back out code changes on main between 7.1.11 and HEAD

[hwine]

Several code changes landed on main for testing purposes on staging, but were never promoted to prod. Thus the latest production tag (7.1.11) is "behind" HEAD, leading to complexity in deploys. To further complicate matters, there are "code quality" commits intermingled that we do want to keep.

This issue will document all changes, and dispositions of 'pending' changes.

References:

• Bugzilla 1838680 for original work
• Bug 1838680 - Do not force --min-sdk-version anymore because of outda… #852 Original commit
• Back out unverified code from production branch #871 backout of code
• Changes for bug 1838680 #872 preservation of backed out code

[hwine]

Based on the details below, it will be safe to take all the changes, except for those to the golang files:

• handlers_racing-test.go
• signer/apk2/apk2.go

This will leave in place developer & CI improvements, but no functional code changes.

All changes from `7.1.11` to `main`

❯ git diff --stat 7.1.11..main
 .circleci/config.yml    | 41 ++++++++++++++++++++++++-----------------
 .gitignore              |  1 +
 Makefile                | 20 ++++++++++++++------
 README.md               | 33 +++++++++++++++++++++++++++++++++
 handlers_racing_test.go | 24 +++++++++++++++++++++++-
 signer/apk2/apk2.go     | 30 ++++++++++++++++++++++++++++--
 6 files changed, 123 insertions(+), 26 deletions(-)

Per commit file changes `7.1.11` to `main`

commit 3d9d9175acd300814c9dd92138e225cc97c62359
Author: Hal Wine <132412+hwine@users.noreply.github.com>
Date:   Wed Dec 13 12:20:25 2023 -0800

    BUSTAGE - address CI breakage (#869)
    
    With no code changes, lint tests started failing in CI, due to an
    updated transitive dependency in non-production tooling.
    
    Change the tool installation process to _not_ update transitive
    dependencies by removing the `-u` option to `go get`

 Makefile | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

commit 7bc7ab2ce78848cd6a69dc4753990a6d89e02eac
Author: Johan Lorenzo <jlorenzo@mozilla.com>
Date:   Wed Jul 12 01:22:23 2023 +0200

    Bug 1838680 - Do not force --min-sdk-version anymore because of outda… (#852)
    
    * Bug 1838680 - part 1: Add a second test APK in TestSignaturePass() to include minSdkVersion
    
    * Bug 1838680 - part 2: Only use `--min-sdk-version` if APK doesn't provide it

 .gitignore              |  1 +
 Makefile                | 10 +++++++++-
 handlers_racing_test.go | 24 +++++++++++++++++++++++-
 signer/apk2/apk2.go     | 30 ++++++++++++++++++++++++++++--
 4 files changed, 61 insertions(+), 4 deletions(-)

commit 8ddfa3896a2297ce2bbc3e6408853c6dcdb7973e
Author: Hal Wine <132412+hwine@users.noreply.github.com>
Date:   Wed Jul 5 12:42:38 2023 -0700

    try to get clean CI run (#856)
    
    Temp workaround so we can simplify the "does a PR pass" story.
    
    The changes do not "fix" anything, rather they treat the current failures a XFAIL at the most granular level available in the CircleCI config file. When the underlying tests are truly fixed, the CI run will fail.

 .circleci/config.yml | 41 ++++++++++++++++++++++++-----------------
 1 file changed, 24 insertions(+), 17 deletions(-)

commit 1a97099f8072a6ae71bfe1d7736d145ff9af84c4
Author: Hal Wine <132412+hwine@users.noreply.github.com>
Date:   Thu Jun 29 16:37:39 2023 -0700

    Doc update (#855)
    
    Unit tests only take a couple of minutes, but it's easy to miss the end
    and think it's running _forever_. :/  Add some bash to terminate the run
    when the unit tests are over.

 README.md | 8 ++++++++
 1 file changed, 8 insertions(+)

commit 9058259781e394b27608ae8cefd489da1f1acad9
Author: Hal Wine <132412+hwine@users.noreply.github.com>
Date:   Wed Jun 28 07:28:01 2023 -0700

    update local dev instructions (#854)

 README.md | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

Non golang changes in `7.1.11` to `main` (manually created)

diff --git a/.circleci/config.yml b/.circleci/config.yml
index 249e24bd..34d9e68d 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -6,7 +6,7 @@
 #
 version: 2.1
 jobs:
-  lint-vet-fmt:
+  XFAIL-lint-vet-fmt:
     docker:
       - image: golang:1.16-buster
     steps:
@@ -34,20 +34,27 @@ jobs:
             apt-get update
             apt-get install -y libltdl-dev
       - run:
-          name: run go vet
+          name: XFAIL! run go vet
           command: |
-            make vet
-            make -C tools/autograph-monitor vet
-            make -C verifier/contentsignature vet
-      - run:
-          name: run staticcheck
+            # Failing as of 2023-06-30
+            make vet && false || true
+            # Failing as of 2023-06-30
+            make -C tools/autograph-monitor vet && false || true
+            # Passing as of 2023-06-30
+            make -C verifier/contentsignature vet 
+      - run:
+          name: XFAIL! run staticcheck
           command: |
-            make install-staticcheck staticcheck
+            # Failing as of 2023-06-30
+            make install-staticcheck staticcheck && false || true
+            # Passing as of 2023-06-30
             make show-lints
-            make -C tools/autograph-monitor staticcheck
-            make -C verifier/contentsignature staticcheck
+            # Failing as of 2023-06-30
+            make -C tools/autograph-monitor staticcheck && false || true
+            # Failing as of 2023-06-30
+            make -C verifier/contentsignature staticcheck && false || true
 
