open-policy-agent dependency downloads lots of dependencies unrelated to the rego parser and evaluator

[tomsfernandez]

Hi! In my golang project we are currently depending on the open-policy-agent library only to parse and evaluate rego code.

The thing is, this dependency brings a lot of transitive dependencies that have nothing to do with our use case but for some reason can't be pruned by "go mod tidy" so they must be used somewhere.

Is there a way to only depend the code related to rego parsing and evaluation ??

[ashutosh-narkar]

@tomsfernandez it would be great if you could provide more details here. Also is this not an issue anymore?

[tomsfernandez]

Hi @ashutosh-narkar year sorry about that I meant to delete if but found out I couldn't.

The issues we have is that we dont use the open-policy-agent server capabilities, we only use rego code evaluation.

Having a module dependency on the server capabilities brings a whole lot of dependencies we dont need and algo brings in a lot of vulnerabilities.

The main problematic transitive dependency that we dont need and brings a lot of vulnerabilities is containerd. There must be a module A from which the ast and rego modules depend on that in turn depends on containerd module.

[tomsfernandez]

I closed it because I'll see if I can solve it with the "replace" go module construct but it would be great if rego related libraries didn't depend on server capability dependencies

[ashutosh-narkar]

Thanks for the info. What's your OPA version?

[tomsfernandez]

We are running 0.48

[ashutosh-narkar]

Ok. I created a project with these 2 examples https://pkg.go.dev/github.com/open-policy-agent/opa/rego#example-Rego.Eval-Tracer and https://pkg.go.dev/github.com/open-policy-agent/opa/rego#example-Rego.Eval-Compiler which import the ast, rego and topdown packages. The vendor directory did not contain the containerd package. Also running go list -f '{{ join .Deps "\n" }}' github.com/open-policy-agent/opa/topdown | grep containerd did not yield any results. Same for ast and rego.

Would you be able to help repro. Also I using v0.50.2.