Revoke dependency leads to broken import of google.golang.org/grpc/naming

[hdm]

A long chain of dependencies is introduced via revoke's CT support. This currently leads to a broken module dependency for GRPC:

        github.com/duo-labs/webauthn/protocol imports
        github.com/duo-labs/webauthn/metadata imports
        github.com/cloudflare/cfssl/revoke imports
        github.com/cloudflare/cfssl/helpers imports
        github.com/google/certificate-transparency-go imports
        go.etcd.io/etcd imports
        github.com/coreos/etcd/etcdmain imports
        github.com/coreos/etcd/proxy/grpcproxy imports
        google.golang.org/grpc/naming: module google.golang.org/grpc@latest found (v1.30.0), but does not contain package google.golang.org/grpc/naming

Edit: It looks like revoke's validation is needed here. Any suggestions for fixing this dependency issue?

[hdm]

It looks like the workaround (until upstream is fixed) is:

go get google.golang.org/[email protected] (or use a go.mod redirect)

[jordan-wright]

Thanks @hdm! Tagging in @nicksteele to collaborate on the best way to fix this issue.

[vvakame]

This issue is still unresolved. It would be nice to be able to remove the dependency of the problem ...

[iftimasum]

@iftimasum

[aeneasr]

Is there maybe an equal lib like cloudflare's that doesn't introduce such a large dependency tree? Or maybe we could fork the revoke module? The problem is that Go 1.18 is much more strict about dependencies and the original workaround does not seem to work any more. It's also problematic when the project consumes grpc and needs a specific (higher version).

[james-d-elliott]

I think the forking idea may be the best one, though it's not entirely easy. That lib is horrible. The only usage of the model is in metadata to check the validity of devices via their certs as you have probably identified.

[Isolus]

I have run into a similar problem. I created a fork of CFSSL that has just enough functionality for this project. I have changed only import paths in the code and deleted unnecessary things, so that practically no dependency comes with it. If anyone is interested: https://github.com/Isolus/cfssl-revoke

[hdm]

@Isolus Nice work! Would you be able to open a PR to switch the dependency?

[tobiaszheller]

PR with forked cfssl is https://github.com/duo-labs/webauthn/pull/150. It would be nice to merge or maybe duo-labs should provide similar fork in their own repo?