-
Notifications
You must be signed in to change notification settings - Fork 29
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
For CG: update eng/_util; omit unused modules
- Loading branch information
Showing
3 changed files
with
94 additions
and
23 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
64 changes: 64 additions & 0 deletions
64
patches/0014-Omit-internal-go.mod-files-used-for-codegen.patch
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| From 0000000000000000000000000000000000000000 Mon Sep 17 00:00:00 2001 | ||
| From: Davis Goodin <[email protected]> | ||
| Date: Fri, 24 May 2024 15:38:31 -0700 | ||
| Subject: [PATCH] Omit internal go.mod files used for codegen | ||
|
|
||
| Rename the go.mod and go.sum files to no.mod and | ||
| no.sum. This makes Component Governance not scan | ||
| these go.mod files, preventing many false | ||
| positives for vulnerabilities in the dependencies | ||
| they contain. | ||
|
|
||
| Renaming the files before the build/tests can be | ||
| considered proof that they aren't used, which is | ||
| justification for ignoring them. | ||
|
|
||
| Rename rather than remove so that if a user needs | ||
| to modify our fork of Go in-situ and re-run these | ||
| parts of code generation, they can rename the | ||
| "no.*" files back to "go.*" because the content | ||
| isn't missing. | ||
|
|
||
| Alternatives: | ||
|
|
||
| There is no reason these files would be used when | ||
| using the Go toolset in a normal way, so directly | ||
| configuring Component Governance to ignore them | ||
| would be a reasonable alternative. However, as of | ||
| writing, there is no known way to do this. | ||
|
|
||
| Another alternative is to upgrade the dependencies | ||
| in these go.mod files to a newer version that | ||
| doesn't have vulnerabilities. However, deviating | ||
| from upstream Go may cause the output to be | ||
| different, so it could be misleading to our users. | ||
| Submitting upgrades directly upstream would avoid | ||
| this issue, but it would be hard to justify these | ||
| unnecessary upgrades. | ||
| --- | ||
| src/crypto/internal/bigmod/_asm/{go.mod => no.mod} | 0 | ||
| src/crypto/internal/bigmod/_asm/{go.sum => no.sum} | 0 | ||
| src/crypto/internal/edwards25519/field/_asm/{go.mod => no.mod} | 0 | ||
| src/crypto/internal/edwards25519/field/_asm/{go.sum => no.sum} | 0 | ||
| 4 files changed, 0 insertions(+), 0 deletions(-) | ||
| rename src/crypto/internal/bigmod/_asm/{go.mod => no.mod} (100%) | ||
| rename src/crypto/internal/bigmod/_asm/{go.sum => no.sum} (100%) | ||
| rename src/crypto/internal/edwards25519/field/_asm/{go.mod => no.mod} (100%) | ||
| rename src/crypto/internal/edwards25519/field/_asm/{go.sum => no.sum} (100%) | ||
|
|
||
| diff --git a/src/crypto/internal/bigmod/_asm/go.mod b/src/crypto/internal/bigmod/_asm/no.mod | ||
| similarity index 100% | ||
| rename from src/crypto/internal/bigmod/_asm/go.mod | ||
| rename to src/crypto/internal/bigmod/_asm/no.mod | ||
| diff --git a/src/crypto/internal/bigmod/_asm/go.sum b/src/crypto/internal/bigmod/_asm/no.sum | ||
| similarity index 100% | ||
| rename from src/crypto/internal/bigmod/_asm/go.sum | ||
| rename to src/crypto/internal/bigmod/_asm/no.sum | ||
| diff --git a/src/crypto/internal/edwards25519/field/_asm/go.mod b/src/crypto/internal/edwards25519/field/_asm/no.mod | ||
| similarity index 100% | ||
| rename from src/crypto/internal/edwards25519/field/_asm/go.mod | ||
| rename to src/crypto/internal/edwards25519/field/_asm/no.mod | ||
| diff --git a/src/crypto/internal/edwards25519/field/_asm/go.sum b/src/crypto/internal/edwards25519/field/_asm/no.sum | ||
| similarity index 100% | ||
| rename from src/crypto/internal/edwards25519/field/_asm/go.sum | ||
| rename to src/crypto/internal/edwards25519/field/_asm/no.sum |