -gt 0 ]; do
+    if eval "$cmd"; then
+      return 0
+    else
+      sleep "$sleep_time"
+      wait_time=$((wait_time-sleep_time))
+    fi
+  done
+  return 1
+}
+
 # Example:  kube::util::trap_add 'echo "in trap DEBUG"' DEBUG
 # See: http://stackoverflow.com/questions/3338030/multiple-bash-traps-for-the-same-signal
 kube::util::trap_add() {
@@ -182,17 +211,29 @@ kube::util::find-binary-for-platform() {
     "${KUBE_ROOT}/_output/local/bin/${platform}/${lookfor}"
     "${KUBE_ROOT}/platforms/${platform}/${lookfor}"
   )
-  # Also search for binary in bazel build tree.
-  # The bazel go rules place some binaries in subtrees like
-  # "bazel-bin/source/path/linux_amd64_pure_stripped/binaryname", so make sure
-  # the platform name is matched in the path.
-  while IFS=$'\n' read -r location; do
-    locations+=("$location");
-  done < <(find "${KUBE_ROOT}/bazel-bin/" -type f -executable \
-    \( -path "*/${platform/\//_}*/${lookfor}" -o -path "*/${lookfor}" \) 2>/dev/null || true)
+
+  # if we're looking for the host platform, add local non-platform-qualified search paths
+  if [[ "${platform}" = "$(kube::util::host_platform)" ]]; then
+    locations+=(
+      "${KUBE_ROOT}/_output/local/go/bin/${lookfor}"
+      "${KUBE_ROOT}/_output/dockerized/go/bin/${lookfor}"
+    );
+  fi
+
+  # looks for $1 in the $PATH
+  if which "${lookfor}" >/dev/null; then
+    local -r local_bin="$(which "${lookfor}")"
+    locations+=( "${local_bin}"  );
+  fi
 
   # List most recently-updated location.
   local -r bin=$( (ls -t "${locations[@]}" 2>/dev/null || true) | head -1 )
+
+  if [[ -z "${bin}" ]]; then
+    kube::log::error "Failed to find binary ${lookfor} for platform ${platform}"
+    return 1
+  fi
+
   echo -n "${bin}"
 }
 
@@ -202,86 +243,40 @@ kube::util::find-binary() {
   kube::util::find-binary-for-platform "$1" "$(kube::util::host_platform)"
 }
 
-# Run all known doc generators (today gendocs and genman for kubectl)
-# $1 is the directory to put those generated documents
-kube::util::gen-docs() {
-  local dest="$1"
-
-  # Find binary
-  gendocs=$(kube::util::find-binary "gendocs")
-  genkubedocs=$(kube::util::find-binary "genkubedocs")
-  genman=$(kube::util::find-binary "genman")
-  genyaml=$(kube::util::find-binary "genyaml")
-  genfeddocs=$(kube::util::find-binary "genfeddocs")
-
-  # TODO: If ${genfeddocs} is not used from anywhere (it isn't used at
-  # least from k/k tree), remove it completely.
-  kube::util::sourced_variable "${genfeddocs}"
-
-  mkdir -p "${dest}/docs/user-guide/kubectl/"
-  "${gendocs}" "${dest}/docs/user-guide/kubectl/"
-  mkdir -p "${dest}/docs/admin/"
-  "${genkubedocs}" "${dest}/docs/admin/" "kube-apiserver"
-  "${genkubedocs}" "${dest}/docs/admin/" "kube-controller-manager"
-  "${genkubedocs}" "${dest}/docs/admin/" "kube-proxy"
-  "${genkubedocs}" "${dest}/docs/admin/" "kube-scheduler"
-  "${genkubedocs}" "${dest}/docs/admin/" "kubelet"
-  "${genkubedocs}" "${dest}/docs/admin/" "kubeadm"
-
-  mkdir -p "${dest}/docs/man/man1/"
-  "${genman}" "${dest}/docs/man/man1/" "kube-apiserver"
-  "${genman}" "${dest}/docs/man/man1/" "kube-controller-manager"
-  "${genman}" "${dest}/docs/man/man1/" "kube-proxy"
-  "${genman}" "${dest}/docs/man/man1/" "kube-scheduler"
-  "${genman}" "${dest}/docs/man/man1/" "kubelet"
-  "${genman}" "${dest}/docs/man/man1/" "kubectl"
-  "${genman}" "${dest}/docs/man/man1/" "kubeadm"
-
-  mkdir -p "${dest}/docs/yaml/kubectl/"
-  "${genyaml}" "${dest}/docs/yaml/kubectl/"
-
-  # create the list of generated files
-  pushd "${dest}" > /dev/null || return 1
-  touch docs/.generated_docs
-  find . -type f | cut -sd / -f 2- | LC_ALL=C sort > docs/.generated_docs
-  popd > /dev/null || return 1
-}
-
-# Removes previously generated docs-- we don't want to check them in. $KUBE_ROOT
-# must be set.
-kube::util::remove-gen-docs() {
-  if [ -e "${KUBE_ROOT}/docs/.generated_docs" ]; then
-    # remove all of the old docs; we don't want to check them in.
-    while read -r file; do
-      rm "${KUBE_ROOT}/${file}" 2>/dev/null || true
-    done <"${KUBE_ROOT}/docs/.generated_docs"
-    # The docs/.generated_docs file lists itself, so we don't need to explicitly
-    # delete it.
-  fi
-}
-
 # Takes a group/version and returns the path to its location on disk, sans
 # "pkg". E.g.:
 # * default behavior: extensions/v1beta1 -> apis/extensions/v1beta1
 # * default behavior for only a group: experimental -> apis/experimental
 # * Special handling for empty group: v1 -> api/v1, unversioned -> api/unversioned
-# * Special handling for groups suffixed with ".k8s.io": foo.k8s.io/v1 -> apis/foo/v1
+# * Special handling for groups suffixed with ".kubesphere.io": foo.kubesphere.io/v1 -> apis/foo/v1
 # * Very special handling for when both group and version are "": / -> api
 #
 # $KUBE_ROOT must be set.
 kube::util::group-version-to-pkg-path() {
   local group_version="$1"
 
-  while IFS=$'\n' read -r api; do
-    if [[ "${api}" = "${group_version/.*k8s.io/}" ]]; then
-      echo "vendor/k8s.io/api/${group_version/.*k8s.io/}"
+  # Make a list of all know APIs by listing their dirs.
+  local apidirs=()
+  kube::util::read-array apidirs < <(
+      cd "${KUBE_ROOT}/staging/src/kubesphere.io/api" || return 1 # make shellcheck happy
+      find . -name types.go -exec dirname {} \; \
+        | sed "s|\./||g" \
+        | LC_ALL=C sort -u)
+
+  # Compare each API dir against the requested GV, and if we find it, no
+  # special handling needed.
+  for api in "${apidirs[@]}"; do
+    # Change "foo.bar.kubesphere.io/v1" -> "foo/v1" notation.
+    local simple_gv="${group_version/.*kubesphere.io/}"
+    if [[ "${api}" = "${simple_gv}" ]]; then
+      echo "staging/src/kubesphere.io/api/${simple_gv}"
       return
     fi
-  done < <(cd "${KUBE_ROOT}/staging/src/k8s.io/api" && find . -name types.go -exec dirname {} \; | sed "s|\./||g" | sort)
+  done
 
   # "v1" is the API GroupVersion
   if [[ "${group_version}" == "v1" ]]; then
-    echo "vendor/k8s.io/api/core/v1"
+    echo "staging/src/kubesphere.io/api/core/v1"
     return
   fi
 
@@ -293,17 +288,11 @@ kube::util::group-version-to-pkg-path() {
     __internal)
       echo "pkg/apis/core"
       ;;
-    meta/v1)
-      echo "vendor/k8s.io/apimachinery/pkg/apis/meta/v1"
+    *.kubesphere.io)
+      echo "pkg/apis/${group_version%.*kubesphere.io}"
       ;;
-    meta/v1beta1)
-      echo "vendor/k8s.io/apimachinery/pkg/apis/meta/v1beta1"
-      ;;
-    *.k8s.io)
-      echo "pkg/apis/${group_version%.*k8s.io}"
-      ;;
-    *.k8s.io/*)
-      echo "pkg/apis/${group_version/.*k8s.io/}"
+    *.kubesphere.io/*)
+      echo "pkg/apis/${group_version/.*kubesphere.io/}"
       ;;
     *)
       echo "pkg/apis/${group_version%__internal}"
@@ -330,7 +319,7 @@ kube::util::gv-to-swagger-name() {
 # repo, e.g. "upstream" or "origin".
 kube::util::git_upstream_remote_name() {
   git remote -v | grep fetch |\
-    grep -E 'github.com[/:]kubernetes/kubernetes|k8s.io/kubernetes' |\
+    grep -E 'github.com[/:]kubesphere/kubesphere|kubesphere.io/kubesphere' |\
     head -n 1 | awk '{print $1}'
 }
 
@@ -429,6 +418,22 @@ function kube::util::test_openssl_installed {
     OPENSSL_BIN=$(command -v openssl)
 }
 
+# Query the API server for client certificate authentication capabilities
+function kube::util::test_client_certificate_authentication_enabled {
+  local output
+  kube::util::test_openssl_installed
+
+  output=$(echo \
+    | "${OPENSSL_BIN}" s_client -connect "127.0.0.1:${SECURE_API_PORT}" 2> /dev/null \
+    | grep -A3 'Acceptable client certificate CA names')
+
+  if [[ "${output}" != *"/CN=127.0.0.1"* ]] && [[ "${output}" != *"CN = 127.0.0.1"* ]]; then
+    echo "API server not configured for client certificate authentication"
+    echo "Output of from acceptable client certificate check: ${output}"
+    exit 1
+  fi
+}
+
 # creates a client CA, args are sudo, dest-dir, ca-id, purpose
 # purpose is dropped in after "key encipherment", you usually want
 # '"client auth"'
@@ -535,8 +540,8 @@ EOF
 EOF
 }
 
-# list_staging_repos outputs a sorted list of repos in staging/src/k8s.io
-# each entry will just be the $repo portion of staging/src/k8s.io/$repo/...
+# list_staging_repos outputs a sorted list of repos in staging/src/kubesphere.io
+# each entry will just be the $repo portion of staging/src/kubesphere.io/$repo/...
 # $KUBE_ROOT must be set.
 function kube::util::list_staging_repos() {
   (
@@ -548,22 +553,18 @@ function kube::util::list_staging_repos() {
 
 # Determines if docker can be run, failures may simply require that the user be added to the docker group.
 function kube::util::ensure_docker_daemon_connectivity {
-  IFS=" " read -ra DOCKER <<< "${DOCKER_OPTS}"
-  # Expand ${DOCKER[@]} only if it's not unset. This is to work around
-  # Bash 3 issue with unbound variable.
-  DOCKER=(docker ${DOCKER[@]:+"${DOCKER[@]}"})
-  if ! "${DOCKER[@]}" info > /dev/null 2>&1 ; then
+  DOCKER_OPTS=${DOCKER_OPTS:-""}
+  IFS=" " read -ra docker_opts <<< "${DOCKER_OPTS}"
+  if ! docker "${docker_opts[@]:+"${docker_opts[@]}"}" info > /dev/null 2>&1 ; then
     cat <<'EOF' >&2
 Can't connect to 'docker' daemon.  please fix and retry.
 
 Possible causes:
   - Docker Daemon not started
     - Linux: confirm via your init system
-    - macOS w/ docker-machine: run `docker-machine ls` and `docker-machine start <name>`
     - macOS w/ Docker for Mac: Check the menu bar and start the Docker application
   - DOCKER_HOST hasn't been set or is set incorrectly
     - Linux: domain socket is used, DOCKER_* should be unset. In Bash run `unset ${!DOCKER_*}`
-    - macOS w/ docker-machine: run `eval "$(docker-machine env <name>)"`
     - macOS w/ Docker for Mac: domain socket is used, DOCKER_* should be unset. In Bash run `unset ${!DOCKER_*}`
   - Other things to check:
     - Linux: User isn't in 'docker' group.  Add and relogin.
@@ -605,6 +606,7 @@ function kube::util::join {
 #  CFSSL_BIN: The path of the installed cfssl binary
 #  CFSSLJSON_BIN: The path of the installed cfssljson binary
 #
+# shellcheck disable=SC2120 # optional parameters
 function kube::util::ensure-cfssl {
   if command -v cfssl &>/dev/null && command -v cfssljson &>/dev/null; then
     CFSSL_BIN=$(command -v cfssl)
@@ -617,7 +619,7 @@ function kube::util::ensure-cfssl {
   if [[ "${host_arch}" != "amd64" ]]; then
     echo "Cannot download cfssl on non-amd64 hosts and cfssl does not appear to be installed."
     echo "Please install cfssl and cfssljson and verify they are in \$PATH."
-    echo "Hint: export PATH=\$PATH:\$GOPATH/bin; go get -u github.com/cloudflare/cfssl/cmd/..."
+    echo "Hint: export PATH=\$PATH:\$GOPATH/bin; go install github.com/cloudflare/cfssl/cmd/...@latest"
     exit 1
   fi
 
@@ -635,12 +637,12 @@ function kube::util::ensure-cfssl {
     kernel=$(uname -s)
     case "${kernel}" in
       Linux)
-        curl --retry 10 -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_linux-amd64
-        curl --retry 10 -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_linux-amd64
+        curl --retry 10 -L -o cfssl https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl_1.5.0_linux_amd64
+        curl --retry 10 -L -o cfssljson https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssljson_1.5.0_linux_amd64
         ;;
       Darwin)
-        curl --retry 10 -L -o cfssl https://pkg.cfssl.org/R1.2/cfssl_darwin-amd64
-        curl --retry 10 -L -o cfssljson https://pkg.cfssl.org/R1.2/cfssljson_darwin-amd64
+        curl --retry 10 -L -o cfssl https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssl_1.5.0_darwin_amd64
+        curl --retry 10 -L -o cfssljson https://github.com/cloudflare/cfssl/releases/download/v1.5.0/cfssljson_1.5.0_darwin_amd64
         ;;
       *)
         echo "Unknown, unsupported platform: ${kernel}." >&2
@@ -655,20 +657,35 @@ function kube::util::ensure-cfssl {
     CFSSLJSON_BIN="${cfssldir}/cfssljson"
     if [[ ! -x ${CFSSL_BIN} || ! -x ${CFSSLJSON_BIN} ]]; then
       echo "Failed to download 'cfssl'. Please install cfssl and cfssljson and verify they are in \$PATH."
-      echo "Hint: export PATH=\$PATH:\$GOPATH/bin; go get -u github.com/cloudflare/cfssl/cmd/..."
+      echo "Hint: export PATH=\$PATH:\$GOPATH/bin; go install github.com/cloudflare/cfssl/cmd/...@latest"
       exit 1
     fi
   popd > /dev/null || return 1
 }
 
