cosign
cosign copied to clipboard
Remove dependency on github.com/golang/glog
Please see https://github.com/sigstore/policy-controller/pull/112 for more context.
TLDR - without this being removed, policy-controller will crash on startup due to conflicts with the klog dependency.
This appears to be brought in via github.com/google/certificate-transparency-go. After looking there, it led to a rabbit hole of other dependencies which also rely on glog.
I've opened up the following PRs which may or may not be all of the locations:
- https://github.com/google/certificate-transparency-go/pull/962
- https://github.com/google/trillian/pull/2787
- https://github.com/google/go-licenses/pull/138
- https://github.com/grpc/grpc-go/pull/5547
An alternative could be for the sigstore org to maintain a fork of glog, just for replace purposes. The required changeset would be this.
For some context, I tried to work around this issue awhile ago by copying in files from certificate-transparency-go (https://github.com/sigstore/cosign/blob/f2c360eb97e52fa7766ecde370f1a48b910d7404/cmd/cosign/cli/fulcio/fulcioverifier/ctutil/ctutil.go) to avoid pulling in glog.