To get closer to prod sec and legal requirements, we should move from get-sources.sh -> asset*.gz file for the golang lang server dependencies, and instead use cachito w/ container.yaml configuration to fetch sources, then build the sources inside a Docker context, letting cachito find the golang dependencies needed to build the lang server in golangci/golangci-lint.

• https://github.com/redhat-developer/devspaces-images/blob/devspaces-3-rhel-8/devspaces-udi/get-sources.sh
• https://github.com/redhat-developer/devspaces-images/blob/devspaces-3-rhel-8/devspaces-udi/sources
• https://github.com/redhat-developer/devspaces-images/blob/devspaces-3-rhel-8/devspaces-udi/container.yaml
• https://github.com/redhat-developer/devspaces-images/blob/devspaces-3-rhel-8/devspaces-udi/build/build_golang.sh#L62-L90

Once the remote_source map described above is set in container.yaml, you can now copy the upstream sources (with bundled dependencies) provided by cachito in your build image by adding:

COPY $REMOTE_SOURCE $REMOTE_SOURCE_DIR
to your Dockerfile. From this point on, you will find the root of the upstream project at $REMOTE_SOURCE_DIR/app, and the project dependencies at $REMOTE_SOURCE_DIR/deps.

then

WORKDIR $REMOTE_SOURCE_DIR/app
RUN source $CACHITO_ENV_FILE && go build .

Note that delv is not supported on IBM Z and Power, so you might need an arch-aware block in the dockerfile like this:

    if [[ "$(uname -m)" == 'x86_64' ]]; then \