-# kube::util::ensure_dockerized
-# Confirms that the script is being run inside a kube-build image
+# kube::util::ensure-docker-buildx
+# Check if we have "docker buildx" commands available
 #
-function kube::util::ensure_dockerized {
-  if [[ -f /kube-build-image ]]; then
+function kube::util::ensure-docker-buildx {
+  # podman returns 0 on `docker buildx version`, docker on `docker buildx`. One of them must succeed.
+  if docker buildx version >/dev/null 2>&1 || docker buildx >/dev/null 2>&1; then
     return 0
   else
-    echo "ERROR: This script is designed to be run inside a kube-build container"
+    echo "ERROR: docker buildx not available. Docker 19.03 or higher is required with experimental features enabled"
+    exit 1
+  fi
+}
+
+# kube::util::ensure-bash-version
+# Check if we are using a supported bash version
+#
+function kube::util::ensure-bash-version {
+  # shellcheck disable=SC2004
+  if ((${BASH_VERSINFO[0]}<4)) || ( ((${BASH_VERSINFO[0]}==4)) && ((${BASH_VERSINFO[1]}<2)) ); then
+    echo "ERROR: This script requires a minimum bash version of 4.2, but got version of ${BASH_VERSINFO[0]}.${BASH_VERSINFO[1]}"
+    if [ "$(uname)" = 'Darwin' ]; then
+      echo "On macOS with homebrew 'brew install bash' is sufficient."
+    fi
     exit 1
   fi
 }
@@ -680,7 +697,10 @@ function kube::util::ensure_dockerized {
 #  SED: The name of the gnu-sed binary
 #
 function kube::util::ensure-gnu-sed {
-  if LANG=C sed --help 2>&1 | grep -q GNU; then
+  # NOTE: the echo below is a workaround to ensure sed is executed before the grep.
+  # see: https://github.com/kubernetes/kubernetes/issues/87251
+  sed_help="$(LANG=C sed --help 2>&1 || true)"
+  if echo "${sed_help}" | grep -q "GNU\|BusyBox"; then
     SED="sed"
   elif command -v gsed &>/dev/null; then
     SED="gsed"
@@ -691,6 +711,27 @@ function kube::util::ensure-gnu-sed {
   kube::util::sourced_variable "${SED}"
 }
 
+# kube::util::ensure-gnu-date
+# Determines which date binary is gnu-date on linux/darwin
+#
+# Sets:
+#  DATE: The name of the gnu-date binary
+#
+function kube::util::ensure-gnu-date {
+  # NOTE: the echo below is a workaround to ensure date is executed before the grep.
+  # see: https://github.com/kubernetes/kubernetes/issues/87251
+  date_help="$(LANG=C date --help 2>&1 || true)"
+  if echo "${date_help}" | grep -q "GNU\|BusyBox"; then
+    DATE="date"
+  elif command -v gdate &>/dev/null; then
+    DATE="gdate"
+  else
+    kube::log::error "Failed to find GNU date as date or gdate. If you are on Mac: brew install coreutils." >&2
+    return 1
+  fi
+  kube::util::sourced_variable "${DATE}"
+}
+
 # kube::util::check-file-in-alphabetical-order <file>
 # Check that the file is in alphabetical order
 #
@@ -712,7 +753,7 @@ function kube::util::check-file-in-alphabetical-order {
 # Checks whether jq is installed.
 function kube::util::require-jq {
   if ! command -v jq &>/dev/null; then
-    echo "jq not found. Please install." 1>&2
+    kube::log::error  "jq not found. Please install."
     return 1
   fi
 }
@@ -728,19 +769,66 @@ function kube::util::md5() {
 
 # kube::util::read-array
 # Reads in stdin and adds it line by line to the array provided. This can be
-# used instead of "mapfile -t", and is bash 3 compatible.
+# used instead of "mapfile -t", and is bash 3 compatible.  If the named array
+# exists and is an array, it will be overwritten.  Otherwise it will be unset
+# and recreated.
 #
 # Assumed vars:
 #   $1 (name of array to create/modify)
 #
 # Example usage:
-# kube::util::read-array files < <(ls -1)
+#   kube::util::read-array files < <(ls -1)
 #
+# When in doubt:
+#  $ W=abc         # a string
+#  $ X=(a b c)     # an array
+#  $ declare -A Y  # an associative array
+#  $ unset Z       # not set at all
+#  $ declare -p W X Y Z
+#  declare -- W="abc"
+#  declare -a X=([0]="a" [1]="b" [2]="c")
+#  declare -A Y
+#  bash: line 26: declare: Z: not found
+#  $ kube::util::read-array W < <(echo -ne "1 1\n2 2\n3 3\n")
+#  bash: W is defined but isn't an array
+#  $ kube::util::read-array X < <(echo -ne "1 1\n2 2\n3 3\n")
+#  $ kube::util::read-array Y < <(echo -ne "1 1\n2 2\n3 3\n")
+#  bash: Y is defined but isn't an array
+#  $ kube::util::read-array Z < <(echo -ne "1 1\n2 2\n3 3\n")
+#  $ declare -p W X Y Z
+#  declare -- W="abc"
+#  declare -a X=([0]="1 1" [1]="2 2" [2]="3 3")
+#  declare -A Y
+#  declare -a Z=([0]="1 1" [1]="2 2" [2]="3 3")
 function kube::util::read-array {
-  local i=0
-  unset -v "$1"
-  while IFS= read -r "$1[i++]"; do :; done
-  eval "[[ \${$1[--i]} ]]" || unset "$1[i]" # ensures last element isn't empty
+  if [[ -z "$1" ]]; then
+    echo "usage: ${FUNCNAME[0]} <varname>" >&2
+    return 1
+  fi
+  if [[ -n $(declare -p "$1" 2>/dev/null) ]]; then
+    if ! declare -p "$1" 2>/dev/null | grep -q '^declare -a'; then
+      echo "${FUNCNAME[0]}: $1 is defined but isn't an array" >&2
+      return 2
+    fi
+  fi
+  # shellcheck disable=SC2034 # this variable _is_ used
+  local __read_array_i=0
+  while IFS= read -r "$1[__read_array_i++]"; do :; done
+  if ! eval "[[ \${$1[--__read_array_i]} ]]"; then
+    unset "$1[__read_array_i]" # ensures last element isn't empty
+  fi
+}
+
+# kube::util::run-in
+# Changes directory to "$1", runs the rest of the arguments, and restores the initial directory
+# Returns 1 if a directory change fails, the result of running the arguments otherwise
+function kube::util::run-in {
+  pushd "$1" > /dev/null || return 1
+  shift
+  "$@"
+  local result=$?
+  popd > /dev/null || return 1
+  return $result
 }
 
 # Some useful colors.

hack/lib/verify-generated.sh

@@ -0,0 +1,68 @@
+#!/usr/bin/env bash
+
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Short-circuit if verify-generated.sh has already been sourced.
+[[ $(type -t kube::verify::generated::loaded) == function ]] && return 0
+
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+# This function verifies whether generated files are up-to-date. The first two
+# parameters are messages that get printed to stderr when changes are found,
+# the rest are the function or command and its parameters for generating files
+# in the work tree.
+#
+# Example: kube::verify::generated "Mock files are out of date" "Please run 'hack/update-mocks.sh'" hack/update-mocks.sh
+kube::verify::generated() {
+  ( # a subshell prevents environment changes from leaking out of this function
+    local failure_header=$1
+    shift
+    local failure_tail=$1
+    shift
+
+    kube::util::ensure_clean_working_dir
+
+    # This sets up the environment, like GOCACHE, which keeps the worktree cleaner.
+    kube::golang::setup_env
+
+    _tmpdir="$(kube::realpath "$(mktemp -d -t "verify-generated-$(basename "$1").XXXXXX")")"
+    git worktree add -f -q "${_tmpdir}" HEAD
+    kube::util::trap_add "git worktree remove -f ${_tmpdir}" EXIT
+    cd "${_tmpdir}"
+
+    # Update generated files.
+    "$@"
+
+    # Test for diffs
+    diffs=$(git status --porcelain | wc -l)
+    if [[ ${diffs} -gt 0 ]]; then
+      if [[ -n "${failure_header}" ]]; then
+        echo "${failure_header}" >&2
+      fi
+      git status >&2
+      git diff >&2
+      if [[ -n "${failure_tail}" ]]; then
+        echo "" >&2
+        echo "${failure_tail}" >&2
+      fi
+      return 1
+    fi
+  )
+}
+
+# Marker function to indicate verify-generated.sh has been fully sourced.
+kube::verify::generated::loaded() {
+  return 0
+}

hack/lib/version.sh

@@ -1,5 +1,19 @@
 #!/usr/bin/env bash
 
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # -----------------------------------------------------------------------------
 # Version management helpers.  These functions help to set, save and load the
 # following variables:
@@ -18,6 +32,11 @@
 # If KUBE_GIT_VERSION_FILE, this function will load from that file instead of
 # querying git.
 kube::version::get_version_vars() {
+  if [[ -n ${KUBE_GIT_VERSION_FILE-} ]]; then
+    kube::version::load_version_vars "${KUBE_GIT_VERSION_FILE}"
+    return
+  fi
+
   # If the kubernetes source was exported through git archive, then
   # we likely don't have a git tree, but these magic values may be filled in.
   # shellcheck disable=SC2016,SC2050
@@ -80,7 +99,6 @@ kube::version::get_version_vars() {
       # the "major" and "minor" versions and whether this is the exact tagged
       # version or whether the tree is between two tagged versions.
       if [[ "${KUBE_GIT_VERSION}" =~ ^v([0-9]+)\.([0-9]+)(\.[0-9]+)?([-].*)?([+].*)?$ ]]; then
-        # shellcheck disable=SC2034 
         KUBE_GIT_MAJOR=${BASH_REMATCH[1]}
         KUBE_GIT_MINOR=${BASH_REMATCH[2]}
         if [[ -n "${BASH_REMATCH[4]}" ]]; then
@@ -90,10 +108,77 @@ kube::version::get_version_vars() {
 
       # If KUBE_GIT_VERSION is not a valid Semantic Version, then refuse to build.
       if ! [[ "${KUBE_GIT_VERSION}" =~ ^v([0-9]+)\.([0-9]+)(\.[0-9]+)?(-[0-9A-Za-z.-]+)?(\+[0-9A-Za-z.-]+)?$ ]]; then
-          echo "KUBE_GIT_VERSION should be a valid Semantic Version. Current value: ${KUBE_GIT_VERSION}"
-          echo "Please see more details here: https://semver.org"
+          kube::log::error "KUBE_GIT_VERSION should be a valid Semantic Version. Current value: ${KUBE_GIT_VERSION}"
+          kube::log::error "Please see more details here: https://semver.org"
           exit 1
       fi
     fi
   fi
 }
+
+# Saves the environment flags to $1
+kube::version::save_version_vars() {
+  local version_file=${1-}
+  [[ -n ${version_file} ]] || {
+    echo "!!! Internal error.  No file specified in kube::version::save_version_vars"
+    return 1
+  }
+
+  cat <<EOF >"${version_file}"
+KUBE_GIT_COMMIT='${KUBE_GIT_COMMIT-}'
+KUBE_GIT_TREE_STATE='${KUBE_GIT_TREE_STATE-}'
+KUBE_GIT_VERSION='${KUBE_GIT_VERSION-}'
+KUBE_GIT_MAJOR='${KUBE_GIT_MAJOR-}'
+KUBE_GIT_MINOR='${KUBE_GIT_MINOR-}'
+EOF
+}
+
+# Loads up the version variables from file $1
+kube::version::load_version_vars() {
+  local version_file=${1-}
+  [[ -n ${version_file} ]] || {
+    echo "!!! Internal error.  No file specified in kube::version::load_version_vars"
+    return 1
+  }
+
+  source "${version_file}"
+}
+
+KUBE_GO_PACKAGE=kubesphere.io/kubesphere
+
+# Prints the value that needs to be passed to the -ldflags parameter of go build
+# in order to set the Kubernetes based on the git tree status.
+# IMPORTANT: if you update any of these, also update the lists in
+# hack/print-workspace-status.sh.
+kube::version::ldflags() {
+  kube::version::get_version_vars
+
+  local -a ldflags
+  function add_ldflag() {
+    local key=${1}
+    local val=${2}
+    ldflags+=(
+      "-X '${KUBE_GO_PACKAGE}/pkg/version.${key}=${val}'"
+    )
+  }
+
+  kube::util::ensure-gnu-date
+
+  add_ldflag "buildDate" "$(${DATE} ${SOURCE_DATE_EPOCH:+"--date=@${SOURCE_DATE_EPOCH}"} -u +'%Y-%m-%dT%H:%M:%SZ')"
+  if [[ -n ${KUBE_GIT_COMMIT-} ]]; then
+    add_ldflag "gitCommit" "${KUBE_GIT_COMMIT}"
+    add_ldflag "gitTreeState" "${KUBE_GIT_TREE_STATE}"
+  fi
+
+  if [[ -n ${KUBE_GIT_VERSION-} ]]; then
+    add_ldflag "gitVersion" "${KUBE_GIT_VERSION}"
+  fi
+
+  if [[ -n ${KUBE_GIT_MAJOR-} && -n ${KUBE_GIT_MINOR-} ]]; then
+    add_ldflag "gitMajor" "${KUBE_GIT_MAJOR}"
+    add_ldflag "gitMinor" "${KUBE_GIT_MINOR}"
+  fi
+
+  # The -ldflags parameter takes a single string, so join the output.
+  echo "${ldflags[*]-}"
+}

hack/lint-dependencies.sh

@@ -14,6 +14,10 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+# This script checks version dependencies of modules. It checks whether all
+# pinned versions of checked dependencies match their preferred version or not.
+# Usage: `hack/lint-dependencies.sh`.
+
 set -o errexit
 set -o nounset
 set -o pipefail
@@ -21,43 +25,44 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
-# Explicitly clear GOFLAGS, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
-export GOFLAGS=-mod=mod
 # Detect problematic GOPROXY settings that prevent lookup of dependencies
 if [[ "${GOPROXY:-}" == "off" ]]; then
   kube::log::error "Cannot run with \$GOPROXY=off"
   exit 1
 fi
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 kube::util::require-jq
 
