Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Dependency on go-cose version that does not exist. #2162

Open
andrew-lawson-tumelo opened this issue Jun 10, 2024 · 4 comments
Open

Dependency on go-cose version that does not exist. #2162

andrew-lawson-tumelo opened this issue Jun 10, 2024 · 4 comments

Comments

@andrew-lawson-tumelo
Copy link

andrew-lawson-tumelo commented Jun 10, 2024

The indirect dependency on "github.com/veraison/[email protected]" [https://github.com/microsoft/hcsshim/blob/8beabacfc2d21767a07c20f8dd5f9f3932dbf305/go.mod#L99] cannot be resolved.
This is due to v1.2.0 being retracted by the developer:
[https://github.com/veraison/go-cose/pull/153]

This dependency should be updated to reference the current release "github.com/veraison/[email protected]"

@lktoken
Copy link

lktoken commented Jul 17, 2024

Can someone explain this?

1 similar comment
@lingdie
Copy link

lingdie commented Jul 31, 2024

Can someone explain this?

@andrew-lawson-tumelo
Copy link
Author

andrew-lawson-tumelo commented Sep 2, 2024

To explain;
I think go-cose retracted a published version since the last version of hcsshim was published.

It plays havoc with our internal build process, in that we are unable to allow "go mod" and "tidy" to run without explicitly pinning specific dependencies, which is never best practice, especially if there are other third-party libraries in the mix.

When building and fetching dependencies everything blows up with an unresolved dependency on go-cose v1.2.0 because the go.mod for hcsshim specifies go-cose v1.2.0 as a dependency. The dependency resolution step of the go build process attempts to go and download this specific go-cose version and fails because it doesn't exist.

Ideally, the fix here would be for the maintainers of hcsshim to update the go.mod to reference an active "published" version of go-cose (followed by a run of "go mod tidy" to ensure that the go.sum file is present and correct).

Hopefully, that makes a bit more sense. Sorry for my original cryptic message.

@stlaz
Copy link

stlaz commented Sep 25, 2024

Please note that this now also breaks Kubernetes vendoring in stricter environments (i.e. with GOPROXY=direct).

It'd be great if you could make a stable release with the vendor fixed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

4 participants