search

notaryproject / notation-go

A collection of libraries for supporting sign and verify OCI artifacts. Based on Notary Project specifications.
Apache License 2.0
38 stars 42 forks source link

Dependency on go-ldap #45

Open rgnote opened 2 years ago

rgnote commented 2 years ago

We are using go-ldap for parsing Distinguished Names (DN) of a trust policy's trustedIdentities field. Although we are using a single function from this library, this dependency is bringing bunch of additional dependencies unrelated to what notation does. We can remove the dependency and just copy the code that we need. But, we need to figure out a way to give attribution to go-ldap. Also, if we remove the dependency, we need to have a mechanism to pull the relevant updates, security patches periodically. This issue is to track how we are going to proceed with this dependency as we approach RC1 launch.

gokarnm commented 2 years ago

@iamsamirzon @rgnote should assign this to appropriate milestone in next planning community meeting.