-case "${1:-}" in
-"--all")
-  echo "Checking all dependencies"
-  filter=''
-  ;;
-"-a")
-  echo "Checking all dependencies"
-  filter=''
-  ;;
-"")
-  # by default, skip checking golang.org/x/... dependencies... we pin to levels that match our go version for those
-  echo "Skipping golang.org/x/... dependencies, pass --all to include"
-  filter='select(.Path | startswith("golang.org/x/") | not) |'
-  ;;
-*)
-  kube::log::error "Unrecognized arg: ${1}"
-  exit 1
-  ;;
-esac
+# Set the Go environment, otherwise we get "can't compute 'all' using the
+# vendor directory".
+export GOWORK=off
+export GOFLAGS=-mod=mod
+
+# let us log all errors before we exit
+rc=0
+
+# List of dependencies we need to avoid dragging back into kubesphere/kubesphere
+# Check if unwanted dependencies are removed
+# The array and map in `unwanted-dependencies.json` are in alphabetical order.
+go run ./tools/cmd/dependencyverifier "${KUBE_ROOT}/hack/unwanted-dependencies.json"
+
+ks_module_regex="kubesphere[.]io/(kubesphere"
+for repo in $(kube::util::list_staging_repos); do
+  ks_module_regex="${ks_module_regex}|${repo}"
+done
+ks_module_regex="${ks_module_regex})"
+
+recursive_dependencies=$(go mod graph | grep -E " ${ks_module_regex}" | grep -E -v "^${ks_module_regex}" || true)
+if [[ -n "${recursive_dependencies}" ]]; then
+  echo "These external modules depend on kubesphere.io/kubesphere or staging modules, which is not allowed:"
+  echo ""
+  echo "${recursive_dependencies}"
+fi
 
 outdated=$(go list -m -json all | jq -r "
   select(.Replace.Version != null) |
   select(.Version != .Replace.Version) |
-  ${filter}
   select(.Path) |
   \"\(.Path)
     pinned:    \(.Replace.Version)
@@ -75,18 +80,33 @@ if [[ -n "${outdated}" ]]; then
   echo "${outdated}"
 fi
 
+noncanonical=$(go list -m -json all | jq -r "
+  select(.Replace.Version != null) |
+  select(.Path != .Replace.Path) |
+  select(.Path) |
+  \"  \(.Path) is replaced with \(.Replace.Path)\"
+")
+if [[ -n "${noncanonical}" ]]; then
+  echo ""
+  echo "These modules are pinned to non-canonical repos."
+  echo "Revert to using the canonical repo for these modules before merge"
+  echo ""
+  echo "${noncanonical}"
+fi
+
 unused=$(comm -23 \
   <(go mod edit -json | jq -r '.Replace[] | select(.New.Version != null) | .Old.Path' | sort) \
   <(go list -m -json all | jq -r .Path | sort))
 if [[ -n "${unused}" ]]; then
   echo ""
   echo "Use the given commands to remove pinned module versions that aren't actually used:"
-  echo "${unused}" | xargs -L 1 echo 'GO111MODULE=on go mod edit -dropreplace'
+  echo "${unused}" | xargs -L 1 echo 'go mod edit -dropreplace'
 fi
 
-if [[ -n "${unused}${outdated}" ]]; then
-  exit 1
+if [[ -n "${unused}${outdated}${noncanonical}${recursive_dependencies}" ]]; then
+  rc=1
+else
+  echo "All pinned versions of checked dependencies match their preferred version."
 fi
 
-echo "All pinned versions of checked dependencies match their preferred version."
-exit 0
+exit $rc

hack/make-rules/build.sh

@@ -0,0 +1,29 @@
+#!/usr/bin/env bash
+
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script sets up a go workspace locally and builds all go components.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
+KUBE_VERBOSE="${KUBE_VERBOSE:-1}"
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+kube::golang::setup_env
+kube::golang::build_binaries "$@"
+kube::golang::place_bins

hack/make-rules/clean.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+
+# Copyright 2017 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
+source "${KUBE_ROOT}/hack/lib/util.sh"
+
+CLEAN_PATTERNS=(
+  "_tmp"
+  "doc_tmp"
+  "test/e2e/generated/bindata.go"
+)
+
+for item in "${CLEAN_PATTERNS[@]}"; do
+  # Shellcheck wants the ":?" because of paranoia about 'rm -rf /'. It will
+  # cause an error if unset, which is already true because of "nounset", but
+  # belts AND suspenders is fine for this.
+  rm -rf "${KUBE_ROOT:?}/${item:?}"
+done
+
+# ex: ts=2 sw=2 et filetype=sh

hack/make-rules/cross.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script sets up a go workspace locally and builds all for all appropriate
+# platforms.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+# NOTE: Using "${array[*]}" here is correct.  [@] becomes distinct words (in
+# bash parlance).
+
+make all WHAT="${KUBE_SERVER_TARGETS[*]}" KUBE_BUILD_PLATFORMS="${KUBE_SERVER_PLATFORMS[*]}"
+
+make all WHAT="${KUBE_NODE_TARGETS[*]}" KUBE_BUILD_PLATFORMS="${KUBE_NODE_PLATFORMS[*]}"
+
+make all WHAT="${KUBE_CLIENT_TARGETS[*]}" KUBE_BUILD_PLATFORMS="${KUBE_CLIENT_PLATFORMS[*]}"
+
+make all WHAT="${KUBE_TEST_TARGETS[*]}" KUBE_BUILD_PLATFORMS="${KUBE_TEST_PLATFORMS[*]}"
+
+make all WHAT="${KUBE_TEST_SERVER_TARGETS[*]}" KUBE_BUILD_PLATFORMS="${KUBE_TEST_SERVER_PLATFORMS[*]}"

hack/make-rules/make-help.sh

@@ -0,0 +1,50 @@
+#!/usr/bin/env bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+red=$(tput setaf 1)
+reset=$(tput sgr0)
+readonly red reset
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
+ALL_TARGETS=$(make -C "${KUBE_ROOT}" PRINT_HELP=y -rpn | sed -n -e '/^$/ { n ; /^[^ .#][^ ]*:/ { s/:.*$// ; p ; } ; }' | sort)
+CMD_TARGETS=$(cd "${KUBE_ROOT}/cmd"; find . -mindepth 1 -maxdepth 1 -type d | cut -c 3-)
+CMD_FLAG=false
+
+echo "--------------------------------------------------------------------------------"
+for tar in ${ALL_TARGETS}; do
+	for cmdtar in ${CMD_TARGETS}; do
+		if [ "${tar}" = "${cmdtar}" ]; then
+			if [ ${CMD_FLAG} = true ]; then
+				continue 2;
+			fi
+
+			echo -e "${red}${CMD_TARGETS}${reset}"
+			make -C "${KUBE_ROOT}" "${tar}" PRINT_HELP=y
+			echo "---------------------------------------------------------------------------------"
+
+			CMD_FLAG=true
+			continue 2
+		fi
+	done
+
+	echo -e "${red}${tar}${reset}"
+	make -C "${KUBE_ROOT}" "${tar}" PRINT_HELP=y
+	echo "---------------------------------------------------------------------------------"
+done

hack/make-rules/update.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# A single script that runs a predefined set of update-* scripts, as they often go together.
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+SILENT=${SILENT:-true}
+ALL=${FORCE_ALL:-false}
+
+trap 'exit 1' SIGINT
+
+if ${SILENT} ; then
+	echo "Running in silent mode, run with SILENT=false if you want to see script logs."
+fi
+
+if ! ${ALL} ; then
+	echo "Running in short-circuit mode; run with FORCE_ALL=true to force all scripts to run."
+fi
+
+BASH_TARGETS=(
+	update-codegen
+	update-featuregates
+	update-generated-api-compatibility-data
+	update-generated-docs
+	update-openapi-spec
+	update-gofmt
+	update-golangci-lint-config
+)
+
+for t in "${BASH_TARGETS[@]}"; do
+	echo -e "${color_yellow:?}Running ${t}${color_norm:?}"
+	if ${SILENT} ; then
+		if ! bash "${KUBE_ROOT}/hack/${t}.sh" 1> /dev/null; then
+			echo -e "${color_red:?}Running ${t} FAILED${color_norm}"
+			if ! ${ALL}; then
+				exit 1
+			fi
+		fi
+	else
+		if ! bash "${KUBE_ROOT}/hack/${t}.sh"; then
+			echo -e "${color_red}Running ${t} FAILED${color_norm}"
+			if ! ${ALL}; then
+				exit 1
+			fi
+		fi
+	fi
+done
+
+echo -e "${color_green:?}Update scripts completed successfully${color_norm}"

hack/make-rules/verify.sh

@@ -0,0 +1,253 @@
+#!/usr/bin/env bash
+
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Indirect calls through kube::util::run-in aren't interpreted
+# shellcheck disable=SC2317
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+kube::golang::setup_env
+
+# If KUBE_JUNIT_REPORT_DIR is unset, and ARTIFACTS is set, then have them match.
+if [[ -z "${KUBE_JUNIT_REPORT_DIR:-}" && -n "${ARTIFACTS:-}" ]]; then
+    export KUBE_JUNIT_REPORT_DIR="${ARTIFACTS}"
+fi
+
+# include shell2junit library
+source "${KUBE_ROOT}/third_party/forked/shell2junit/sh2ju.sh"
+
+# Excluded check patterns are always skipped.
+EXCLUDED_PATTERNS=(
+  "verify-all.sh"                # this script calls the make rule and would cause a loop
+  "verify-*-dockerized.sh"       # Don't run any scripts that intended to be run dockerized
+  "verify-golangci-lint-pr.sh"       # Runs in a separate job for PRs.
+  "verify-golangci-lint-pr-hints.sh" # Runs in a separate job for PRs.
+  "verify-licenses.sh"           # runs in a separate job to monitor availability of the dependencies periodically
+  "verify-openapi-docs-urls.sh"  # Spams docs URLs, don't run in CI.
+  )
+
+# Exclude typecheck in certain cases, if they're running in a separate job.
+if [[ ${EXCLUDE_TYPECHECK:-} =~ ^[yY]$ ]]; then
+  EXCLUDED_PATTERNS+=(
+    "verify-typecheck.sh"              # runs in separate typecheck job
+    )
+fi
+
+# Exclude dependency checks in certain cases, if they're running in a separate job.
+# From @cblecker: We can't change the variable name here, unless we update it throughout
+#                 test-infra (and we would need to pick it backwards).
+if [[ ${EXCLUDE_GODEP:-} =~ ^[yY]$ ]]; then
+  EXCLUDED_PATTERNS+=(
+    "verify-external-dependencies-version.sh" # runs in separate dependencies job
+    "verify-vendor.sh"                        # runs in separate dependencies job
+    "verify-vendor-licenses.sh"               # runs in separate dependencies job
+    )
+fi
+
+# Exclude golangci-lint if requested, for example in pull-kubernetes-verify.
+if [[ ${EXCLUDE_GOLANGCI_LINT:-} =~ ^[yY]$ ]]; then
+  EXCLUDED_PATTERNS+=(
+    "verify-golangci-lint.sh"              # runs in separate pull-kubernetes-verify-lint
+    )
+fi
+
+# Exclude readonly package check in certain cases, aka, in periodic jobs we don't care and a readonly package won't be touched
+if [[ ${EXCLUDE_READONLY_PACKAGE:-} =~ ^[yY]$ ]]; then
+  EXCLUDED_PATTERNS+=(
+    "verify-readonly-packages.sh"  # skip in CI, if env is set
+    )
+fi
+
+# Only run known fast checks in quick mode.
+# These ideally run in less than 10s.
+QUICK_PATTERNS+=(
+  "verify-api-groups.sh"
+  "verify-boilerplate.sh"
+  "verify-external-dependencies-version.sh"
+  "verify-featuregates.sh"
+  "verify-fieldname-docs.sh"
+  "verify-gofmt.sh"
+  "verify-imports.sh"
+  "verify-non-mutating-validation.sh"
+  "verify-pkg-names.sh"
+  "verify-readonly-packages.sh"
+  "verify-spelling.sh"
+  "verify-staging-client-go.sh"
+  "verify-staging-meta-files.sh"
+  "verify-test-featuregates.sh"
+  "verify-test-images.sh"
+  "verify-vendor-licenses.sh"
+)
+
+while IFS='' read -r line; do EXCLUDED_CHECKS+=("$line"); done < <(ls "${EXCLUDED_PATTERNS[@]/#/${KUBE_ROOT}/hack/}" 2>/dev/null || true)
+while IFS='' read -r line; do QUICK_CHECKS+=("$line"); done < <(ls "${QUICK_PATTERNS[@]/#/${KUBE_ROOT}/hack/}" 2>/dev/null || true)
+TARGET_LIST=()
+IFS=" " read -r -a TARGET_LIST <<< "${WHAT:-}"
+
+function is-excluded {
+  for e in "${EXCLUDED_CHECKS[@]}"; do
+    if [[ $1 -ef "${e}" ]]; then
+      return
+    fi
+  done
+  return 1
+}
+
+function is-quick {
+  for e in "${QUICK_CHECKS[@]}"; do
+    if [[ $1 -ef "${e}" ]]; then
+      return
+    fi
+  done
+  return 1
+}
+
+function is-explicitly-chosen {
+  local name="${1#verify-}"
+  name="${name%.*}"
+  index=0
+  for e in "${TARGET_LIST[@]}"; do
+    if [[ "${e}" == "${name}" ]]; then
+      TARGET_LIST[index]=""
+      return
+    fi
+    index=$((index + 1))
+  done
+  return 1
+}
+
+function run-cmd {
+  local filename="${2##*/verify-}"
+  local testname="${filename%%.*}"
+  local output="${KUBE_JUNIT_REPORT_DIR:-/tmp/junit-results}"
+  local tr
+
+  if ${SILENT}; then
+    juLog -output="${output}" -class="verify" -name="${testname}" -fail="^ERROR: " "$@" &> /dev/null
+    tr=$?
+  else
+    juLog -output="${output}" -class="verify" -name="${testname}" -fail="^ERROR: " "$@"
+    tr=$?
+  fi
+  return "${tr}"
+}
+
+# Collect Failed tests in this Array , initialize it to nil
+FAILED_TESTS=()
+
+function print-failed-tests {
+  echo -e "========================"
+  echo -e "${color_red:?}FAILED TESTS${color_norm:?}"
+  echo -e "========================"
+  for t in "${FAILED_TESTS[@]}"; do
+      echo -e "${color_red}${t}${color_norm}"
+  done
+}
+
+function run-checks {
+  local -r pattern=$1
+  local -r runner=$2
+
+  local t
+  for t in ${pattern}
+  do
+    if [ "$t" = "$pattern" ]; then
+      # The pattern didn't match any files
+      continue
+    fi
+    local check_name
+    check_name="$(basename "${t}")"
+    if [[ -n ${WHAT:-} ]]; then
+      if ! is-explicitly-chosen "${check_name}"; then
+        continue
+      fi
+    else
+      if is-excluded "${t}" ; then
+        echo "Skipping ${check_name}"
+        continue
+      fi
+      if ${QUICK} && ! is-quick "${t}" ; then
+        echo "Skipping ${check_name} in quick mode"
+        continue
+      fi
+    fi
+    echo -e "Verifying ${check_name}"
+    local start
+    start=$(date +%s)
+    run-cmd "${runner}" "${t}" && tr=$? || tr=$?
+    local elapsed=$(($(date +%s) - start))
+    if [[ ${tr} -eq 0 ]]; then
+      echo -e "${color_green:?}SUCCESS${color_norm}  ${check_name}\t${elapsed}s"
+    else
+      echo -e "${color_red}FAILED${color_norm}   ${check_name}\t${elapsed}s"
+      ret=1
+      FAILED_TESTS+=("${PWD}/${t}")
+    fi
+  done
+}
+
+# Check invalid targets specified in "WHAT" and mark them as failure cases
+function missing-target-checks {
+  # In case WHAT is not specified
+  [[ ${#TARGET_LIST[@]} -eq 0 ]] && return
+
+  for v in "${TARGET_LIST[@]}"
+  do
+    [[ -z "${v}" ]] && continue
+
+    FAILED_TESTS+=("${v}")
+    ret=1
+  done
+}
+
+SILENT=${SILENT:-false}
+QUICK=${QUICK:-false}
+
+if ${SILENT} ; then
+  echo "Running in silent mode, run with SILENT=false if you want to see script logs."
+fi
+
+if ${QUICK} ; then
+  echo "Running in quick mode (QUICK=true). Only fast checks will run."
+fi
+
+shopt -s globstar
+export API_KNOWN_VIOLATIONS_DIR="${KUBE_ROOT}"/api/api-rules
+ret=0
+# Modules are discovered by looking for go.mod rather than asking go
+# to ensure that modules that aren't part of the workspace and/or are
+# not dependencies are checked too.
+# . and staging are listed explicitly here to avoid _output
+for module in ./go.mod ./staging/**/go.mod; do
+  module="${module%/go.mod}"
+  if [ -d "$module/hack" ]; then
+    kube::util::run-in "$module" run-checks "hack/verify-*.sh" bash
+    kube::util::run-in "$module" run-checks "hack/verify-*.py" python3
+  fi
+done
+missing-target-checks
+
+if [[ ${ret} -eq 1 ]]; then
+    print-failed-tests
+fi
+exit ${ret}
+
+# ex: ts=2 sw=2 et filetype=sh

