Clean overridden dependencies

radu-matei commented 5 years ago

depends on https://github.com/docker/cnab-to-oci/pull/77 ref #121

When that PR is merged, we should update this PR, do a release of cnab-to-oci, then a release of cnab-go.

There are still some dependencies that are still overridden:

[[override]]
  name = "github.com/containerd/containerd"
  version = "v1.3.0"

[[override]]
  name = "github.com/docker/distribution"
  #version = "v2.7.1"
  revision = "0d3efadf0154c2b8a4e7b6621fff9809655cc580"

[[override]]
  name = "github.com/docker/docker-credential-helpers"
  version = "v0.6.3"

[[override]]
  name = "golang.org/x/sys"
  revision = "f49334f85ddcf0f08d7fb6dd7363e9e6d6b777eb"

without the x/sys override: github.com/docker/docker/pkg/system/filesys_windows.go:112:24: cannot use uintptr(unsafe.Pointer(&sd[0])) (type uintptr) as type *"github.com/deislabs/cnab-go/vendor/golang.org/x/sys/windows".SECURITY_DESCRIPTOR in assignment
go-containerregistry - I got this from duffle - I think it relates to image-relocation - @glyn might be able to help`
containerd, distribution, docker-credential-helpers - this helps pin compatible versions across cnab-to-oci, cli, client, docker/docker. Feel free to try turning these into constraints rather than overrides, I didn't have any luck so far.

Please test this on all operating systems and supported Go versions - I also added the osusergo build tag (see https://github.com/golang/go/issues/23265) - without it, cross compilation on Darwin fails.

radu-matei commented 5 years ago

Not sure what Azure Pipelines is doing, cancelled the build and reran it, it's green now - https://dev.azure.com/deislabs/cnab-go/_build/results?buildId=3919

radu-matei commented 5 years ago

Also, we should probably consider adding the vendor/ directory to source control, like we do in the rest of the Go projects in CNAB.

carolynvs commented 4 years ago

I agree that a follow-up PR where we commit vendor would be appreciated. 👍

jlegrone commented 4 years ago

@radu-matei sorry for the churn, can you rebase this PR now that #161 is merged?

carolynvs commented 4 years ago

Closing now that we use go mods.

cnabio / cnab-go

Clean overridden dependencies #150