Repository navigation
ci: check dependencies with gosocialcheck - #53979
AkihiroSuda wants to merge 1 commit into
Conversation
AkihiroSuda
added
kind/enhancement
1512e98 to
0d7adbe
Compare
| // Docker, Moby, and golang.org/x packages are trusted | ||
| //gosocialcheck:trusted | ||
| require ( | ||
| github.com/moby/docker-image-spec v1.3.1 // indirect | ||
| golang.org/x/sys v0.33.0 // indirect | ||
| ) |
There was a problem hiding this comment.
Is this something that can be configured through other ways? If I'm not mistaken, go (finally!?) started fixing grouping in go.mod to prevent multiple groups (multiple direct / indirect).
Also slightly wondering what makes decisions in CNCF projects more trust-worthy than (e.g.) moby itself? (I've seen some poor choices and messy dependency-management in CNCF)
There was a problem hiding this comment.
Is this something that can be configured through other ways?
Updated to use inline comments instead of require() group comments
If I'm not mistaken, go (finally!?) started fixing grouping in
go.modto prevent multiple groups (multiple direct / indirect).
Yes, seems started in Go 1.27 😞
Also slightly wondering what makes decisions in CNCF projects more trust-worthy than (e.g.) moby itself?
s/CNCF projects/CNCF graduated projects/
s/more/same/
(I've seen some poor choices and messy dependency-management in CNCF)
https://github.com/cncf/toc/blob/main/.github/ISSUE_TEMPLATE/template-graduation-application.md#security could be improved?
| name: Install gosocialcheck | ||
| run: | | ||
| go install "github.com/AkihiroSuda/gosocialcheck/cmd/gosocialcheck@${GOSOCIALCHECK_VERSION}" |
There was a problem hiding this comment.
Could this run as linter in golangci-lint? Similar to (e.g.) forbidigo ?
There was a problem hiding this comment.
Not sure, as gosocialcheck is a linter for go.mod rather than Go source codes themselves.
Could be experimented as a plugin anyway
b9a5830 to
fa0e781
Compare
fa0e781 to
aeaab91
Compare
aeaab91 to
58e3f82
Compare
e7e6fa0 to
1067b9b
Compare
|
Addressed the review comments @thaJeztah Could you take a look? |
fc546a1 to
85103cf
Compare
Run gosocialcheck to check whether the dependencies of the main module, api, and client are adopted by trusted projects (i.e., CNCF graduated projects). Findings are reported as GitHub Actions annotations on go.sum and do not fail the job. Docker, Moby, and golang.org/x packages are annotated as trusted in go.mod. https://github.com/AkihiroSuda/gosocialcheck Signed-off-by: Akihiro Suda <akihiro.suda.cz@hco.ntt.co.jp>
85103cf to
fddae73
Compare
| github.com/moby/buildkit v0.35.0-rc1 //gosocialcheck:trusted | ||
| github.com/moby/docker-image-spec v1.3.1 //gosocialcheck:trusted | ||
| github.com/moby/extensions v0.0.0-20261026144205-2b6b3bd5fa82 //gosocialcheck:trusted | ||
| github.com/moby/go-archive v0.3.3 //gosocialcheck:trusted | ||
| github.com/moby/ipvs v1.1.0 //gosocialcheck:trusted |
There was a problem hiding this comment.
it's odd that we trust other orgs, but not the things we maintain ourselves, and don't trust dependencies maintained by the Go project.
This PR does the quite opposite. Docker, Moby, and golang.org/x packages are trusted with the //gosocialcheck:trusted annotations. The others are untrusted, unless they are already adopted by a CNCF-graduated project.
There was a problem hiding this comment.
Right; but
unless they are already adopted by a CNCF-graduated project.
Means we assume those made the right choice, so that's out of our control ? And "adopted by a CNCF-graduated project" means, that I need to get (say) containerd to accept a PR that adds something as an (indirect?) dependency, then it's considered "approved" by default 🤔
There was a problem hiding this comment.
Does containerd have this in CI? Because if the graduated CNCF project do not get a warning "this is a new dependency that has not yet been adopted by anyone else; you're the first!", then that would reduce the gate for it to be introduced.
(besides every update of a dependency should ideally get the same amount of attention; version X of a dependency may be fine, but gives no promises for any update of the same dependency).
There was a problem hiding this comment.
Means we assume those made the right choice, so that's out of our control ?
Right, if an adoption in a single CNCF project is not considered safe enough, maybe we should bump the threshold to 2 or 3?
And "adopted by a CNCF-graduated project" means, that I need to get (say) containerd to accept a PR that adds something as an (indirect?) dependency, then it's considered "approved" by default 🤔
You don't need to get (say) containerd to accept such a PR. Just a warning will be printed.
Does containerd have this in CI?
It is in nerdctl (containerd/nerdctl#5208) , but not in containerd itself yet.
Will open a PR there soon. EDIT: opened containerd/containerd#14547
Summary
Run gosocialcheck to check whether the dependencies of the main module, api, and client are adopted by trusted projects (i.e., CNCF graduated projects).
Findings are reported as GitHub Actions annotations on
go.sumand do not fail the job.Docker, Moby, and golang.org/x packages are annotated as trusted (
//gosocialcheck:trusted) ingo.mod.https://github.com/AkihiroSuda/gosocialcheck
See:
Release notes (optional)
A picture of a cute animal (not mandatory but encouraged)
Created with: Claude Code