hack/make-rules/vet.sh

@@ -0,0 +1,25 @@
+#!/usr/bin/env bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/../..
+
+# Ignore the usual golangci.yaml config because it would
+# enable additional linters, then enable just "go vet".
+"${KUBE_ROOT}/hack/verify-golangci-lint.sh" -c none -- --disable-all --enable=govet "$@"

hack/pin-dependency.sh

@@ -1,5 +1,23 @@
 #!/usr/bin/env bash
 
+# Copyright 2019 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script switches to the preferred version for specified module.
+# Usage: `hack/pin-dependency.sh $MODULE $SHA-OR-TAG`.
+# Example: `hack/pin-dependency.sh github.com/docker/docker 501cb131a7b7`.
+
 set -o errexit
 set -o nounset
 set -o pipefail
@@ -7,73 +25,89 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-# Usage:
-#   hack/pin-dependency.sh $MODULE $SHA-OR-TAG
-#
-# Example:
-#   hack/pin-dependency.sh github.com/docker/docker 501cb131a7b7
-
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
-# Explicitly clear GOFLAGS, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
-export GOFLAGS=
 # Detect problematic GOPROXY settings that prevent lookup of dependencies
 if [[ "${GOPROXY:-}" == "off" ]]; then
   kube::log::error "Cannot run with \$GOPROXY=off"
   exit 1
 fi
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 kube::util::require-jq
 
+# Explicitly set GOFLAGS to ignore vendor, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
+export GOWORK=off
+export GOFLAGS=-mod=mod
+
 dep="${1:-}"
 sha="${2:-}"
-if [[ -z "${dep}" || -z "${sha}" ]]; then
+
+# Specifying a different repo is optional.
+replacement=
+case ${dep} in
+    *=*)
+        # shellcheck disable=SC2001
+        replacement=$(echo "${dep}" | sed -e 's/.*=//')
+        # shellcheck disable=SC2001
+        dep=$(echo "${dep}" | sed -e 's/=.*//')
+        ;;
+    *)
+        replacement="${dep}"
+        ;;
+esac
+
+if [[ -z "${dep}" || -z "${replacement}" || -z "${sha}" ]]; then
   echo "Usage:"
-  echo "  hack/pin-dependency.sh \$MODULE \$SHA-OR-TAG"
+  echo "  hack/pin-dependency.sh \$MODULE[=\$REPLACEMENT] \$SHA-OR-TAG"
   echo ""
-  echo "Example:"
+  echo "Examples:"
   echo "  hack/pin-dependency.sh github.com/docker/docker 501cb131a7b7"
+  echo "  hack/pin-dependency.sh github.com/docker/docker=github.com/johndoe/docker my-experimental-branch"
+  echo ""
+  echo "Replacing with a different repository is useful for testing but"
+  echo "the result should never be merged into Kubernetes!"
   echo ""
   exit 1
 fi
 
-_tmp="${KUBE_ROOT}/_tmp"
-cleanup() {
-  rm -rf "${_tmp}"
-}
-trap "cleanup" EXIT SIGINT
-cleanup
-mkdir -p "${_tmp}"
+# Find the resolved version before trying to use it.
+echo "Running: go mod download ${replacement}@${sha}"
+if meta=$(go mod download -json "${replacement}@${sha}"); then
+    rev=$(echo "${meta}" | jq -r ".Version")
+else
+    error=$(echo "${meta}" | jq -r ".Error")
+    echo "Download failed: ${error}" >&2
+    exit 1
+fi
+echo "Resolved to ${replacement}@${rev}"
 
 # Add the require directive
-echo "Running: go get ${dep}@${sha}"
-go get -d "${dep}@${sha}"
-
-# Find the resolved version
-rev=$(go mod edit -json | jq -r ".Require[] | select(.Path == \"${dep}\") | .Version")
-
-# No entry in go.mod, we must be using the natural version indirectly
-if [[ -z "${rev}" ]]; then
-  # backup the go.mod file, since go list modifies it
-  cp go.mod "${_tmp}/go.mod.bak"
-  # find the revision
-  rev=$(go list -m -json "${dep}" | jq -r .Version)
-  # restore the go.mod file
-  mv "${_tmp}/go.mod.bak" go.mod
-fi
-
-# No entry found
-if [[ -z "${rev}" ]]; then
-  echo "Could not resolve ${sha}"
-  exit 1
-fi
-
-echo "Resolved to ${dep}@${rev}"
+echo "Running: go mod edit -require ${dep}@${rev}"
+go mod edit -require "${dep}@${rev}"
 
 # Add the replace directive
-echo "Running: go mod edit -replace ${dep}=${dep}@${rev}"
-go mod edit -replace "${dep}=${dep}@${rev}"
+if [ "${replacement}" != "${dep}" ]; then
+  echo "Running: go mod edit -replace ${dep}=${replacement}@${rev}"
+  go mod edit -replace "${dep}=${replacement}@${rev}"
+fi
+
+# Propagate pinned version to staging repos
+for repo in $(kube::util::list_staging_repos); do
+  pushd "staging/src/kubesphere.io/${repo}" >/dev/null 2>&1
+    go mod edit -require "${dep}@${rev}"
+
+    # When replacing with a fork, always add a replace statement in all go.mod
+    # files (not just the root of the staging repos!) because there might be
+    # indirect dependencies on the fork.
+    #
+    # This is excessive, but the resulting commit should never be merged, so it
+    # isn't that important to get this exactly right.
+    if [ "${replacement}" != "${dep}" ]; then
+        find . -name go.mod -print | while read -r modfile; do
+            (cd "$(dirname "${modfile}")" && go mod edit -replace "${dep}=${replacement}@${rev}")
+        done
+    fi
+  popd >/dev/null 2>&1
+done
 
 echo ""
 echo "Run hack/update-vendor.sh to rebuild the vendor directory"

hack/setup-envtest.sh

@@ -5,22 +5,12 @@ set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
-source "${KUBE_ROOT}/hack/lib/util.sh"
 
-kube::golang::verify_go_version
-
-# Ensure that we find the binaries we build before anything else.
-export GOBIN="${KUBE_OUTPUT_BINPATH}"
-PATH="${GOBIN}:${PATH}"
-
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
+kube::golang::setup_env
 
 if ! command -v setup-envtest ; then
   echo 'installing setup-envtest'
   # While it's preferable not to use @latest here, we have no choice at the moment. Details at
   # https://github.com/kubernetes-sigs/kubebuilder/issues/2480
-  GO111MODULE=auto go install -mod=mod sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20240521074430-fbb7d370bebc
+  go install -mod=mod sigs.k8s.io/controller-runtime/tools/setup-envtest@v0.0.0-20240521074430-fbb7d370bebc
 fi
-
-setup-envtest use 1.23.x --bin-dir="${KUBE_OUTPUT_BINPATH}"

hack/test-go.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script runs all *_test.go files. It is equivalent to `make test`.
+# Usage: `hack/test-go.sh` or `make test`.
+# Note: This script is a vestigial redirection. Please do not add "real" logic.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+kube::golang::setup_env
+
+cd "${KUBE_ROOT}" || exit 1
+
+ENVTEST_K8S_VERSION=1.28.x
+KUBEBUILDER_ASSETS=$(setup-envtest use $ENVTEST_K8S_VERSION -p path --bin-dir="${KUBE_OUTPUT_BIN}")
+export KUBEBUILDER_ASSETS
+
+go test ./pkg/... ./cmd/... -covermode=atomic -coverprofile=coverage.txt
+go -C staging/src/kubesphere.io/api test ./...
+go -C staging/src/kubesphere.io/client-go test ./...

