nogo: plumb SDK version as language version

Rather than hard-coding the language version, plumb the version from the
rules_go GoSDK provider.

The end result is a no-op: we analyze everything with the GoVersion
matching the language version from go.mod. This is slightly different
from go vet / go build. For dependencies, those would use the language
version from their go.mod, which may be older.

Surprisingly, this seems to be how rules_go works for all builds: it
never passes -lang to the compiler, effectively building everything at
the language version of the toolchain.

The printf analyzer has a stricter check on uses of %q gated behind
language version 1.26:
https://cs.opensource.google/go/x/tools/+/master:go/analysis/passes/printf/printf.go;l=892;drc=a54c8a428f1496d97a2c4e795b4300e8985649e1.
Fix the new findings in gVisor and suppress them in dependencies.

PiperOrigin-RevId: 885633196

Author: prattmic

nogo.yaml

@@ -156,6 +156,12 @@ analyzers:
       suppress:
         - "fmt.Fprintln arg list ends with redundant newline"
         - "non-constant format string in call to .*"
+      exclude:
+        # Starting in 1.26, printf reports misuse of %q with more types. Many
+        # of these are unfixed in upstream projects.
+        - codes/codes.go # go.opentelemetry.io/otel
+        - yaml.go # github.com/go-openapi/swag/yamlutils
+        - staticcheck/sa1030/sa1030.go # staticcheck
   shift:
     generated: # Disabled for generated code; these shifts are well-defined.
       exclude: [".*"]

pkg/sentry/socket/netfilter/extensions.go

@@ -203,7 +203,7 @@ func targetRevision(name string, netProto tcpip.NetworkProtocolNumber, rev uint8
 // with the netfilter package.
 func registerTargetMaker(tm targetMaker) {
 	if _, ok := targetMakers[tm.id()]; ok {
-		panic(fmt.Sprintf("multiple targets registered with name %q.", tm.id()))
+		panic(fmt.Sprintf("multiple targets registered with id %+v.", tm.id()))
 	}
 	targetMakers[tm.id()] = tm
 }

pkg/tcpip/stack/nud_test.go

@@ -568,7 +568,7 @@ func TestNUDConfigurationsMaxMulticastProbes(t *testing.T) {
 				t.Fatalf("got stack.NUDConfigurations(%d, %d) = %s", nicID, ipv6.ProtocolNumber, err)
 			}
 			if got := sc.MaxMulticastProbes; got != test.want {
-				t.Errorf("got MaxMulticastProbes = %q, want = %q", got, test.want)
+				t.Errorf("got MaxMulticastProbes = %d, want = %d", got, test.want)
 			}
 		})
 	}
@@ -619,7 +619,7 @@ func TestNUDConfigurationsMaxUnicastProbes(t *testing.T) {
 				t.Fatalf("got stack.NUDConfigurations(%d, %d) = %s", nicID, ipv6.ProtocolNumber, err)
 			}
 			if got := sc.MaxUnicastProbes; got != test.want {
-				t.Errorf("got MaxUnicastProbes = %q, want = %q", got, test.want)
+				t.Errorf("got MaxUnicastProbes = %d, want = %d", got, test.want)
 			}
 		})
 	}

runsc/container/container.go

@@ -1753,7 +1753,7 @@ func setOOMScoreAdj(pid int, scoreAdj int) error {
 			log.Warningf("Process (%d) exited while setting oom_score_adj", pid)
 			return nil
 		}
-		return fmt.Errorf("setting oom_score_adj to %q: %v", scoreAdj, err)
+		return fmt.Errorf("setting oom_score_adj to %d: %v", scoreAdj, err)
 	}
 	return nil
 }

runsc/container/shared_volume_test.go

@@ -76,7 +76,7 @@ func TestSharedVolume(t *testing.T) {
 	if ws, err := c.executeSync(conf, argsTestFile); err != nil {
 		t.Fatalf("unexpected error testing file %q: %v", filename, err)
 	} else if ws.ExitStatus() == 0 {
-		t.Errorf("test %q exited with code %v, wanted not zero", ws.ExitStatus(), err)
+		t.Errorf("test %q exited with code %v, wanted not zero", filename, ws.ExitStatus())
 	}
 
 	// Create the file from outside of the sandbox.

