Implement verify-vendor.sh in pure Go

google / cel-go

Fast, portable, non-Turing complete expression evaluation with gradual typing (Go)

https://cel.dev

Apache License 2.0

2.27k stars 221 forks source link

Implement verify-vendor.sh in pure Go #1030

Open aep-sunlife opened 1 month ago

aep-sunlife commented 1 month ago

Feature request checklist

[x] There are no issues that match the desired change
[ ] The change is large enough it can't be addressed with a simple Pull Request
[ ] If this is a bug, please file a Bug Report.

Change

Please rewrite the helper script verify-vendor.sh in pure Go, for the benefit of the Go community.

Shell scripts are inherently fragile and difficult to maintain compared to higher level languages. Migrating to Go simplifies the installation process. It increases portability. It increases reliability, enabling richer test suites.

TristonianJones commented 1 month ago

Hi @aep-sunlife, the script was contributed to the CEL repo, so I'm not sure what this would entail. Would this be related to go mod verify? Or did you have something else in mind?

aep-sunlife commented 1 week ago

Shell scripts tend to complicate things for Windows contributors and Windows users. But shell scripts can break UNIX environment as well, such as Alpine Linux and FreeBSD (bash is not the default shell there). Shell is harder to test, harder to guarantee portability, and harder to lint/SAST than general purpose programming languages like Go.

Even shellcheck, set... flags, and sticking to 100% POSIX tools and CLI flags are not sufficient to produce perfect shell scripts.

Go is Turing complete, capable of performing a wide variety of tasks without resorting to (inherently less portable) shell tricks.

Let's publish the same logic in pure Go code, such as an ordinary Go program.

TristonianJones commented 1 week ago

That's all well and good, but an example implementation that matches what you have in mind would be very helpful.