hack/unwanted-dependencies.json

@@ -0,0 +1,507 @@
+{
+  "spec": {
+    "unwantedModules": {
+      "cloud.google.com/go": "cloud dependency",
+      "cloud.google.com/go/bigquery": "cloud dependency",
+      "cloud.google.com/go/compute": "cloud dependency",
+      "cloud.google.com/go/firestore": "db/datastore clients should not be required",
+      "cloud.google.com/go/storage": "cloud dependency",
+      "github.com/GoogleCloudPlatform/k8s-cloud-provider": "cloud dependency",
+      "github.com/PuerkitoBio/urlesc": "unmaintained, archive mode",
+      "github.com/armon/consul-api": "MPL license not in CNCF allowlist",
+      "github.com/bketelsen/crypt": "unused, crypto",
+      "github.com/containerd/cgroups": "standardize on single cgroups library from runc, refer #128157",
+      "github.com/davecgh/go-spew": "refer to #103942",
+      "github.com/form3tech-oss/jwt-go": "unmaintained, archive mode",
+      "github.com/getsentry/raven-go": "unmaintained, archive mode",
+      "github.com/go-bindata/go-bindata": "refer to #99829",
+      "github.com/go-kit/kit": "lots of transitive dependencies, see https://github.com/prometheus/common/issues/255",
+      "github.com/gogo/googleapis": "depends on unmaintained github.com/gogo/protobuf",
+      "github.com/gogo/protobuf": "unmaintained",
+      "github.com/golang/mock": "unmaintained, archive mode",
+      "github.com/golang/protobuf": "replace with google.golang.org/protobuf",
+      "github.com/golang/groupcache": "unmaintained",
+      "github.com/google/gofuzz": "unmaintained, use sigs.k8s.io/randfill",
+      "github.com/google/s2a-go": "cloud dependency, unstable",
+      "github.com/google/shlex": "unmaintained, archive mode",
+      "github.com/googleapis/enterprise-certificate-proxy": "references cloud dependencies",
+      "github.com/googleapis/gax-go/v2": "references cloud dependencies",
+      "github.com/gorilla/handlers": "unmaintained, archive mode",
+      "github.com/gorilla/mux": "unmaintained, archive mode",
+      "github.com/gorilla/rpc": "unmaintained, archive mode",
+      "github.com/gorilla/schema": "unmaintained, archive mode",
+      "github.com/gregjones/httpcache": "unmaintained, archive mode",
+      "github.com/grpc-ecosystem/go-grpc-prometheus": "unmaintained, archive mode",
+      "github.com/grpc-ecosystem/grpc-gateway": "use github.com/grpc-ecosystem/grpc-gateway/v2",
+      "github.com/hashicorp/consul": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/errwrap": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/go-immutable-radix": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/go-multierror": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/go-retryablehttp": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/go-rootcerts": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/go-sockaddr": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/go-uuid": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/golang-lru": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/hcl": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/logutils": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/memberlist": "MPL license not in CNCF allowlist",
+      "github.com/hashicorp/serf": "MPL license not in CNCF allowlist",
+      "github.com/imdario/mergo": "see https://github.com/kubernetes/kubernetes/issues/107499",
+      "github.com/influxdata/influxdb1-client": "db/datastore clients should not be required",
+      "github.com/json-iterator/go": "refer to #105030",
+      "github.com/klauspost/compress": "unreviewable assembly code, `prometheus/client_golang` should use stdlib instead",
+      "github.com/mailru/easyjson": "unmaintained",
+      "github.com/miekg/dns": "no dns client/server should be required",
+      "github.com/mindprince/gonvml": "depends on nvml.h that does not appear to permit modification, redistribution",
+      "github.com/mitchellh/cli": "MPL license not in CNCF allowlist",
+      "github.com/mitchellh/gox": "MPL license not in CNCF allowlist",
+      "github.com/mndrix/tap-go": "unmaintained",
+      "github.com/modern-go/concurrent": "problematic reliance on golang internals, e.g. https://github.com/modern-go/reflect2/issues/24",
+      "github.com/modern-go/reflect2": "problematic reliance on golang internals, e.g. https://github.com/modern-go/reflect2/issues/24",
+      "github.com/onsi/ginkgo": "Ginkgo has been migrated to V2, refer to #109111",
+      "github.com/pkg/errors": "unmaintained, archive mode",
+      "github.com/planetscale/vtprotobuf": "avoid using additional proto implementations",
+      "github.com/smartystreets/goconvey": "MPL license not in CNCF allowlist",
+      "github.com/xeipuuv/gojsonschema": "unmaintained",
+      "go.mongodb.org/mongo-driver": "",
+      "go.opencensus.io": "unmaintained, https://github.com/census-instrumentation/opencensus-go archive mode",
+      "golang.org/x/exp": "This subrepository holds experimental and deprecated packages",
+      "golang.org/x/lint": "unmaintained, archive mode",
+      "google.golang.org/api": "cloud dependency",
+      "google.golang.org/appengine": "cloud dependency",
+      "google.golang.org/genproto": "refer to #113366",
+      "gopkg.in/square/go-jose.v2": "obsolete, use gopkg.in/go-jose/go-jose.v2",
+      "gopkg.in/fsnotify.v1": "obsolete, use github.com/fsnotify/fsnotify",
+      "gopkg.in/yaml.v2": "prefer sigs.k8s.io/yaml",
+      "gopkg.in/yaml.v3": "prefer sigs.k8s.io/yaml/goyaml.v3",
+      "k8s.io/klog": "we have switched to klog v2, so avoid klog v1",
+      "rsc.io/quote": "refer to #102833",
+      "rsc.io/sampler": "refer to #102833"
+    }
+  },
+  "status": {
+    "unwantedReferences": {
+      "github.com/containerd/cgroups": [
+        "github.com/containerd/containerd"
+      ],
+      "github.com/davecgh/go-spew": [
+        "github.com/Masterminds/sprig/v3",
+        "github.com/Masterminds/squirrel",
+        "github.com/containerd/containerd",
+        "github.com/containerd/platforms",
+        "github.com/cyphar/filepath-securejoin",
+        "github.com/go-git/go-billy/v5",
+        "github.com/go-git/go-git/v5",
+        "github.com/go-gorp/gorp/v3",
+        "github.com/go-jose/go-jose/v4",
+        "github.com/go-ldap/ldap/v3",
+        "github.com/go-openapi/analysis",
+        "github.com/go-openapi/errors",
+        "github.com/go-openapi/jsonpointer",
+        "github.com/go-openapi/jsonreference",
+        "github.com/go-openapi/loads",
+        "github.com/go-openapi/spec",
+        "github.com/go-openapi/strfmt",
+        "github.com/go-openapi/swag",
+        "github.com/go-openapi/validate",
+        "github.com/go-task/slim-sprig/v3",
+        "github.com/jmespath/go-jmespath/internal/testify",
+        "github.com/json-iterator/go",
+        "github.com/prometheus/common",
+        "github.com/sagikazarmark/locafero",
+        "github.com/sergi/go-diff",
+        "github.com/sirupsen/logrus",
+        "github.com/sourcegraph/conc",
+        "github.com/spf13/viper",
+        "github.com/stretchr/testify",
+        "github.com/subosito/gotenv",
+        "github.com/vbatts/tar-split",
+        "go.etcd.io/etcd/api/v3",
+        "go.etcd.io/etcd/client/pkg/v3",
+        "go.etcd.io/etcd/client/v3",
+        "go.mongodb.org/mongo-driver",
+        "go.opentelemetry.io/auto/sdk",
+        "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
+        "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
+        "go.opentelemetry.io/otel",
+        "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
+        "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
+        "go.opentelemetry.io/otel/metric",
+        "go.opentelemetry.io/otel/sdk",
+        "go.opentelemetry.io/otel/trace",
+        "go.uber.org/automaxprocs",
+        "go.uber.org/multierr",
+        "go.uber.org/zap",
+        "gomodules.xyz/jsonpatch/v2",
+        "helm.sh/helm/v3",
+        "k8s.io/api",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apimachinery",
+        "k8s.io/apiserver",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/code-generator",
+        "k8s.io/component-base",
+        "k8s.io/kube-openapi",
+        "k8s.io/kubectl",
+        "k8s.io/utils",
+        "oras.land/oras-go",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/kustomize/api",
+        "sigs.k8s.io/kustomize/kyaml"
+      ],
+      "github.com/gogo/protobuf": [
+        "github.com/containerd/containerd",
+        "github.com/containerd/errdefs/pkg",
+        "github.com/google/go-containerregistry",
+        "go.etcd.io/etcd/api/v3",
+        "go.etcd.io/etcd/client/v3",
+        "helm.sh/helm/v3",
+        "k8s.io/api",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apimachinery",
+        "k8s.io/apiserver",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/code-generator",
+        "k8s.io/component-base",
+        "k8s.io/kms",
+        "k8s.io/kubectl",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/controller-tools"
+      ],
+      "github.com/golang/groupcache": [
+        "github.com/containerd/containerd",
+        "github.com/go-git/go-git/v5",
+        "sigs.k8s.io/application"
+      ],
+      "github.com/golang/protobuf": [
+        "github.com/containerd/containerd",
+        "github.com/golang/groupcache",
+        "github.com/open-policy-agent/opa",
+        "go.etcd.io/etcd/api/v3",
+        "go.etcd.io/etcd/client/v3",
+        "google.golang.org/grpc",
+        "google.golang.org/protobuf",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apiserver",
+        "oras.land/oras-go",
+        "sigs.k8s.io/apiserver-network-proxy/konnectivity-client"
+      ],
+      "github.com/google/gofuzz": [
+        "github.com/containerd/containerd",
+        "github.com/json-iterator/go",
+        "kubesphere.io/client-go",
+        "sigs.k8s.io/controller-runtime"
+      ],
+      "github.com/google/shlex": [
+        "helm.sh/helm/v3",
+        "k8s.io/cli-runtime",
+        "k8s.io/kubectl",
+        "sigs.k8s.io/kustomize/api"
+      ],
+      "github.com/gorilla/handlers": [
+        "helm.sh/helm/v3",
+        "oras.land/oras-go"
+      ],
+      "github.com/gorilla/mux": [
+        "github.com/open-policy-agent/opa",
+        "helm.sh/helm/v3",
+        "oras.land/oras-go"
+      ],
+      "github.com/gregjones/httpcache": [
+        "helm.sh/helm/v3",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/kubectl"
+      ],
+      "github.com/grpc-ecosystem/go-grpc-prometheus": [
+        "github.com/containerd/containerd",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apiserver"
+      ],
+      "github.com/grpc-ecosystem/grpc-gateway": [
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apiserver"
+      ],
+      "github.com/hashicorp/errwrap": [
+        "github.com/containerd/containerd",
+        "github.com/hashicorp/go-multierror",
+        "github.com/rubenv/sql-migrate",
+        "helm.sh/helm/v3"
+      ],
+      "github.com/hashicorp/go-multierror": [
+        "github.com/rubenv/sql-migrate",
+        "helm.sh/helm/v3"
+      ],
+      "github.com/hashicorp/go-uuid": [
+        "github.com/go-ldap/ldap/v3"
+      ],
+      "github.com/imdario/mergo": [
+        "github.com/rubenv/sql-migrate"
+      ],
+      "github.com/json-iterator/go": [
+        "github.com/containerd/containerd",
+        "github.com/emicklei/go-restful-openapi/v2",
+        "github.com/prometheus/client_golang",
+        "helm.sh/helm/v3",
+        "k8s.io/api",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apimachinery",
+        "k8s.io/apiserver",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/code-generator",
+        "k8s.io/component-base",
+        "k8s.io/kube-openapi",
+        "k8s.io/kubectl",
+        "kubesphere.io/kubesphere",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/controller-tools",
+        "sigs.k8s.io/structured-merge-diff/v4"
+      ],
+      "github.com/klauspost/compress": [
+        "github.com/containerd/containerd",
+        "github.com/containerd/stargz-snapshotter/estargz",
+        "github.com/google/go-containerregistry",
+        "github.com/open-policy-agent/opa",
+        "github.com/prometheus/client_golang",
+        "go.etcd.io/etcd/client/v3",
+        "go.mongodb.org/mongo-driver",
+        "helm.sh/helm/v3",
+        "oras.land/oras-go"
+      ],
+      "github.com/mailru/easyjson": [
+        "github.com/go-openapi/analysis",
+        "github.com/go-openapi/jsonpointer",
+        "github.com/go-openapi/jsonreference",
+        "github.com/go-openapi/loads",
+        "github.com/go-openapi/spec",
+        "github.com/go-openapi/swag",
+        "github.com/go-openapi/validate",
+        "helm.sh/helm/v3",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apimachinery",
+        "k8s.io/apiserver",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/code-generator",
+        "k8s.io/component-base",
+        "k8s.io/kube-openapi",
+        "k8s.io/kubectl",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/controller-tools",
+        "sigs.k8s.io/kustomize/api",
+        "sigs.k8s.io/kustomize/kyaml"
+      ],
+      "github.com/miekg/dns": [
+        "github.com/open-policy-agent/opa",
+        "helm.sh/helm/v3"
+      ],
+      "github.com/mitchellh/cli": [
+        "github.com/rubenv/sql-migrate"
+      ],
+      "github.com/modern-go/concurrent": [
+        "github.com/containerd/containerd",
+        "github.com/json-iterator/go",
+        "github.com/prometheus/client_golang",
+        "helm.sh/helm/v3",
+        "k8s.io/api",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apimachinery",
+        "k8s.io/apiserver",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/code-generator",
+        "k8s.io/component-base",
+        "k8s.io/kube-openapi",
+        "k8s.io/kubectl",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/controller-tools",
+        "sigs.k8s.io/structured-merge-diff/v4"
+      ],
+      "github.com/modern-go/reflect2": [
+        "github.com/containerd/containerd",
+        "github.com/json-iterator/go",
+        "github.com/prometheus/client_golang",
+        "helm.sh/helm/v3",
+        "k8s.io/api",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apimachinery",
+        "k8s.io/apiserver",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/code-generator",
+        "k8s.io/component-base",
+        "k8s.io/kube-openapi",
+        "k8s.io/kubectl",
+        "kubesphere.io/kubesphere",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/controller-tools"
+      ],
+      "github.com/onsi/ginkgo": [
+        "sigs.k8s.io/application",
+        "sigs.k8s.io/controller-tools"
+      ],
+      "github.com/pkg/errors": [
+        "github.com/containerd/containerd",
+        "github.com/go-git/gcfg",
+        "github.com/google/go-containerregistry",
+        "gomodules.xyz/jsonpatch/v2",
+        "helm.sh/helm/v3",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apimachinery",
+        "k8s.io/apiserver",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/component-base",
+        "k8s.io/kubectl",
+        "kubesphere.io/kubesphere",
+        "kubesphere.io/utils",
+        "oras.land/oras-go",
+        "sigs.k8s.io/application",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/kustomize/api"
+      ],
+      "github.com/planetscale/vtprotobuf": [
+        "google.golang.org/grpc"
+      ],
+      "github.com/xeipuuv/gojsonschema": [
+        "helm.sh/helm/v3"
+      ],
+      "go.mongodb.org/mongo-driver": [
+        "github.com/go-openapi/analysis",
+        "github.com/go-openapi/loads",
+        "github.com/go-openapi/strfmt",
+        "github.com/go-openapi/validate"
+      ],
+      "go.opencensus.io": [
+        "github.com/containerd/containerd"
+      ],
+      "golang.org/x/exp": [
+        "github.com/antlr4-go/antlr/v4",
+        "github.com/go-git/go-billy/v5",
+        "github.com/google/cel-go",
+        "github.com/rubenv/sql-migrate",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apiserver",
+        "kubesphere.io/kubesphere",
+        "sigs.k8s.io/controller-runtime"
+      ],
+      "google.golang.org/appengine": [
+        "github.com/containerd/containerd"
+      ],
+      "google.golang.org/genproto": [
+        "github.com/containerd/containerd",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apiserver"
+      ],
+      "gopkg.in/yaml.v2": [
+        "github.com/Masterminds/sprig/v3",
+        "github.com/containerd/containerd",
+        "github.com/jmespath/go-jmespath/internal/testify",
+        "github.com/prometheus/client_golang",
+        "github.com/prometheus/common",
+        "github.com/rubenv/sql-migrate",
+        "github.com/sergi/go-diff",
+        "gopkg.in/cas.v2",
+        "helm.sh/helm/v3",
+        "oras.land/oras-go",
+        "sigs.k8s.io/application",
+        "sigs.k8s.io/controller-tools"
+      ],
+      "gopkg.in/yaml.v3": [
+        "code.cloudfoundry.org/bytefmt",
+        "github.com/containerd/containerd",
+        "github.com/containerd/platforms",
+        "github.com/coreos/go-semver",
+        "github.com/cyphar/filepath-securejoin",
+        "github.com/go-git/go-billy/v5",
+        "github.com/go-git/go-git/v5",
+        "github.com/go-gorp/gorp/v3",
+        "github.com/go-jose/go-jose/v4",
+        "github.com/go-ldap/ldap/v3",
+        "github.com/go-openapi/analysis",
+        "github.com/go-openapi/errors",
+        "github.com/go-openapi/jsonpointer",
+        "github.com/go-openapi/jsonreference",
+        "github.com/go-openapi/loads",
+        "github.com/go-openapi/spec",
+        "github.com/go-openapi/strfmt",
+        "github.com/go-openapi/swag",
+        "github.com/go-openapi/validate",
+        "github.com/go-task/slim-sprig/v3",
+        "github.com/google/cel-go",
+        "github.com/google/gnostic-models",
+        "github.com/google/go-containerregistry",
+        "github.com/grpc-ecosystem/grpc-gateway/v2",
+        "github.com/onsi/ginkgo/v2",
+        "github.com/onsi/gomega",
+        "github.com/open-policy-agent/opa",
+        "github.com/prometheus/common",
+        "github.com/sagikazarmark/locafero",
+        "github.com/sourcegraph/conc",
+        "github.com/spf13/cobra",
+        "github.com/spf13/viper",
+        "github.com/stretchr/testify",
+        "github.com/subosito/gotenv",
+        "github.com/vbatts/tar-split",
+        "go.etcd.io/etcd/api/v3",
+        "go.etcd.io/etcd/client/pkg/v3",
+        "go.etcd.io/etcd/client/v3",
+        "go.opentelemetry.io/auto/sdk",
+        "go.opentelemetry.io/contrib/instrumentation/google.golang.org/grpc/otelgrpc",
+        "go.opentelemetry.io/contrib/instrumentation/net/http/otelhttp",
+        "go.opentelemetry.io/otel",
+        "go.opentelemetry.io/otel/exporters/otlp/otlptrace",
+        "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc",
+        "go.opentelemetry.io/otel/metric",
+        "go.opentelemetry.io/otel/sdk",
+        "go.opentelemetry.io/otel/trace",
+        "go.uber.org/automaxprocs",
+        "go.uber.org/multierr",
+        "go.uber.org/zap",
+        "helm.sh/helm/v3",
+        "k8s.io/apiextensions-apiserver",
+        "k8s.io/apimachinery",
+        "k8s.io/apiserver",
+        "k8s.io/cli-runtime",
+        "k8s.io/client-go",
+        "k8s.io/code-generator",
+        "k8s.io/component-base",
+        "k8s.io/kube-openapi",
+        "k8s.io/kubectl",
+        "kubesphere.io/kubesphere",
+        "oras.land/oras-go",
+        "sigs.k8s.io/controller-runtime",
+        "sigs.k8s.io/controller-tools",
+        "sigs.k8s.io/kustomize/api",
+        "sigs.k8s.io/kustomize/kyaml"
+      ]
+    },
+    "unwantedVendored": [
+      "github.com/davecgh/go-spew",
+      "github.com/gogo/protobuf",
+      "github.com/golang/groupcache",
+      "github.com/golang/protobuf",
+      "github.com/google/gofuzz",
+      "github.com/google/shlex",
+      "github.com/gorilla/mux",
+      "github.com/gregjones/httpcache",
+      "github.com/grpc-ecosystem/go-grpc-prometheus",
+      "github.com/hashicorp/errwrap",
+      "github.com/hashicorp/go-multierror",
+      "github.com/json-iterator/go",
+      "github.com/klauspost/compress",
+      "github.com/mailru/easyjson",
+      "github.com/modern-go/concurrent",
+      "github.com/modern-go/reflect2",
+      "github.com/pkg/errors",
+      "github.com/xeipuuv/gojsonschema",
+      "go.mongodb.org/mongo-driver",
+      "golang.org/x/exp",
+      "gopkg.in/yaml.v2",
+      "gopkg.in/yaml.v3"
+    ]
+  }
+}

hack/update-gofmt.sh

@@ -1,5 +1,19 @@
 #!/usr/bin/env bash
 
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # GoFmt apparently is changing @ head...
 
 set -o errexit
@@ -9,25 +23,22 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 cd "${KUBE_ROOT}"
 
