MPL-licensed github.com/hashicorp/go-retryablehttp is not allowed in CNCF

[saschagrunert]

Hey folks, we (Kubernetes) use the rekor client directly from go in kubernetes-sigs/release-sdk: https://github.com/kubernetes-sigs/release-sdk/blob/83243fb51416adb402fbbb1e611e2861e8e8d008/sign/sign.go#L726

The issue is that GetRekorClient imports go-retryablehttp, which is MPL licensed and therefore not allowed in the CNCF.

Would it be generally possible to switch to an alternative?

Refers to kubernetes-sigs/release-sdk#197

[haydentherapper]

Do you have any suggestions of alternative implementations of a retryable HTTP client?

This might be a bit too in the weeds, but another alternative would be to change how you verify. I saw that you're doing lookups in the log to find a matching entry only for the purpose of knowing if the file is signed. Can you instead persist a log proof locally, removing the need to make online calls during verification? Can you assume that if a signature is provided, the file is signed, and otherwise require a flag to be specified to skip verification?

[kommendorkapten]

This may be an option https://github.com/avast/retry-go (MIT). But also, implementing a retry for this is not extremely complicated, and bringing down dependencies is always a noble thing IMHO. I may have some cycles next week to take a look at this.

[saschagrunert]

I'm working on a solution in #2350