[Bug] latest upstream version is wrongly detected

[christian-heusel]

Is this a support request?

• This is not a support request

Is there an existing issue for this?

• I have searched the existing issues

Current Behavior

2024-05-02T11:56:17Z WRN An updated version of Headscale has been found (0.23.0-alpha9 vs. your current v0.23.0-alpha11). Check it out https://github.com/juanfont/headscale/releases

Expected Behavior

No log message when on the latest version

Steps To Reproduce

1. start up any headscale version later than 9
2. observe the above warning

Environment

- OS: Debian trixie/sid with Headscale running in Docker
- Headscale version: v0.23.0-alpha11
- Tailscale version: -

Runtime environment

• Headscale is behind a (reverse) proxy
• Headscale runs in a container

Anything else?

With the relevant code inside of this project that is causing this behaviour being:

headscale/cmd/headscale/cli/root.go

Lines 72 to 88 in a9c568c

	if (runtime.GOOS == "linux" || runtime.GOOS == "darwin") &&
	Version != "dev" {
	githubTag := &latest.GithubTag{
	Owner: "juanfont",
	Repository: "headscale",
	}
	res, err := latest.Check(githubTag, Version)
	if err == nil && res.Outdated {
	//nolint
	log.Warn().Msgf(
	"An updated version of Headscale has been found (%s vs. your current %s). Check it out https://github.com/juanfont/headscale/releases\n",
	res.Current,
	Version,
	)
	}
	}
	}

I have dug into the issue/code a little and found that the error seems to propagate from github.com/hashicorp/go-version or alteast the version that the tcnksm/go-latest dependency is using. I have come to this conclusion with this little test program:

package main

import (
	"fmt"

	"github.com/hashicorp/go-version"
	"github.com/rs/zerolog/log"
	"github.com/tcnksm/go-latest"
)

func main() {
	Version := "v0.23.0-alpha10"
	githubTag := &latest.GithubTag{
		Owner:      "juanfont",
		Repository: "headscale",
	}

	fetch, err := githubTag.Fetch()
	fmt.Println("Valid")
	for _, v := range fetch.Versions {
		fmt.Printf("%s\n", v)
	}

	fmt.Println("Malformed")
	for _, v := range fetch.Malformeds {
		fmt.Printf("%s\n", v)
	}

	fmt.Println("Versioncmp")
	ourV, err := version.NewVersion(Version)
	theirV, err := version.NewVersion("0.23.0-alpha9")

	fmt.Printf("versioncompare %s < %s == %t\n", ourV, theirV, ourV.LessThan(theirV))

	// Original code
	res, err := latest.Check(githubTag, Version)
	if err == nil && res.Outdated {
		log.Warn().Msgf(
			"An updated version of Headscale has been found (%s vs. your current %s). Check it out https://github.com/juanfont/headscale/releases\n",
			res.Current,
			Version,
		)
	}
}

Gives the following:

$ go run test.go
Valid
0.23.0-alpha-docker-release-test
0.23.0-alpha11
0.23.0-alpha10
0.23.0-alpha9
0.23.0-alpha8
0.23.0-alpha7
0.23.0-alpha6
0.23.0-alpha5
0.23.0-alpha4
0.23.0-alpha4-docker-ko-test9
0.23.0-alpha4-docker-ko-test8
0.23.0-alpha4-docker-ko-test7
0.23.0-alpha4-docker-ko-test6
0.23.0-alpha4-docker-ko-test5
0.23.0-alpha4-docker-ko-test4
0.23.0-alpha4-docker-ko-test3
0.23.0-alpha4-docker-ko-test2
0.23.0-alpha4-docker-ko-test
0.23.0-alpha3
0.23.0-alpha2
0.23.0-alpha1
0.22.3
0.22.2
0.22.1
0.22.0
0.22.0-nfpmtest
0.22.0-alpha3
0.22.0-alpha2
0.22.0-alpha1
0.21.0
Malformed
Versioncmp
versioncompare 0.23.0-alpha10 < 0.23.0-alpha9 == true
{"level":"warn","time":"2024-05-02T14:30:27+02:00","message":"An updated version of Headscale has been found (0.23.0-alpha9 vs. your current v0.23.0-alpha10). Check it out https://github.com/juanfont/headscale/releases\n"}

This shows a few things:

1. The versions greater than 9 are detected by latest
2. They are parsed valid and not sorted out because they are malformed
3. For some reason 0.23.0-alpha10 < 0.23.0-alpha9 is true

[runejuhl]

Looks like it's a known issue, here are some issues in the https://github.com/hashicorp/go-version/ tracker that look like they're related. Unfortunately one of them is almost 5 years old.

• [question] which is bigger according the constraint? hashicorp/go-version#92
• [question] Why constraint without a pre-release can only match a version without a pre-release? hashicorp/go-version#59