-find_files() {
-  find . -not \( \
-      \( \
-        -wholename './output' \
-        -o -wholename './.git' \
-        -o -wholename './_output' \
-        -o -wholename './_gopath' \
-        -o -wholename './release' \
-        -o -wholename './target' \
-        -o -wholename '*/third_party/*' \
-        -o -wholename '*/vendor/*' \
-        -o -wholename './staging/src/kubesphere.io/client-go/*vendor/*' \
-        -o -wholename './staging/src/kubesphere.io/api/*/zz_generated.deepcopy.go' \
-      \) -prune \
-    \) -name '*.go'
+function git_find() {
+    # Similar to find but faster and easier to understand.  We want to include
+    # modified and untracked files because this might be running against code
+    # which is not tracked by git yet.
+    git ls-files -cmo --exclude-standard \
+        ':!:vendor/*'        `# catches vendor/...` \
+        ':!:*/vendor/*'      `# catches any subdir/vendor/...` \
+        ':!:third_party/*'   `# catches third_party/...` \
+        ':!:*/third_party/*' `# catches third_party/...` \
+        ':!:*/testdata/*'    `# catches any subdir/testdata/...` \
+        ':(glob)**/*.go' \
+        "$@"
 }
 
-find_files | xargs gofmt -s -w
+git_find -z | xargs -0 gofmt -s -w

hack/update-goimports.sh

@@ -21,25 +21,17 @@ set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
-source "${KUBE_ROOT}/hack/lib/util.sh"
 
-kube::golang::verify_go_version
-
-# Ensure that we find the binaries we build before anything else.
-export GOBIN="${KUBE_OUTPUT_BINPATH}"
-PATH="${GOBIN}:${PATH}"
-
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
+kube::golang::setup_env
 
 if ! command -v goimports ; then
-# Install goimports
+  # Install goimports
   echo 'installing goimports'
-  GO111MODULE=auto go install -mod=mod golang.org/x/tools/cmd/goimports@v0.7.0
+  go install -mod=mod golang.org/x/tools/cmd/goimports@v0.33.0
 fi
 
 cd "${KUBE_ROOT}" || exit 1
 
-IFS=$'\n' read -r -d '' -a files < <( find . -type f -name '*.go' -not -path "./vendor/*" -not -path "./pkg/client/*" -not -name "zz_generated.deepcopy.go" && printf '\0' )
+IFS=$'\n' read -r -d '' -a files < <( find . -type f -name '*.go' -not -path "./vendor/*" -not -path "./_output/*" -not -name "zz_generated.deepcopy.go" && printf '\0' )
 
-"goimports" -w -local kubesphere.io/kubesphere "${files[@]}"
+goimports -w -local kubesphere.io/kubesphere "${files[@]}"

hack/update-internal-modules.sh

@@ -0,0 +1,47 @@
+#!/usr/bin/env bash
+
+# Copyright 2020 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+source "${KUBE_ROOT}/hack/lib/init.sh"
+
+# These are "internal" modules.  For various reasons, we want them to be
+# decoupled from their parent modules.
+MODULES=()                                                                                                                                                                   
+kube::util::read-array MODULES < <(
+    git ls-files -cmo --exclude-standard -- ':!:vendor/*' ':(glob)*/**/go.work' \
+        | while read -r F; do \
+            dirname "${F}"; \
+        done
+    )
+
+# Detect problematic GOPROXY settings that prevent lookup of dependencies
+if [[ "${GOPROXY:-}" == "off" ]]; then
+  kube::log::error "Cannot run hack/update-internal-modules.sh with \$GOPROXY=off"
+  exit 1
+fi
+
+kube::golang::setup_env
+
+for mod in "${MODULES[@]}"; do
+  echo "=== tidying go.mod/go.sum in ${mod}"
+  echo "${KUBE_ROOT}/${mod}"
+  go -C "${KUBE_ROOT}/${mod}" mod edit -fmt
+  go -C "${KUBE_ROOT}/${mod}" mod tidy
+done

hack/update-licenses.sh

@@ -7,24 +7,23 @@ set -o pipefail
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-if ! command -v license-eye &> /dev/null
-then
-    # Ensure that we find the binaries we build before anything else.
-    export GOBIN="${KUBE_OUTPUT_BINPATH}"
-    PATH="${GOBIN}:${PATH}"
+kube::golang::setup_env
 
-    # Explicitly opt into go modules, even though we're inside a GOPATH directory
-    export GO111MODULE=on
-    # Explicitly clear GOFLAGS, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
-    export GOFLAGS=
-
-    # Install skywalking-eyes
-    echo 'installing skywalking-eyes '
-    go install -mod=mod github.com/apache/skywalking-eyes/cmd/license-eye@v0.6.0
+if ! command -v goimports ; then
+  # Install goimports
+  echo 'installing goimports'
+  go install -mod=mod github.com/apache/skywalking-eyes/cmd/license-eye@v0.7.0
 fi
 
-cd "${KUBE_ROOT}"
+cd "${KUBE_ROOT}" || exit 1
 
 echo 'running skywalking-eyes fix '
-license-eye header fix
-exit 0
+
+mapfile -t files < <(git diff --name-only HEAD~1 | grep -v '^vendor/' | grep -E '\.go$' || true)
+
+if [ "${#files[@]}" -eq 0 ]; then
+  echo "✅ No files changed."
+  exit 0
+fi
+
+license-eye header fix "${files[@]}"

hack/update-vendor-licenses.sh

@@ -103,6 +103,7 @@ process_content () {
   IFS=" " read -r -a local_files <<< "$(
     for dir_root in ${package} ${package_root}; do
       [[ -d ${DEPS_DIR}/${dir_root} ]] || continue
+
       # One (set) of these is fine
       find "${DEPS_DIR}/${dir_root}" \
           -xdev -follow -maxdepth ${find_maxdepth} \
@@ -134,7 +135,8 @@ process_content () {
 #############################################################################
 
 # use modules, and use module info rather than the vendor dir for computing dependencies
-export GO111MODULE=on
+kube::golang::setup_env
+export GOWORK=off
 export GOFLAGS=-mod=mod
 
 # Check bash version
@@ -200,8 +202,8 @@ for PACKAGE in ${modules}; do
 
   # if there are no files vendored under this package...
   if [[ -z "$(find "${DEPS_DIR}/${PACKAGE}" -mindepth 1 -maxdepth 1 -type f)" ]]; then
-    # and we have the same number of submodules as subdirectories...
-    if [[ "$(find "${DEPS_DIR}/${PACKAGE}/" -mindepth 1 -maxdepth 1 -type d | wc -l)" -gt 0 ]]; then
+    # and we have at least the same number of submodules as subdirectories...
+    if [[ "$(find "${DEPS_DIR}/${PACKAGE}/" -mindepth 1 -maxdepth 1 -type d | wc -l)" -le "$(echo "${modules}" | grep -cE "^${PACKAGE}/")" ]]; then
       echo "Only submodules of ${PACKAGE} are vendored, skipping" >&2
       continue
     fi
@@ -229,6 +231,7 @@ for PACKAGE in ${modules}; do
     if [[ -z "${file}" ]]; then
       cat >&2 << __EOF__
 No license could be found for ${PACKAGE} - aborting.
+
 Options:
 1. Check if the upstream repository has a newer version with LICENSE, COPYRIGHT and/or
    COPYING files.
@@ -249,7 +252,14 @@ __EOF__
   mv "${TMP_LICENSE_FILE}" "${dest_dir}/LICENSE"
 done
 
+# copy licenses for forked code from vendor and third_party directories
+(cd "${KUBE_ROOT}" && \
+  find vendor third_party -iname 'licen[sc]e*' -o -iname 'notice*' -o -iname 'copying*' | \
+  grep -E 'third_party|forked' | \
+  xargs tar -czf - | tar -C "${TMP_LICENSES_DIR}" -xzf -)
+
 # Leave things like OWNERS alone.
 rm -f "${LICENSES_DIR}/LICENSE"
 rm -rf "${LICENSES_DIR}/vendor"
+rm -rf "${LICENSES_DIR}/third_party"
 mv "${TMP_LICENSES_DIR}"/* "${LICENSES_DIR}"

hack/update-vendor.sh

@@ -1,6 +1,18 @@
 #!/usr/bin/env bash
 
-# This script is a modified version of Kubernetes
+# Copyright 2019 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
 
 set -o errexit
 set -o nounset
@@ -12,7 +24,12 @@ cd "$(pwd -P)"
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
+# Get all the default Go environment.
+kube::golang::setup_env
+
+# Turn off workspaces until we are ready for them later
+export GOWORK=off
+# Explicitly opt into go modules
 export GO111MODULE=on
 # Explicitly set GOFLAGS to ignore vendor, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
 export GOFLAGS=-mod=mod
@@ -25,65 +42,30 @@ if [[ "${GOPROXY:-}" == "off" ]]; then
   exit 1
 fi
 
-kube::golang::verify_go_version
 kube::util::require-jq
 
 TMP_DIR="${TMP_DIR:-$(mktemp -d /tmp/update-vendor.XXXX)}"
 LOG_FILE="${LOG_FILE:-${TMP_DIR}/update-vendor.log}"
 kube::log::status "logfile at ${LOG_FILE}"
 
+# Set up some FDs for this script to use, while capturing everything else to
+# the log. NOTHING ELSE should write to $LOG_FILE directly.
+exec 11>&1            # Real stdout, use this explicitly
+exec 22>&2            # Real stderr, use this explicitly
+exec 1>"${LOG_FILE}"  # Automatic stdout
+exec 2>&1             # Automatic stderr
+set -x                # Trace this script to stderr
+go env                # For the log
+
 function finish {
   ret=$?
   if [[ ${ret} != 0 ]]; then
-    echo "An error has occurred. Please see more details in ${LOG_FILE}"
+    echo "An error has occurred. Please see more details in ${LOG_FILE}" >&22
   fi
   exit ${ret}
 }
 trap finish EXIT
 
-if [ -z "${BASH_XTRACEFD:-}" ]; then
-  exec 19> "${LOG_FILE}"
-  export BASH_XTRACEFD="19"
-  set -x
-fi
-
-# ensure_require_replace_directives_for_all_dependencies:
-# - ensures all existing 'require' directives have an associated 'replace' directive pinning a version
-# - adds explicit 'require' directives for all transitive dependencies
-# - adds explicit 'replace' directives for all require directives (existing 'replace' directives take precedence)
-function ensure_require_replace_directives_for_all_dependencies() {
-  local local_tmp_dir
-  local_tmp_dir=$(mktemp -d "${TMP_DIR}/pin_replace.XXXX")
-
-  # collect 'require' directives that actually specify a version
-  local require_filter='(.Version != null) and (.Version != "v0.0.0") and (.Version != "v0.0.0-00010101000000-000000000000")'
-  # collect 'replace' directives that unconditionally pin versions (old=new@version)
-  local replace_filter='(.Old.Version == null) and (.New.Version != null)'
-
-  # Capture local require/replace directives before running any go commands that can modify the go.mod file
-  local require_json="${local_tmp_dir}/require.json"
-  local replace_json="${local_tmp_dir}/replace.json"
-  go mod edit -json \
-      | jq -r ".Require // [] | sort | .[] | select(${require_filter})" \
-      > "${require_json}"
-  go mod edit -json \
-      | jq -r ".Replace // [] | sort | .[] | select(${replace_filter})" \
-      > "${replace_json}"
-
-  # Propagate root replace/require directives into staging modules, in case we are downgrading, so they don't bump the root required version back up
-  for repo in $(kube::util::list_staging_repos); do
-    pushd "staging/src/kubesphere.io/${repo}" >/dev/null 2>&1
-      jq -r '"-require \(.Path)@\(.Version)"' < "${require_json}" \
-          | xargs -L 100 go mod edit -fmt
-      jq -r '"-replace \(.Old.Path)=\(.New.Path)@\(.New.Version)"' < "${replace_json}" \
-          | xargs -L 100 go mod edit -fmt
-    popd >/dev/null 2>&1
-  done
-
-  # tidy to ensure require directives are added for indirect dependencies
-  go mod tidy
-}
-
 function print_go_mod_section() {
   local directive="$1"
   local file="$2"
@@ -160,197 +142,135 @@ function add_generated_comments() {
   go mod edit -fmt
 }
 
+function add_staging_replace_directives() {
+  local path_to_staging_kubesphere_io="$1"
+  # Prune
+  go mod edit -json \
+      | jq -r '.Require[]? | select(.Version == "v0.0.0")                 | "-droprequire \(.Path)"' \
+      | xargs -L 100 go mod edit -fmt
+  go mod edit -json \
+      | jq -r '.Replace[]? | select(.New.Path | startswith("'"${path_to_staging_kubesphere_io}"'")) | "-dropreplace \(.Old.Path)"' \
+      | xargs -L 100 go mod edit -fmt
+  # Re-add
+  kube::util::list_staging_repos \
+      | while read -r X; do echo "-require kubesphere.io/${X}@v0.0.0"; done \
+      | xargs -L 100 go mod edit -fmt
+  kube::util::list_staging_repos \
+      | while read -r X; do echo "-replace kubesphere.io/${X}=${path_to_staging_kubesphere_io}/${X}"; done \
+      | xargs -L 100 go mod edit -fmt
+}
 
