Does not build currently because of go.mod entries

[aminvakil]

Description

Currently building with -mod=readonly so that go.mod entries does not get changed, fails with this error:
go: updates to go.mod needed, disabled by -mod=readonly; to update it:

Link

https://github.com/aminvakil/aur/actions/runs/6387591584/job/17352378751#step:11:444

Suggestions

I used go mod tidy and many lines got changed, but as I used go 1.21 I'm not sure if those entries work with go 1.20 as well or not, otherwise I would just whip up a PR with changes.

[knqyf263]

It looks like the forward compatibility introduced in Go 1.21 is relevant.

A module’s go line must declare a version greater than or equal to the go version declared by each of the modules listed in require statements.

https://go.dev/doc/toolchain

We've merged this PR, and rekor declares go 1.21 in their go.mod, but Dependabot didn't update go 1.20 to go 1.21 in Trivy's go.mod. I guess Dependabot used Go 1.20 to apply the change.
#5304

Then, we cannot compile the main branch with Go 1.21 because the go line must be go 1.21.

We need to stay in Go 1.20 for some reason. It can be fixed with go get go@1.20.

$ go get go@1.20 
go: downgraded github.com/sigstore/rekor v1.3.0 => v1.2.2

[knqyf263]

Created #5338

[aminvakil]

The https://aur.archlinux.org/packages/trivy-git package cannot use go 1.20, as Arch Linux does not offer go 1.20, I will disable nightly build now, and enable it later when it can get built against 1.21 .

[knqyf263]

After #5339 gets merged, you will be able to build it with Go 1.21.