runsc/sandbox/sandbox.go

@@ -1448,7 +1448,7 @@ func (s *Sandbox) destroy() error {
 	if pid != 0 {
 		log.Debugf("Killing sandbox %q", s.ID)
 		if err := unix.Kill(pid, unix.SIGKILL); err != nil && err != unix.ESRCH {
-			return fmt.Errorf("killing sandbox %q PID %q: %w", s.ID, pid, err)
+			return fmt.Errorf("killing sandbox %q PID %d: %w", s.ID, pid, err)
 		}
 		if err := s.waitForStopped(); err != nil {
 			return fmt.Errorf("waiting sandbox %q stop: %w", s.ID, err)

test/cmd/test_app/fds.go

@@ -89,7 +89,7 @@ func (fds *fdSender) Execute(ctx context.Context, f *flag.FlagSet, args ...any)
 	w := s.Writer(true)
 	w.ControlMessage.PackFDs(int(fileToSend.Fd()))
 	if _, err := w.WriteVec([][]byte{{'a'}}); err != nil {
-		log.Fatalf("Error sending FD %q over socket %q: %v", fileToSend.Fd(), fds.socketPath, err)
+		log.Fatalf("Error sending FD %d over socket %q: %v", fileToSend.Fd(), fds.socketPath, err)
 	}
 
 	log.Print("FD SENDER exiting successfully")

tools/bazeldefs/defs.bzl

@@ -106,7 +106,3 @@ def bpf_program(name, src, bpf_object, visibility, hdrs):
         outs = [bpf_object],
         cmd = "clang -O2 -Wall -Werror -target bpf -c $< -o $@ -I/usr/include/$$(uname -m)-linux-gnu",
     )
-
-def get_goversion():
-    """Returns the current go-version used to build gVisor."""
-    return "1.25.5"

tools/bazeldefs/go.bzl

@@ -188,6 +188,7 @@ def go_context(ctx, goos = None, goarch = None):
         goarch = goarch or go_ctx.sdk.goarch,
         goos = goos or go_ctx.sdk.goos,
         gotags = go_ctx.tags,
+        lang_version = "go" + go_ctx.sdk.version,  # go_ctx.sdk.version excludes the go prefix.
         nogo_args = nogo_args,
         runfiles = depset([go_ctx.go] + go_ctx.sdk.srcs.to_list() + go_ctx.sdk.tools.to_list() + go_ctx.stdlib.libs.to_list()),
         stdlib_srcs = go_ctx.sdk.srcs,

tools/defs.bzl

@@ -7,7 +7,7 @@ change for Google-internal and bazel-compatible rules.
 
 load("//tools:arch.bzl", "arch_genrule", "arch_transition_impl")
 load("//tools/bazeldefs:cc.bzl", _cc_binary = "cc_binary", _cc_flags_supplier = "cc_flags_supplier", _cc_grpc_library = "cc_grpc_library", _cc_library = "cc_library", _cc_proto_library = "cc_proto_library", _cc_test = "cc_test", _cc_toolchain = "cc_toolchain", _gbenchmark = "gbenchmark", _gbenchmark_internal = "gbenchmark_internal", _grpcpp = "grpcpp", _gtest = "gtest", _select_gtest = "select_gtest")
-load("//tools/bazeldefs:defs.bzl", _BuildSettingInfo = "BuildSettingInfo", _bool_flag = "bool_flag", _bpf_program = "bpf_program", _build_test = "build_test", _bzl_library = "bzl_library", _coreutil = "coreutil", _default_net_util = "default_net_util", _get_goversion = "get_goversion", _more_shards = "more_shards", _most_shards = "most_shards", _proto_library = "proto_library", _select_arch = "select_arch", _select_system = "select_system", _short_path = "short_path", _version = "version")
+load("//tools/bazeldefs:defs.bzl", _BuildSettingInfo = "BuildSettingInfo", _bool_flag = "bool_flag", _bpf_program = "bpf_program", _build_test = "build_test", _bzl_library = "bzl_library", _coreutil = "coreutil", _default_net_util = "default_net_util", _more_shards = "more_shards", _most_shards = "most_shards", _proto_library = "proto_library", _select_arch = "select_arch", _select_system = "select_system", _short_path = "short_path", _version = "version")
 load("//tools/bazeldefs:go.bzl", _gazelle = "gazelle", _go_binary = "go_binary", _go_cov = "go_cov", _go_grpc_and_proto_libraries = "go_grpc_and_proto_libraries", _go_imports = "go_imports", _go_library = "go_library", _go_path = "go_path", _go_proto_library = "go_proto_library", _go_test = "go_test", _gotsan_flag_values = "gotsan_flag_values", _gotsan_values = "gotsan_values", _select_goarch = "select_goarch", _select_goos = "select_goos")
 load("//tools/bazeldefs:pkg.bzl", _pkg_deb = "pkg_deb", _pkg_tar = "pkg_tar")
 load("//tools/bazeldefs:platforms.bzl", _default_platform = "default_platform", _platform_capabilities = "platform_capabilities", _platforms = "platforms", _save_restore_platforms = "save_restore_platforms")
@@ -25,7 +25,6 @@ BuildSettingInfo = _BuildSettingInfo
 default_net_util = _default_net_util
 select_arch = _select_arch
 select_system = _select_system
-get_goversion = _get_goversion
 short_path = _short_path
 coreutil = _coreutil
 more_shards = _more_shards