cosign icon indicating copy to clipboard operation
cosign copied to clipboard

Remove dependency on github.com/golang/glog

Open jdolitsky opened this issue 3 years ago • 1 comments

Please see https://github.com/sigstore/policy-controller/pull/112 for more context.

TLDR - without this being removed, policy-controller will crash on startup due to conflicts with the klog dependency.

This appears to be brought in via github.com/google/certificate-transparency-go. After looking there, it led to a rabbit hole of other dependencies which also rely on glog.

I've opened up the following PRs which may or may not be all of the locations:

  • https://github.com/google/certificate-transparency-go/pull/962
  • https://github.com/google/trillian/pull/2787
  • https://github.com/google/go-licenses/pull/138
  • https://github.com/grpc/grpc-go/pull/5547

An alternative could be for the sigstore org to maintain a fork of glog, just for replace purposes. The required changeset would be this.

jdolitsky avatar Jul 29 '22 19:07 jdolitsky

For some context, I tried to work around this issue awhile ago by copying in files from certificate-transparency-go (https://github.com/sigstore/cosign/blob/f2c360eb97e52fa7766ecde370f1a48b910d7404/cmd/cosign/cli/fulcio/fulcioverifier/ctutil/ctutil.go) to avoid pulling in glog.

haydentherapper avatar Aug 01 '22 20:08 haydentherapper