Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients

To: Leo Antunes <leo@antun.es>

Subject: Bug#1029170: ITP: golang-github-sigstore-sigstore -- Common go library shared across sigstore services and clients

From: Reinhard Tartler <siretart@gmail.com>

Date: Sun, 26 Mar 2023 16:07:37 -0400

Message-id: <[🔎] CAJ0cceYnj9xsC6khrCt64En1RfcdoSA81MdWN+Dnarg5rt6vpw@mail.gmail.com>

Reply-to: Reinhard Tartler <siretart@gmail.com>, 1029170@bugs.debian.org

In-reply-to: <gpRTtIsqlkF8q2SgC6Z_6kw0njuzZ8QBAk2OZfY5Q5tOCK7Yh1HcYSMhc6ZnNcdVmNxDCt8YVTRJqMubB5Q1Fs2AjtkfuKU1MFKAUNHLN4Y=@antun.es>

References: <CAJ0cceZpqRfO-OqvUc5TR+ojwXW=hVme5p+d1p8gRs-WT+0Tow@mail.gmail.com> <VKMy3_3axd86D6aRsBmu5cf2FIbmOKnBzf8DsSz3DfmnJZaPDet-Sf802bayHltGH8bH5TpIrlbcS37Xpm2BOFjktK8fKbVK9PMN9rfZ4To=@antun.es> <CAJ0ccea5pDHwgd+iDdcs863ZSmRGSXANMdK1XnCzNTQh8=dOWA@mail.gmail.com> <1674073013.967794.666772@focus> <CAJ0cceZDRAuffBhnGEPaFBpjaQE-+cr9LGPN7=ADB1dG4Zt9JQ@mail.gmail.com> <gpRTtIsqlkF8q2SgC6Z_6kw0njuzZ8QBAk2OZfY5Q5tOCK7Yh1HcYSMhc6ZnNcdVmNxDCt8YVTRJqMubB5Q1Fs2AjtkfuKU1MFKAUNHLN4Y=@antun.es> <1674073013.967794.666772@focus>

Sounds good.

I'm happy to take on the easier dependencies, such as pkg/browser or jellydator/ttlcache.

But the dependency on boulder is giving me a massive headache. It is really unfortunate that they chose to use such a heavy dependency for a rather simple task (goodkey). What are your thoughts on resolving this?

-rt

On Sun, Feb 5, 2023 at 3:30 PM Leo Antunes <leo@antun.es> wrote:

Hi Reinhard,

It seems I underestimated the work and overestimated by free time: we need some bumps for deps (e.g. golang-github-azure-azure-sdk-for-go-dev) and maybe some patching to get rid of other deps (e.g. github.com/letsencrypt/boulder), if we can manage that.
OTOH, I see you already took care of #1030555 and #1030557! That's great! :)

Cheers
Leo

------- Original Message -------
On Thursday, February 2nd, 2023 at 12:33, Reinhard Tartler <siretart@gmail.com> wrote:

> seems https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1022937 was accepted. Any update on sigstore packaging?

regards,
Reinhard

Reply to: