From 4322a3826e618666e679b5257d65441ed013ddf1 Mon Sep 17 00:00:00 2001
From: Pablo Baeyens <pbaeyens31+github@gmail.com>
Date: Thu, 6 Jun 2024 14:36:45 +0000
Subject: [PATCH] [chore] Clarify that cmd/otelcontribcol and top-level go.mod
 are not the sources of the contrib distro (#33409)

**Description:** <Describe what has changed.>
<!--Ex. Fixing a bug - Describe the bug and how this fixes the issue.
Ex. Adding a feature - Explain what this achieves.-->

Documents the purpose of `cmd/otelcontribcol` and `cmd/oteltestbedcol`
in new READMEs and in comments on the builder manifests. Adds note to
top-level `go.mod`.

This is a common point of confusion and was recently confusing for users
on the aftermath of CVE-2024-36129

Counterpart to open-telemetry/opentelemetry-collector/pull/10351

---------

Co-authored-by: Armin Ruech <7052238+arminru@users.noreply.github.com>
---
 cmd/otelcontribcol/README.md           | 4 ++++
 cmd/otelcontribcol/builder-config.yaml | 8 ++++++++
 cmd/oteltestbedcol/README.md           | 4 ++++
 cmd/oteltestbedcol/builder-config.yaml | 5 +++++
 go.mod                                 | 8 ++++++++
 5 files changed, 29 insertions(+)
 create mode 100644 cmd/otelcontribcol/README.md
 create mode 100644 cmd/oteltestbedcol/README.md

diff --git a/cmd/otelcontribcol/README.md b/cmd/otelcontribcol/README.md
new file mode 100644
index 000000000000..18e7b3c1ca91
--- /dev/null
+++ b/cmd/otelcontribcol/README.md
@@ -0,0 +1,4 @@
+# `otelcontribcol` test binary
+
+This folder contains the sources for the `otelcontribcol` test binary. This binary is intended for internal **TEST PURPOSES ONLY**. The source files in this folder are **NOT** the ones used to build any official OpenTelemetry Collector releases.
+Check [open-telemetry/opentelemetry-collector-releases](https://github.com/open-telemetry/opentelemetry-collector-releases) for the official releases. Check the [**`otelcol-contrib` folder**](https://github.com/open-telemetry/opentelemetry-collector-releases/tree/main/distributions/otelcol-contrib) on that repository for the official Collector contrib manifest.
diff --git a/cmd/otelcontribcol/builder-config.yaml b/cmd/otelcontribcol/builder-config.yaml
index 6b1756e28f74..f0be75891fb7 100644
--- a/cmd/otelcontribcol/builder-config.yaml
+++ b/cmd/otelcontribcol/builder-config.yaml
@@ -1,3 +1,11 @@
+# NOTE:
+# This builder configuration is NOT used to build any official binary.
+# To see the builder manifests used for official binaries, 
+# check https://github.com/open-telemetry/opentelemetry-collector-releases
+# 
+# For the OpenTelemetry Collector Contrib official distribution sources, check
+# https://github.com/open-telemetry/opentelemetry-collector-releases/tree/main/distributions/otelcol-contrib
+
 dist:
   module: github.com/open-telemetry/opentelemetry-collector-contrib/cmd/otelcontribcol
   name: otelcontribcol
diff --git a/cmd/oteltestbedcol/README.md b/cmd/oteltestbedcol/README.md
new file mode 100644
index 000000000000..e7d30135bceb
--- /dev/null
+++ b/cmd/oteltestbedcol/README.md
@@ -0,0 +1,4 @@
+# `oteltestbedcol` binary
+
+This folder contains the sources for the `oteltestbedcol` test binary. This binary is intended for **TEST PURPOSES ONLY**. The source files in this folder are **NOT** the ones used to build any official OpenTelemetry Collector releases.
+Check [open-telemetry/opentelemetry-collector-releases](https://github.com/open-telemetry/opentelemetry-collector-releases) for the official releases.
diff --git a/cmd/oteltestbedcol/builder-config.yaml b/cmd/oteltestbedcol/builder-config.yaml
index 8927aede7de4..a26a55f53c09 100644
--- a/cmd/oteltestbedcol/builder-config.yaml
+++ b/cmd/oteltestbedcol/builder-config.yaml
@@ -1,3 +1,8 @@
+# NOTE:
+# This builder configuration is NOT used to build any official binary.
+# To see the builder manifests used for official binaries, 
+# check https://github.com/open-telemetry/opentelemetry-collector-releases
+
 dist:
   module: github.com/open-telemetry/opentelemetry-collector-contrib/cmd/oteltestbedcol
   name: oteltestbedcol
diff --git a/go.mod b/go.mod
index fc6acc99fad3..c489ec98eccb 100644
--- a/go.mod
+++ b/go.mod
@@ -1,5 +1,13 @@
 module github.com/open-telemetry/opentelemetry-collector-contrib
 
+// NOTE:
+// This go.mod is NOT used to build any official binary.
+// To see the builder manifests used for official binaries,
+// check https://github.com/open-telemetry/opentelemetry-collector-releases
+//
+// For the OpenTelemetry Collector Contrib distribution specifically, see
+// https://github.com/open-telemetry/opentelemetry-collector-releases/tree/main/distributions/otelcol-contrib
+
 go 1.21.0
 
 require (