cosign v1.8.0 installation failure: module ... contains one or more exclude directives...

[nealmcb]

Description

When I follow the installation instructions at https://docs.sigstore.dev/cosign/installation I get an error:

$ go install github.com/sigstore/cosign/cmd/cosign@latest
go: downloading github.com/sigstore/cosign v1.8.0
go: github.com/sigstore/cosign/cmd/cosign@latest (in github.com/sigstore/cosign@v1.8.0):
        The go.mod file for the module providing named packages contains one or
        more exclude directives. It must not contain directives that would cause
        it to be interpreted differently than if it were the main module.

$ go version
go version go1.18.1 linux/amd64

This seems related to #588, but the error is about "exclude" directives, not "replace" directives.

I'm doing this on Ubuntu 20.04, with Go1.18.1

[dlorenc]

We should probably drop the go install instructions, they're too easy to break with replace and exclude directives :(

[dlorenc]

Cc @cpanato

[nealmcb]

Related question: what installation method do you recommend for keeping the package automatically up-to-date with security fixes etc. on Ubuntu? I'm unfamiliar with linuxbrew. I don't see a snap or flatpack or ppa available - are any of those options planned?

Many thanks.

[nealmcb]

One more point: the section on installing via deb/rpm/binary has an extra quote in the final line for deb installation.
It could also be more explicit about needing to look up the latest version of the package....
And if that is done it would help to split it out into separate code sections so that clicking on the little copy icon for the appropriate method actually made sense.

[nealmcb]

I got the same "exclude directives" issue on sget with this command from the main README:
go install github.com/sigstore/cosign/cmd/sget@latest

I look forward to the day when you offer sget options for installing the rest of cosign.... Ahh, those chickens and eggs....

[nealmcb]

Ahh - now I see #1364 - might make sense to at least note the unclear status of sget in the README now.

[haydentherapper]

Out of date, instructions should be working now.