error installing staticcheck with the new go 1.24 tool tracker

[aep-sunlife]

When I try to install staticcheck via the new Go 1.24 tool tracking system, then I get errors.

This happens in GitHub Actions. No problem in macOS.

$ go get -tool honnef.co/go/tools/cmd/staticcheck
$ go mod download
$ go mod vendor
$ go mod tidy
$ go install tool
Error: vendor/honnef.co/go/tools/lintcmd/lint.go:26:2: cannot find module providing package golang.org/x/tools/go/packages: import lookup disabled by -mod=vendor

Can we please update this project to use Go 1.24.1? Go has many new security patches lately.

As a workaround, I may have to disable staticcheck.

[arp242]

I guess you have GOFLAGS set with -mod=vendor? That's what the error message import lookup disabled by -mod=vendor suggests anyway.

Also, 2025.1.1 is built with Go 1.24.1: https://github.com/dominikh/go-tools/releases/tag/2025.1.1

[aep-sunlife]

Good thinking. However, in our case, the GOFLAGS option is blank. We're not customizing that.

AR='ar'
CC='gcc'
CGO_CFLAGS='-O2 -g'
CGO_CPPFLAGS=''
CGO_CXXFLAGS='-O2 -g'
CGO_ENABLED='1'
CGO_FFLAGS='-O2 -g'
CGO_LDFLAGS='-O2 -g'
CXX='g++'
GCCGO='gccgo'
GO111MODULE=''
GOAMD64='v1'
GOARCH='amd64'
GOAUTH='netrc'
GOBIN=''
GOCACHE='/home/runner/.cache/go-build'
GOCACHEPROG=''
GODEBUG=''
GOENV='/home/runner/.config/go/env'
GOEXE=''
GOEXPERIMENT=''
GOFIPS140='off'
GOFLAGS=''
GOGCCFLAGS='-fPIC -m64 -pthread -Wl,--no-gc-sections -fmessage-length=0 -ffile-prefix-map=/tmp/go-build1195534314=/tmp/go-build -gno-record-gcc-switches'
GOHOSTARCH='amd64'
GOHOSTOS='linux'
GOINSECURE=''
GOMOD='/home/runner/work/hello-go/hello-go/go.mod'
GOMODCACHE='/home/runner/go/pkg/mod'
GONOPROXY=''
GONOSUMDB=''
GOOS='linux'
GOPATH='/home/runner/go'
GOPRIVATE=''
GOPROXY='https://proxy.golang.org,direct'
GOROOT='/opt/hostedtoolcache/go/1.24.1/x64'
GOSUMDB='sum.golang.org'
GOTELEMETRY='local'
GOTELEMETRYDIR='/home/runner/.config/go/telemetry'
GOTMPDIR=''
GOTOOLCHAIN='auto'
GOTOOLDIR='/opt/hostedtoolcache/go/1.24.1/x64/pkg/tool/linux_amd64'
GOVCS=''
GOVERSION='go1.24.1'
GOWORK=''
PKG_CONFIG='pkg-config'

Perhaps that is the default behavior when GOFLAGS is blank and a vendor/ directory exists?

By the way, using the v5 https://github.com/actions/setup-go workflow with Go 1.24.1.

[dominikh]

This seems more like something to be reported at https://github.com/golang/go than us. It looks like vendoring and tool dependencies aren't interacting correctly, or at least as expected?

At any rate, I don't see anything for us to do here at the moment.

(arp242 is right that our latest binary releases are built with 1.24.1, and I don't believe there's anything we could do to the source to help with this problem.)

[aep-sunlife]

I don't see anything for us to do here at the moment.

Try updating Go to 1.24.1 then updating the /x/ dependencies. Many linters occasionally experience backwards incompatible glitches with newer Go & x versions, despite the Go backwards compatibility guarantee.

[dominikh]

If you are using Go 1.24.1 to build Staticcheck, then that's what's being used. We don't have to update the go statement in go.mod for that. And we won't, as we also support Go 1.23. Our /x/ dependencies are up to date. Staticcheck works just fine with Go 1.24 and on Go 1.24 source code. The error you're seeing isn't because of us. It's because you're using vendoring and it seems that tool dependencies aren't getting vendored, which naturally leads to the dependencies not being found when trying to build the tool. Which is why I've suggested that this problem should be raised with Go. It looks like a bad interaction of vendoring and tool dependencies to me.

[dominikh]

Although it is also worth pointing out that I cannot reproduce the problem.

> go version
go version go1.24.1 linux/amd64
> mkdir testing
> cd testing
> go mod init example.com
go: creating new go.mod: module example.com
> go get -tool honnef.co/go/tools/cmd/staticcheck
go: added github.com/BurntSushi/toml v1.4.1-0.20240526193622-a339e1f7089c
go: added golang.org/x/exp/typeparams v0.0.0-20231108232855-2478ac86f678
go: added golang.org/x/mod v0.23.0
go: added golang.org/x/sync v0.11.0
go: added golang.org/x/tools v0.30.0
go: added honnef.co/go/tools v0.6.1
> go mod download
> go mod vendor
> go mod tidy
> go install tool
> go tool staticcheck -help
Usage: staticcheck [flags] [packages]
[...]

[aep-sunlife]

It looks like a bad interaction of vendoring and tool dependencies to me.

Go 1.24's tool vendoring has been buggy since release qq