-# Phase 1: ensure go.mod files for staging modules and main module
-
-for repo in $(kube::util::list_staging_repos); do
-  pushd "staging/src/kubesphere.io/${repo}" >/dev/null 2>&1
-    if [[ ! -f go.mod ]]; then
-      kube::log::status "go.mod: initialize ${repo}"
-      rm -f Godeps/Godeps.json # remove before initializing, staging Godeps are not authoritative
-      go mod init "kubesphere.io/${repo}"
-      go mod edit -fmt
-    fi
-  popd >/dev/null 2>&1
-done
-
-if [[ ! -f go.mod ]]; then
-  kube::log::status "go.mod: initialize kubesphere.io/kubesphere"
-  go mod init "kubesphere.io/kubesphere"
-  rm -f Godeps/Godeps.json # remove after initializing
+# === Capture go / godebug directives from root go.mod
+go_directive_value=$(grep '^go 1.' go.mod | awk '{print $2}' || true)
+if [[ -z "${go_directive_value}" ]]; then
+  kube::log::error "root go.mod must have 'go 1.x.y' directive" >&22 2>&1
+  exit 1
 fi
-
-
-# Phase 2: ensure staging repo require/replace directives
-
-kube::log::status "go.mod: update staging references"
-# Prune
-go mod edit -json \
-    | jq -r '.Require[]? | select(.Version == "v0.0.0")                 | "-droprequire \(.Path)"' \
-    | xargs -L 100 go mod edit -fmt
-go mod edit -json \
-    | jq -r '.Replace[]? | select(.New.Path | startswith("./staging/")) | "-dropreplace \(.Old.Path)"' \
-    | xargs -L 100 go mod edit -fmt
-# Readd
-kube::util::list_staging_repos \
-    | while read -r X; do echo "-require kubesphere.io/${X}@v0.0.0"; done \
-    | xargs -L 100 go mod edit -fmt
-kube::util::list_staging_repos \
-    | while read -r X; do echo "-replace kubesphere.io/${X}=./staging/src/kubesphere.io/${X}"; done \
-    | xargs -L 100 go mod edit -fmt
-
-
-# Phase 3: capture required (minimum) versions from all modules, and replaced (pinned) versions from the root module
-
-# pin referenced versions
-ensure_require_replace_directives_for_all_dependencies
-# resolves/expands references in the root go.mod (if needed)
-go mod tidy >>"${LOG_FILE}" 2>&1
-# pin expanded versions
-ensure_require_replace_directives_for_all_dependencies
-# group require/replace directives
-group_directives
-
-# Phase 4: copy root go.mod to staging dirs and rewrite
-
-kube::log::status "go.mod: propagate to staging modules"
-for repo in $(kube::util::list_staging_repos); do
-  pushd "staging/src/kubesphere.io/${repo}" >/dev/null 2>&1
-    echo "=== propagating to ${repo}" >> "${LOG_FILE}"
-    # copy root go.mod, changing module name
-    sed "s#module kubesphere.io/kubesphere#module kubesphere.io/${repo}#" \
-        < "${KUBE_ROOT}/go.mod" \
-        > "${KUBE_ROOT}/staging/src/kubesphere.io/${repo}/go.mod"
-    # remove `require` directives for staging components (will get re-added as needed by `go list`)
-    kube::util::list_staging_repos \
-        | while read -r X; do echo "-droprequire kubesphere.io/${X}"; done \
-        | xargs -L 100 go mod edit
-    # rewrite `replace` directives for staging components to point to peer directories
-    kube::util::list_staging_repos \
-        | while read -r X; do echo "-replace kubesphere.io/${X}=../${X}"; done \
-        | xargs -L 100 go mod edit
-  popd >/dev/null 2>&1
-done
-
-
-# Phase 5: sort and tidy staging components
-
-kube::log::status "go.mod: sorting staging modules"
-# tidy staging repos in reverse dependency order.
-# the content of dependencies' go.mod files affects what `go mod tidy` chooses to record in a go.mod file.
-tidy_unordered="${TMP_DIR}/tidy_unordered.txt"
-kube::util::list_staging_repos \
-    | xargs -I {} echo "kubesphere.io/{}" > "${tidy_unordered}"
-rm -f "${TMP_DIR}/tidy_deps.txt"
-# SC2094 checks that you do not read and write to the same file in a pipeline.
-# We do read from ${tidy_unordered} in the pipeline and mention it within the
-# pipeline (but only ready it again) so we disable the lint to assure shellcheck
-# that :this-is-fine:
-# shellcheck disable=SC2094
-while IFS= read -r repo; do
-  # record existence of the repo to ensure modules with no peer relationships still get included in the order
-  echo "${repo} ${repo}" >> "${TMP_DIR}/tidy_deps.txt"
-
-  pushd "${KUBE_ROOT}/staging/src/${repo}" >/dev/null 2>&1
-    # save the original go.mod, since go list doesn't just add missing entries, it also removes specific required versions from it
-    tmp_go_mod="${TMP_DIR}/tidy_${repo/\//_}_go.mod.original"
-    tmp_go_deps="${TMP_DIR}/tidy_${repo/\//_}_deps.txt"
-    cp go.mod "${tmp_go_mod}"
-
-    {
-      echo "=== sorting ${repo}"
-      # 'go list' calculates direct imports and updates go.mod so that go list -m lists our module dependencies
-      echo "=== computing imports for ${repo}"
-      go list all
-      echo "=== computing tools imports for ${repo}"
-      go list -tags=tools all
-    } >> "${LOG_FILE}" 2>&1
-
-    # capture module dependencies
-    go list -m -f '{{if not .Main}}{{.Path}}{{end}}' all > "${tmp_go_deps}"
-
-    # restore the original go.mod file
-    cp "${tmp_go_mod}" go.mod
-
-    # list all module dependencies
-    for dep in $(join "${tidy_unordered}" "${tmp_go_deps}"); do
-      # record the relationship (put dep first, because we want to sort leaves first)
-      echo "${dep} ${repo}" >> "${TMP_DIR}/tidy_deps.txt"
-      # switch the required version to an explicit v0.0.0 (rather than an unknown v0.0.0-00010101000000-000000000000)
-      go mod edit -require "${dep}@v0.0.0"
-    done
-  popd >/dev/null 2>&1
-done < "${tidy_unordered}"
-
-kube::log::status "go.mod: tidying"
-for repo in $(tsort "${TMP_DIR}/tidy_deps.txt"); do
-  pushd "${KUBE_ROOT}/staging/src/${repo}" >/dev/null 2>&1
-    echo "=== tidying ${repo}" >> "${LOG_FILE}"
-
-    # prune replace directives that pin to the naturally selected version.
-    # do this before tidying, since tidy removes unused modules that
-    # don't provide any relevant packages, which forgets which version of the
-    # unused transitive dependency we had a require directive for,
-    # and prevents pruning the matching replace directive after tidying.
-    go list -m -json all |
-      jq -r 'select(.Replace != null) |
-             select(.Path == .Replace.Path) |
-             select(.Version == .Replace.Version) |
-             "-dropreplace \(.Replace.Path)"' |
-    xargs -L 100 go mod edit -fmt
-
-    go mod tidy -v >>"${LOG_FILE}" 2>&1
-
-    # disallow transitive dependencies on kubesphere.io/kubesphere
-    loopback_deps=()
-    kube::util::read-array loopback_deps < <(go list all 2>/dev/null | grep kubesphere.io/kubesphere/ || true)
-    if [[ -n ${loopback_deps[*]:+"${loopback_deps[*]}"} ]]; then
-      kube::log::error "Disallowed ${repo} -> kubesphere.io/kubesphere dependencies exist via the following imports:
-$(go mod why "${loopback_deps[@]}")"
-      exit 1
-    fi
-
-    # prune unused pinned replace directives
-    comm -23 \
-      <(go mod edit -json | jq -r '.Replace[] | .Old.Path' | sort) \
-      <(go list -m -json all | jq -r .Path | sort) |
-    while read -r X; do echo "-dropreplace=${X}"; done |
-    xargs -L 100 go mod edit -fmt
-
-    # prune replace directives that pin to the naturally selected version
-    go list -m -json all |
-      jq -r 'select(.Replace != null) |
-             select(.Path == .Replace.Path) |
-             select(.Version == .Replace.Version) |
-             "-dropreplace \(.Replace.Path)"' |
-    xargs -L 100 go mod edit -fmt
-
-    # group require/replace directives
-    group_directives
-
-  popd >/dev/null 2>&1
-done
-echo "=== tidying root" >> "${LOG_FILE}"
-go mod tidy >>"${LOG_FILE}" 2>&1
-
-# prune unused pinned non-local replace directives
-comm -23 \
-  <(go mod edit -json | jq -r '.Replace[] | select(.New.Path | startswith("./") | not) | .Old.Path' | sort) \
-  <(go list -m -json all | jq -r .Path | sort) |
-while read -r X; do echo "-dropreplace=${X}"; done |
-xargs -L 100 go mod edit -fmt
-
-# disallow transitive dependencies on kubesphere.io/kubesphere
-loopback_deps=()
-kube::util::read-array loopback_deps < <(go mod graph | grep ' kubesphere.io/kubesphere' || true)
-if [[ -n ${loopback_deps[*]:+"${loopback_deps[*]}"} ]]; then
-  kube::log::error "Disallowed transitive kubesphere.io/kubesphere dependencies exist via the following imports:"
-  kube::log::error "${loopback_deps[@]}"
+godebug_directive_value=$(grep 'godebug default=go' go.mod | awk '{print $2}' || true)
+if [[ -z "${godebug_directive_value}" ]]; then
+  kube::log::error "root go.mod must have 'godebug default=go1.x' directive" >&22 2>&1
   exit 1
 fi
 
-# Phase 6: add generated comments to go.mod files
-kube::log::status "go.mod: adding generated comments"
+# === Ensure staging go.mod files exist
+for repo in $(kube::util::list_staging_repos); do
+  (
+    cd "staging/src/kubesphere.io/${repo}"
+
+    if [[ ! -f go.mod ]]; then
+      kube::log::status "go.mod: initialize ${repo}" >&11
+      go mod init "kubesphere.io/${repo}"
+    fi
+    go mod edit -go "${go_directive_value}" -godebug "${godebug_directive_value}"
+  )
+done
+
+# === Ensure root and staging go.mod files refer to each other using v0.0.0 and local path replaces
+kube::log::status "go.mod: update staging module references" >&11
+add_staging_replace_directives "./staging/src/kubesphere.io"
+for repo in $(kube::util::list_staging_repos); do
+  (
+    cd "staging/src/kubesphere.io/${repo}"
+    add_staging_replace_directives ".."
+  )
+done
+
+# === Ensure all root and staging modules are included in go.work
+kube::log::status "go.mod: go work use" >&11
+(
+  cd "${KUBE_ROOT}"
+  unset GOWORK
+  unset GOFLAGS
+  if [[ ! -f go.work ]]; then
+    kube::log::status "go.work: initialize" >&11
+    go work init
+  fi
+  # Prune use directives
+  go work edit -json \
+      | jq -r '.Use[]? | "-dropuse \(.DiskPath)"' \
+      | xargs -L 100 go work edit -fmt
+  # Ensure go and godebug directives
+  go work edit -go "${go_directive_value}" -godebug "${godebug_directive_value}"
+  # Re-add use directives
+  go work use .
+  for repo in $(kube::util::list_staging_repos); do
+    go work use "./staging/src/kubesphere.io/${repo}"
+  done
+)
+
+# === Propagate MVS across all root / staging modules (calculated by `go work`) back into root / staging modules
+kube::log::status "go.mod: go work sync" >&11
+(
+  cd "${KUBE_ROOT}"
+  unset GOWORK
+  unset GOFLAGS
+  go work sync
+)
+
+# === Tidy
+kube::log::status "go.mod: tidy" >&11
+for repo in $(kube::util::list_staging_repos); do
+  (
+    echo "=== tidying kubesphere.io/${repo}"
+    cd "staging/src/kubesphere.io/${repo}"
+    go mod tidy -v
+    group_directives
+  )
+done
+echo "=== tidying root"
+go mod tidy -v
+group_directives
+
+# === Prune unused replace directives, format modules
+kube::log::status "go.mod: prune" >&11
+for repo in $(kube::util::list_staging_repos); do
+  (
+    echo "=== pruning kubesphere.io/${repo}"
+    cd "staging/src/kubesphere.io/${repo}"
+
+    # drop all unused replace directives
+    comm -23 \
+      <(go mod edit -json | jq -r '.Replace[] | .Old.Path' | sort) \
+      <(go list -m -json all | jq -r 'select(.Main | not) | .Path' | sort) |
+    while read -r X; do echo "-dropreplace=${X}"; done |
+    xargs -L 100 go mod edit -fmt
+
+    group_directives
+  )
+done
+
+echo "=== pruning root"
+# drop unused replace directives other than to local paths
+comm -23 \
+  <(go mod edit -json | jq -r '.Replace[] | select(.New.Path | startswith("./") | not) | .Old.Path' | sort) \
+  <(go list -m -json all | jq -r 'select(.Main | not) | .Path' | sort) |
+while read -r X; do echo "-dropreplace=${X}"; done |
+xargs -L 100 go mod edit -fmt
+
+group_directives
+
+# === Add generated comments to go.mod files
+kube::log::status "go.mod: adding generated comments" >&11
 add_generated_comments "
 // This is a generated file. Do not edit directly.
 // Ensure you've carefully read
@@ -359,31 +279,60 @@ add_generated_comments "
 // Run hack/update-vendor.sh to update go.mod files and the vendor directory.
 "
 for repo in $(kube::util::list_staging_repos); do
-  pushd "staging/src/kubesphere.io/${repo}" >/dev/null 2>&1
+  (
+    cd "staging/src/kubesphere.io/${repo}"
     add_generated_comments "// This is a generated file. Do not edit directly."
-  popd >/dev/null 2>&1
+  )
 done
 
+# === Update internal modules
+kube::log::status "vendor: updating internal modules" >&11
+hack/update-internal-modules.sh
 
-# Phase 7: rebuild vendor directory
-kube::log::status "vendor: running 'go mod vendor'"
-go mod vendor >>"${LOG_FILE}" 2>&1
 
-# create a symlink in vendor directory pointing to the staging components.
-# This lets other packages and tools use the local staging components as if they were vendored.
-for repo in $(kube::util::list_staging_repos); do
-  rm -fr "${KUBE_ROOT}/vendor/kubesphere.io/${repo}"
-  ln -s "../../staging/src/kubesphere.io/${repo}" "${KUBE_ROOT}/vendor/kubesphere.io/${repo}"
-done
+# === Rebuild vendor directory
+(
+  kube::log::status "vendor: running 'go work vendor'" >&11
+  unset GOWORK
+  unset GOFLAGS
+  # rebuild go.work.sum
+  rm -f go.work.sum
+  go mod download
+  # rebuild vendor
+  go work vendor
+)
 
-kube::log::status "vendor: updating vendor/LICENSES"
-hack/update-vendor-licenses.sh >>"${LOG_FILE}" 2>&1
+kube::log::status "vendor: updating vendor/LICENSES" >&11
+hack/update-vendor-licenses.sh
 
-kube::log::status "vendor: creating OWNERS file"
+kube::log::status "vendor: creating OWNERS file" >&11
 rm -f "vendor/OWNERS"
 cat <<__EOF__ > "vendor/OWNERS"
 # See the OWNERS docs at https://github.com/kubesphere/kubesphere/blob/master/OWNERS
-
 __EOF__
 
