Remove golang.org/x/crypto package Dependency #239
Conversation
|
Skipping CI for Draft Pull Request. |
|
The changes in the PR are insufficient. |
Package github.com/Masterminds/sprig imports a golang.org/x/crypto package that we wish to avoid. We remove all the unviersal functions from sprig as two of them, bcrypt and htpasswd use insecure algorithms from golang.org/x/crypto
Add missing and remove unused modules, make vendored copy of dependencies, and verify dependencies have expected content by go mod verify
As of Go 1.16, this function simply calls os.ReadFile, thus we can remove it and simply call os.ReadFile
razo7
force-pushed
the
avoid-using-sprig
branch
from
a573b7e to
288a8df
Compare
The universal functions are redundant, so they are no longer needed. |
|
/test 4.16-openshift-e2e |
|
/test 4.16-openshift-e2e |
pkg/render/render_test.go
Outdated
| @@ -89,7 +89,8 @@ func TestDir(t *testing.T) { | |||
| g := NewGomegaWithT(t) | |||
|
|
|||
| d := MakeRenderData() | |||
| d.Funcs["fname"] = func(s string) string { return s } | |||
| d.Funcs["fname"] = func(s string) string { return "test-" + s } | |||
There was a problem hiding this comment.
this looks like a significant change to me, can you explain please?
There was a problem hiding this comment.
Not sure why it was changed. I reverted it
No changes are needed in the rendet_test.go file for applying the removal of github.com/Masterminds/sprig package
razo7
force-pushed
the
avoid-using-sprig
branch
from
e80d32c to
aff549f
Compare
|
/test 4.16-openshift-e2e |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: razo7, slintes The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
/cherry-pick release-0.9 |
|
@razo7: new pull request created: #241 In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository. |
Why we need this PR
Remove the
golang.org/x/cryptopackage dependency whengithub.com/Masterminds/sprigis used. It is coming from running thego mod whycommand.Changes made
golang.org/x/cryptopackage dependency. No longer add Sprig (200+) universal functions when rendering the template. Add dummy function as it is needed for 1 unit test.go mod ...commands.io/ioutiland usingos.ReadFileWhich issue(s) this PR fixes
Test plan