Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Forcibly replace github.com/satori/go.uuid #18282

Closed
wants to merge 2 commits into from

Conversation

zeripath
Copy link
Contributor

@zeripath zeripath commented Jan 15, 2022

There are several dependencies which still reference github.com/satori/go-uuid despite
the long recognised problem with this library.

This PR proposes replacing satori/go.uuid with my recently created fork which is shim
against google/uuid. This shim is not a perfect replacement for satori as it misses
several functions available on the old type - however, these should only be rarely used
in any case and certainly testing appears to imply that these functions are not used.

Close #18311

Signed-off-by: Andrew Thornton [email protected]

There are several dependencies which still reference github.com/satori/go-uuid despite
the long recognised problem with this library.

This PR proposes replacing satori/go.uuid with my recently created fork which is shim
against google/uuid. This shim is not a perfect replacement for satori as it misses
several functions available on the old type - however, these should only be rarely used
in any case and certainly testing appears to imply that these functions are not used.

Signed-off-by: Andrew Thornton <[email protected]>
@zeripath zeripath added this to the 1.16.0 milestone Jan 15, 2022
@KN4CK3R
Copy link
Member

KN4CK3R commented Jan 15, 2022

satori/go.uuid#115 mentioned https://github.com/gofrs/uuid as replacement. Could we use that instead?

@GiteaBot GiteaBot added the lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. label Jan 15, 2022
@zeripath
Copy link
Contributor Author

Which version of go-frs do you propose to use?

@KN4CK3R
Copy link
Member

KN4CK3R commented Jan 15, 2022

I have not looked into it but as it has the same api surface so it should be a drop in replacement. If maintaining your shim is not a problem we can use yours.

@zeripath
Copy link
Contributor Author

zeripath commented Jan 15, 2022

If you're going to suggest a different library - please do the work to check and figure out which one.

One problem with not using the shim as above is that you won't then be able to forcibly update the version of go-frs using the replace notation. (I think)

@codecov-commenter
Copy link

codecov-commenter commented Jan 15, 2022

Codecov Report

❗ No coverage uploaded for pull request base (main@d7c2a29). Click here to learn what that means.
The diff coverage is n/a.

Impacted file tree graph

@@           Coverage Diff           @@
##             main   #18282   +/-   ##
=======================================
  Coverage        ?   45.74%           
=======================================
  Files           ?      831           
  Lines           ?    92165           
  Branches        ?        0           
=======================================
  Hits            ?    42162           
  Misses          ?    43244           
  Partials        ?     6759           

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d7c2a29...7d81ca0. Read the comment docs.

@GiteaBot GiteaBot added lgtm/need 1 This PR needs approval from one additional maintainer to be merged. and removed lgtm/need 2 This PR needs two approvals by maintainers to be considered for merging. labels Jan 15, 2022
@6543
Copy link
Member

6543 commented Jan 15, 2022

satori/go.uuid#115 mentioned https://github.com/gofrs/uuid as replacement. Could we use that instead?

looked at this lib too, i fafour googl/uuid

@noerw
Copy link
Member

noerw commented Jan 15, 2022

what do you think of hosting such gitea-related/maintained shims & forks on gitea.com?

@zeripath
Copy link
Contributor Author

what do you think of hosting such gitea-related/maintained shims & forks on gitea.com?

Happy to move these to gitea.com if preferred.

I think we could even consider hosting them on the system.

looked at this lib too, i fafour googl/uuid

Unfortunately we can't force the go-frs/uuid code to use the same shim we'd have to create another one.


I honestly don't mind replacing to go-frs/uuid if we're happy that would work. Just need to decide the version value to go with.

@6543 6543 added the topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! label Jan 16, 2022
@GiteaBot GiteaBot added lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. and removed lgtm/need 1 This PR needs approval from one additional maintainer to be merged. labels Jan 16, 2022
@lunny
Copy link
Member

lunny commented Jan 16, 2022

what do you think of hosting such gitea-related/maintained shims & forks on gitea.com?

Happy to move these to gitea.com if preferred.

I think we could even consider hosting them on the system.

looked at this lib too, i fafour googl/uuid

Unfortunately we can't force the go-frs/uuid code to use the same shim we'd have to create another one.

I honestly don't mind replacing to go-frs/uuid if we're happy that would work. Just need to decide the version value to go with.

Ah, please!!!

@zeripath zeripath added the status/blocked This PR cannot be merged yet, i.e. because it depends on another unmerged PR label Jan 16, 2022
@zeripath zeripath closed this Jan 18, 2022
@zeripath zeripath deleted the no-more-satori branch January 18, 2022 11:04
@go-gitea go-gitea locked and limited conversation to collaborators Apr 28, 2022
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Labels
lgtm/done This PR has enough approvals to get merged. There are no important open reservations anymore. status/blocked This PR cannot be merged yet, i.e. because it depends on another unmerged PR topic/security Something leaks user information or is otherwise vulnerable. Should be fixed! type/bug
Projects
None yet
Development

Successfully merging this pull request may close these issues.

7 participants