-kube::log::status "NOTE: don't forget to handle vendor/* and LICENSE/* files that were added or removed"
+# === Disallow transitive dependencies on kubesphere.io/kubesphere
+kube::log::status "go.mod: prevent staging --> kubesphere.io/kubesphere dep" >&11
+for repo in $(kube::util::list_staging_repos); do
+  (
+    echo "=== checking kubesphere.io/${repo}"
+    cd "staging/src/kubesphere.io/${repo}"
+    loopback_deps=()
+    kube::util::read-array loopback_deps < <(go list all 2>/dev/null | grep kubesphere.io/kubesphere/ || true)
+    if (( "${#loopback_deps[@]}" > 0 )); then
+      kube::log::error "${#loopback_deps[@]} disallowed ${repo} -> kubesphere.io/kubesphere dependencies exist via the following imports: $(go mod why "${loopback_deps[@]}")" >&22 2>&1
+      exit 1
+    fi
+  )
+done
+
+kube::log::status "go.mod: prevent kubesphere.io/kubesphere --> * --> kubesphere.io/kubesphere dep" >&11
+loopback_deps=()
+kube::util::read-array loopback_deps < <(go mod graph | grep ' kubesphere.io/kubesphere' || true)
+if (( "${#loopback_deps[@]}" > 0 )); then
+  kube::log::error "${#loopback_deps[@]} disallowed transitive kubesphere.io/kubesphere dependencies exist via the following imports:" >&22 2>&1
+  kube::log::error "${loopback_deps[@]}" >&22 2>&1
+  exit 1
+fi
+
+kube::log::status "NOTE: don't forget to handle vendor/* and LICENSE/* files that were added or removed" >&11

hack/verify-all.sh

@@ -25,11 +25,9 @@ source "${KUBE_ROOT}/hack/lib/util.sh"
 # Excluded check patterns are always skipped.
 EXCLUDED_PATTERNS=(
   "verify-all.sh"                # this script calls the make rule and would cause a loop
-  "verify-linkcheck.sh"          # runs in separate Jenkins job once per day due to high network usage
-  "verify-*-dockerized.sh"       # Don't run any scripts that intended to be run dockerized
-  "verify-govet-levee.sh"        # Do not run levee analysis by default while KEP-1933 implementation is in alpha.
-  # "verify-licenses.sh"
+  "verify-licenses.sh"
   "verify-shellcheck.sh"
+  "verify-vendor-licenses.sh"
 )
 
 while IFS='' read -r line; do EXCLUDED_CHECKS+=("$line"); done < <(ls "${EXCLUDED_PATTERNS[@]/#/${KUBE_ROOT}/hack/}" 2>/dev/null || true)

hack/verify-gofmt.sh

@@ -1,5 +1,19 @@
 #!/usr/bin/env bash
 
+# Copyright 2014 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 # This script checks whether the source code needs to be formatted or not by
 # `gofmt`. Run `hack/update-gofmt.sh` to actually format sources.
 #
@@ -16,21 +30,18 @@ source "${KUBE_ROOT}/hack/lib/init.sh"
 
 cd "${KUBE_ROOT}"
 
-kube::golang::verify_go_version
+kube::golang::setup_env
 
 find_files() {
   find . -not \( \
       \( \
-        -wholename './output' \
-        -o -wholename './.git' \
+        -wholename './.git' \
         -o -wholename './_output' \
-        -o -wholename './_gopath' \
         -o -wholename './release' \
         -o -wholename './target' \
         -o -wholename '*/third_party/*' \
         -o -wholename '*/vendor/*' \
-        -o -wholename './staging/src/kubesphere.io/client-go/*vendor/*' \
-        -o -wholename './staging/src/kubesphere.io/api/*/zz_generated.deepcopy.go' \
+        -o -wholename '*/testdata/*' \
         -o -wholename '*/bindata.go' \
       \) -prune \
     \) -name '*.go'

hack/verify-goimports.sh

@@ -20,26 +20,24 @@ set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
-source "${KUBE_ROOT}/hack/lib/util.sh"
 
-kube::golang::verify_go_version
+# Detect problematic GOPROXY settings that prevent lookup of dependencies
+if [[ "${GOPROXY:-}" == "off" ]]; then
+  kube::log::error "Cannot run with \$GOPROXY=off"
+  exit 1
+fi
 
-# Ensure that we find the binaries we build before anything else.
-export GOBIN="${KUBE_OUTPUT_BINPATH}"
-PATH="${GOBIN}:${PATH}"
-
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
+kube::golang::setup_env
 
 if ! command -v goimports ; then
-# Install goimports
+  # Install goimports
   echo 'installing goimports'
-  GO111MODULE=auto go install -mod=mod golang.org/x/tools/cmd/goimports@v0.7.0
+  go install -mod=mod golang.org/x/tools/cmd/goimports@v0.33.0
 fi
 
 cd "${KUBE_ROOT}" || exit 1
 
-IFS=$'\n' read -r -d '' -a files < <( find . -type f -name '*.go' -not -path "./vendor/*" -not -path "./pkg/apis/*" -not -path "./pkg/client/*" -not -name "zz_generated.deepcopy.go" && printf '\0' )
+IFS=$'\n' read -r -d '' -a files < <( find . -type f -name '*.go' -not -path "./vendor/*" -not -path "./_output/*" -not -name "zz_generated.deepcopy.go" && printf '\0' )
 
 output=$(goimports -local kubesphere.io/kubesphere -l "${files[@]}")
 

hack/verify-golangci-lint.sh

@@ -10,21 +10,13 @@ set -o pipefail
 
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
-source "${KUBE_ROOT}/hack/lib/util.sh"
 
-kube::golang::verify_go_version
-
-# Ensure that we find the binaries we build before anything else.
-export GOBIN="${KUBE_OUTPUT_BINPATH}"
-PATH="${GOBIN}:${PATH}"
-
-# Explicitly opt into go modules, even though we're inside a GOPATH directory
-export GO111MODULE=on
+kube::golang::setup_env
 
 if ! command -v golangci-lint ; then
-# Install golangci-lint
+  # Install golangci-lint
   echo 'installing golangci-lint'
-  GO111MODULE=auto go install -mod=mod github.com/golangci/golangci-lint/cmd/golangci-lint@v1.64.8
+  go install -mod=mod github.com/golangci/golangci-lint/v2/cmd/golangci-lint@v2.1.6
 fi
 
 cd "${KUBE_ROOT}"
@@ -43,12 +35,9 @@ echo "running golangci-lint: REV=HEAD^"
 golangci-lint run \
   -v \
   --timeout 30m \
-  --disable-all \
-  -E unused \
-  -E ineffassign \
-  -E staticcheck \
-  -E gosimple \
-  -E bodyclose \
-  --skip-dirs pkg/client \
+  --default standard \
   --new-from-rev=HEAD^ \
-  ./...
+  pkg/... \
+  cmd/... \
+  staging/... \
+  tools/...

hack/verify-licenses.sh

@@ -1,30 +1,134 @@
 #!/usr/bin/env bash
 
+# Copyright 2016 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Usage: `hack/verify-licenses.sh`.
+
+
 set -o errexit
 set -o nounset
 set -o pipefail
 
+
 KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 source "${KUBE_ROOT}/hack/lib/init.sh"
+source "${KUBE_ROOT}/hack/lib/util.sh"
 
-if ! command -v license-eye &> /dev/null
-then
-    # Ensure that we find the binaries we build before anything else.
-    export GOBIN="${KUBE_OUTPUT_BINPATH}"
-    PATH="${GOBIN}:${PATH}"
+# This sets up the environment, like GOCACHE, which keeps the worktree cleaner.
+kube::golang::setup_env
+kube::util::ensure-temp-dir
 
-    # Explicitly opt into go modules, even though we're inside a GOPATH directory
-    export GO111MODULE=on
-    # Explicitly clear GOFLAGS, since GOFLAGS=-mod=vendor breaks dependency resolution while rebuilding vendor
-    export GOFLAGS=
+ARTIFACTS="${ARTIFACTS:-${PWD}/_artifacts}"
+mkdir -p "$ARTIFACTS/logs/"
 
-    # Install skywalking-eyes
-    echo 'installing skywalking-eyes '
-    go install -mod=mod github.com/apache/skywalking-eyes/cmd/license-eye@v0.6.0
+# Creating a new repository tree
+# Deleting vendor directory to make go-licenses fetch license URLs from go-packages source repository
+git worktree add -f "${KUBE_TEMP}"/tmp_test_licenses/kubernetes HEAD >/dev/null 2>&1 || true
+cd "${KUBE_TEMP}"/tmp_test_licenses/kubernetes && rm -rf vendor
+
+# Ensure that we find the binaries we build before anything else.
+export GOBIN="${KUBE_OUTPUT_BIN}"
+PATH="${GOBIN}:${PATH}"
+
+function http_code() {
+    curl -I -s -o /dev/null -w "%{http_code}" "$1"
+}
+
+packages_flagged=()
+packages_url_missing=()
+exit_code=0
+
+# Install go-licenses
+echo '[INFO] Installing go-licenses...'
+go install github.com/google/go-licenses@latest
+
+# Fetching CNCF Approved List Of Licenses
+# Refer: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md
+curl -s 'https://spdx.org/licenses/licenses.json' -o "${ARTIFACTS}"/licenses.json
+
+echo '[INFO] Fetching current list of CNCF approved licenses...'
+jq -r '.licenses[] | select(.isDeprecatedLicenseId==false) .licenseId' "${ARTIFACTS}"/licenses.json | sort | uniq > "${ARTIFACTS}"/licenses.txt
+
+# Scanning go-packages under the project & verifying against the CNCF approved list of licenses
+echo '[INFO] Starting license scan on go-packages...'
+go-licenses report ./... >> "${ARTIFACTS}"/licenses.csv 2>"${ARTIFACTS}"/logs/go-licenses.log
+
+echo -e 'PACKAGE_NAME  LICENSE_NAME  LICENSE_URL\n' >> "${ARTIFACTS}"/approved_licenses.dump
+while IFS=, read -r GO_PACKAGE LICENSE_URL LICENSE_NAME; do
+    if ! grep -q "^${LICENSE_NAME}$" "${ARTIFACTS}"/licenses.txt; then
+        echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${ARTIFACTS}"/notapproved_licenses.dump
+        packages_flagged+=("${GO_PACKAGE}")
+        continue
+    fi
+
+    if [[ "${LICENSE_URL}" == 'Unknown' ]]; then
+        if  [[ "${GO_PACKAGE}" != kubesphere.io/* ]]; then
+            echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${ARTIFACTS}"/approved_licenses_with_missing_urls.dump
+            packages_url_missing+=("${GO_PACKAGE}")
+        else
+            LICENSE_URL='https://github.com/kubesphere/kubesphere/blob/master/LICENSE'
+            echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${ARTIFACTS}"/approved_licenses.dump
+        fi
+        continue
+    fi
+
+    if [[ "$(http_code "${LICENSE_URL}")" != 404 ]]; then
+        echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${ARTIFACTS}"/approved_licenses.dump
+        continue
+    fi
+
+    # The URL 404'ed.  Try parent-paths.
+
+    #echo -e "DBG: err 404 ${LICENSE_URL}"
+    dir="$(dirname "${LICENSE_URL}")"
+    file="$(basename "${LICENSE_URL}")"
+
+    while [[ "${dir}" != "." ]]; do
+        dir="$(dirname "${dir}")"
+        #echo "DBG:     try ${dir}/${file}"
+        if [[ "$(http_code "${dir}/${file}")" != 404 ]]; then
+            #echo "DBG:         it worked"
+            echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${dir}/${file}" >> "${ARTIFACTS}"/approved_licenses.dump
+            break
+        fi
+        #echo "DBG:         still 404"
+    done
+    if [[ "${dir}" == "." ]];then
+        #echo "DBG:     failed to find a license"
+        packages_url_missing+=("${GO_PACKAGE}")
+        echo "${GO_PACKAGE}  ${LICENSE_NAME}  ${LICENSE_URL}" >> "${ARTIFACTS}"/approved_licenses_with_missing_urls.dump
+    fi
+done < "${ARTIFACTS}"/licenses.csv
+awk '{ printf "%-100s : %-20s : %s\n", $1, $2, $3 }' "${ARTIFACTS}"/approved_licenses.dump
+
+
+if [[ ${#packages_url_missing[@]} -gt 0 ]]; then
+    echo -e '\n[ERROR] The following go-packages in the project have unknown or unreachable license URL:'
+    awk '{ printf "%-100s :  %-20s : %s\n", $1, $2, $3 }' "${ARTIFACTS}"/approved_licenses_with_missing_urls.dump
+    exit_code=1
 fi
 
-cd "${KUBE_ROOT}"
 
-echo 'running skywalking-eyes check '
-license-eye header check
-exit 0
+if [[ ${#packages_flagged[@]} -gt 0 ]]; then
+    echo -e "\n[ERROR] The following go-packages in the project are using non-CNCF approved licenses. Please refer to the CNCF's approved licence list for further information: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md"
+    awk '{ printf "%-100s :  %-20s : %s\n", $1, $2, $3 }' "${ARTIFACTS}"/notapproved_licenses.dump
+    exit_code=1
+elif [[ "${exit_code}" -eq 1 ]]; then
+    echo -e "\n[ERROR] Project is using go-packages with unknown or unreachable license URLs. Please refer to the CNCF's approved licence list for further information: https://github.com/cncf/foundation/blob/main/allowed-third-party-license-policy.md"
+else
+    echo -e "\n[SUCCESS] Scan complete! All go-packages under the project are using current CNCF approved licenses!"
+fi
+
+exit "${exit_code}"

hack/verify-spelling.sh

@@ -25,18 +25,14 @@ KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
 export KUBE_ROOT
 source "${KUBE_ROOT}/hack/lib/init.sh"
 
-# Ensure that we find the binaries we build before anything else.
-export GOBIN="${KUBE_OUTPUT_BINPATH}"
-PATH="${GOBIN}:${PATH}"
+kube::golang::setup_env
 
-# Install tools we need
 if ! command -v misspell ; then
-  # As GOFLAGS may equal to `-mod=vendor`, we must download the modules to vendor or go install will fail.
-  GO111MODULE=on go install -mod=mod github.com/client9/misspell/cmd/misspell@v0.3.4
+  # Install misspell
+  echo 'installing misspell'
+  go install -mod=mod github.com/golangci/misspell/cmd/misspell@v0.7.0
 fi
 
-cd "${KUBE_ROOT}"
-
 # Spell checking
 # All the skipping files are defined in hack/.spelling_failures
 skipping_file="${KUBE_ROOT}/hack/.spelling_failures"

hack/verify-vendor-licenses.sh

@@ -0,0 +1,30 @@
+#!/usr/bin/env bash
+
+# Copyright 2015 The Kubernetes Authors.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This script checks whether updating of licenses files is needed
+# or not. We should run `hack/update-vendor-licenses.sh` and commit the results,
+# if actually updates them.
+# Usage: `hack/verify-vendor-licenses.sh`.
+
+set -o errexit
+set -o nounset
+set -o pipefail
+
+KUBE_ROOT=$(dirname "${BASH_SOURCE[0]}")/..
+
+source "${KUBE_ROOT}/hack/lib/verify-generated.sh"
+
+kube::verify::generated "Generated files need to be updated" "Please run 'hack/update-vendor-licenses.sh'" hack/update-vendor-licenses.sh "$@"

kube/pkg/apis/core/v1/helper/qos/qos.go

@@ -1,3 +1,19 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 package qos
 
 import (

kube/pkg/openapi/apiservice.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

kube/pkg/openapi/downloader.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

kube/pkg/openapi/error.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

kube/pkg/openapi/merge/merge.go

@@ -1,3 +1,19 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 package merge
 
 import (

kube/pkg/openapi/openapi.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

kube/pkg/openapi/v2/services.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

kube/pkg/openapi/v2/services_test.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

kube/pkg/openapi/v3/services.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

kube/pkg/openapi/v3/services_test.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */

kube/plugin/pkg/admission/resourcequota/apis/resourcequota/types.go

@@ -1,3 +1,19 @@
+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
 package resourcequota
 
 import (

pkg/api/cluster/v1alpha1/types.go

@@ -1,4 +1,5 @@
 /*
+ * Copyright 2024 the KubeSphere Authors.
  * Please refer to the LICENSE file in the root directory of the project.
  * https://github.com/kubesphere/kubesphere/blob/master/LICENSE
  */