pkgxdev/dev does not update GOROOT and GOPATH after resolving Golang via sniffing

[vkumbhar94]

When pkgxdev/dev resolves Golang, it correctly sets the go binary to the version it resolves (e.g., v1.23.7). However, it does not update the GOROOT and GOPATH environment variables accordingly. This results in a mismatch between the active Go version and the environment expected by tooling and scripts.

╭─ z log ingest
-deno.land -deno^2.1
+go.dev +pre-commit +go.dev +skaffold.dev +kubernetes.io/kubectl +kubernetes.io/minikube

╰─ which go
/Users/vaibhav.kumbhar/.pkgx/go.dev/v1.23.7/bin/go

╰─ echo $GOPATH
/Users/vaibhav.kumbhar/.gvm/pkgsets/go1.23/global

╰─ echo $GOROOT
/Users/vaibhav.kumbhar/.gvm/gos/go1.23

due to mismatch in these both, it leads us to following issues using golang.

go build ./cmd/ingest                                                                                               ─╯
# internal/unsafeheader
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/profilerecord
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/goarch
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/goexperiment
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/godebugs
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/byteorder
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/msan
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/race
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/itoa
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/asan
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# cmp
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# unicode
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# encoding
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# math/bits
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/goos
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# unicode/utf8
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/coverage/rtcov
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# unicode/utf16
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/platform
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# container/list
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# sync/atomic
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# log/internal
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# crypto/internal/alias
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# vendor/golang.org/x/crypto/cryptobyte/asn1
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/nettrace
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# github.com/pierrec/lz4/v4/internal/lz4errors
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# vendor/golang.org/x/crypto/internal/alias
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# crypto/subtle
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# github.com/aws/aws-sdk-go-v2/internal/sdkio
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# github.com/segmentio/fasthash/fnv1
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# google.golang.org/protobuf/internal/flags
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/goversion
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# github.com/segmentio/kafka-go/protocol/consumer
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# google.golang.org/grpc/serviceconfig
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# crypto/internal/boring/sig
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# go.opentelemetry.io/otel/sdk/instrumentation
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# golang.org/x/exp/constraints
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# stash.logicmonitor.com/dev/log-ingest.git/internal/server/constants
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# github.com/aws/aws-sdk-go/aws/client/metadata
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# internal/cpu
compile: version "go1.23.0" does not match go tool version "go1.23.7"
# go.opentelemetry.io/contrib
compile: version "go1.23.0" does not match go tool version "go1.23.7"

[mxcl]

This seems complex and I don't know a lot about how go works. Is the user always expected to update GOPATH and GOROOT themselves?

[vkumbhar94]

@mxcl Yes, appropriate GOPATH and GOROOT is expected. Here is little more about go: the go command inside bin folder is just a bootstrapper - however rest of the toolchain required for compiling a go program resides in the GOROOT and other auxiliary dev/compile binaries (like linters, etc) uses $GOPATH/bin.

Yes, it is not straight forward as dev shellcode just modifies the PATH env var. This is something new to adjust other env vars.