-  unit-test:
+  XFAIL-unit-test:
     # based on the official golang image with more docker stuff
     docker:
       - image: circleci/golang:1.16-buster
@@ -73,9 +80,9 @@ jobs:
           command: |
             docker-compose build --no-cache unit-test
       - run:
-          name: run unit-test docker image and report coverage
+          name: XFAIL run XFAIL-unit-test docker image and report coverage
           command: |
-            docker-compose run unit-test
+            docker-compose run unit-test && false || true
 
   build-integrationtest-verify:
     # based on the official golang image with more docker stuff
@@ -150,12 +157,12 @@ workflows:
   version: 2
   check-code-quality:
     jobs:
-      - lint-vet-fmt:
+      - XFAIL-lint-vet-fmt:
           filters:
             tags:
               only: /.*/
 
-      - unit-test:
+      - XFAIL-unit-test:
           filters:
             tags:
               only: /.*/
@@ -184,6 +191,6 @@ workflows:
             branches:
               only: main
     jobs:
-      - lint-vet-fmt
-      - unit-test
+      - XFAIL-lint-vet-fmt
+      - XFAIL-unit-test
       - build-integrationtest-verify
diff --git a/.gitignore b/.gitignore
index 83185bb8..4454b2ec 100644
--- a/.gitignore
+++ b/.gitignore
@@ -24,6 +24,7 @@ _testmain.go
 *.prof
 
 *.out
+*.log
 .DS_Store
 
 docs/*.html
diff --git a/Makefile b/Makefile
index c0db65bc..d79636f1 100644
--- a/Makefile
+++ b/Makefile
@@ -12,19 +12,19 @@ install-wait-for-it:
 	chmod +x bin/wait-for-it.sh
 
 install-golint:
-	go get -u golang.org/x/lint/golint
+	go get golang.org/x/lint/golint
 
 install-cover:
-	go get -u golang.org/x/tools/cmd/cover
+	go get golang.org/x/tools/cmd/cover
 
 install-goveralls:
-	go get -u github.com/mattn/goveralls
+	go get github.com/mattn/goveralls
 
 install-staticcheck:
-	go get -u honnef.co/go/tools/cmd/staticcheck
+	go get honnef.co/go/tools/cmd/staticcheck
 
 install-go-mod-upgrade:
-	go get -u github.com/oligot/go-mod-upgrade
+	go get github.com/oligot/go-mod-upgrade
 
 install-dev-deps: install-golint install-staticcheck install-cover install-goveralls install-go-mod-upgrade
 
@@ -77,6 +77,14 @@ staticcheck:
 test:
 	go test -v -coverprofile coverage.out -covermode=count -count=1 $(PACKAGE_NAMES)
 
+test-in-docker:
+	$(SHELL) -c " \
+		docker compose up 2>&1 | tee test-in-docker.log \
+		| (grep --silent 'autograph-unit-test exited with code' && docker compose down; \
+		grep 'autograph-unit-test' test-in-docker.log >unit-test.log ; \
+		tail -2 unit-test.log)"
+
+
 showcoverage: test
 	go tool cover -html=coverage.out
 
@@ -105,4 +113,4 @@ dummy-statsd:
 	nc -kluvw 0 localhost 8125
 
 .SUFFIXES:            # Delete the default suffixes
-.PHONY: all dummy-statsd test generate vendor integration-test check-no-crypto11-in-signers
+.PHONY: all dummy-statsd test generate vendor integration-test check-no-crypto11-in-signers test-in-docker
diff --git a/README.md b/README.md
index 2da53816..aa6dea41 100644
--- a/README.md
+++ b/README.md
@@ -15,14 +15,47 @@ Why is it called "autograph"? Because it's a service to sign stuff.
 
 ## Installation
 
+Use Docker whenever possible. The golang version on your machine is likely _not_ the corect version for autograph.
+
 ### Using Docker
 
 `docker pull mozilla/autograph && docker run mozilla/autograph`
 
 This will download the latest build of autograph from DockerHub and run it with its dev configuration.
 
+#### Local Development with Docker
+
+|    |    |
+|----|----|
+| **WARNING!** | These tests may break or delete your gpg setup. |
+|    |    |
+
+If your are lucky, it will leave you alone. (It starts a number of `gpg-agent`
+processes, then does a `killall gpg-agent` to clean up.) However, I've lost my
+entire `~/.gnupg` setup. I _strongly_ recommend: `tar czf ~/gnupg.tgz ~/.gnupg`
+before starting.
+
+After making any changes, please test locally by:
+```bash
+make build             # updates local docker images
+make integration-test  # must pass
+docker compose up      # runs unit tests in container, must pass
+```
+_Note: you must monitor the output of docker to detect when the unit tests have
+completed. Otherwise, it will run forever with heartbeat messages. The following
+pipeline is useful:_
+```bash
+docker compose up 2>&1 | tee compose.log \
+    | (grep --silent "autograph-unit-test exited with code" && docker compose down; \
+       grep "autograph-unit-test" compose.log)
+```
+
+As of 2023-06-26, only the integration tests will pass on Circle CI. See [Issue 853](https://github.com/mozilla-services/autograph/issues/853) for details.
+
 ### Using go get
 
+_**Do Not Use** unless you are an experienced golang developer._
+
 If you don't yet have a GOPATH, export one:
 ```bash
 $ export GOPATH=$HOME/go

[hwine]

all done