search

s12v / go-jwks

A Go library to retrieve RSA public keys from a JWKS (JSON Web Key Set) endpoint
MIT License
42 stars 16 forks source link

Question about some suspect dependencies of "go-jose" #8

Open pintarj opened 2 years ago

pintarj commented 2 years ago

I'm quite new to Go and I have some issues with module dependencies in my project. While trying to figure out what's the problem I found out that in the go.mod of the go-jwks repository there are two (to me) suspect lines:

require(
  // ...
  github.com/square/go-jose v2.6.0+incompatible
  // ...  
  gopkg.in/square/go-jose.v2 v2.3.1 // indirect
)

They are targeting the same module, but with different versions and on different package registries (github.com and gopkg.in). Furthermore (as far as I can see) the gopkg.in/square/go-jose.v2 is never user inside the code of the repository.

Is this intentional? Cause I think that this could be the problem that is breaking my code.