snapshotter: Fixes go.sum false positive alert for protobuf def #931
Conversation
The previous PR which fixes this did not actually remove the bad version from the go.sum file. Funny story, go.sum is not really a list of deps included in the actually binary, its more of a manifest that go used to walk the dep tree. Dependabot will sometimes improperly use this as the source of truth which is not 100% correct. I am not 100% sure if that is what is happening here, but it def could be because the final binary is only including 1.3.2 of protobuf. The reason this wasnt cleaned up is that go 1.15's `go mod tidy` does not do as good of job of cleaning up the go.sum as 1.16. I have modified my patching scripts to delete the go.sum along with the vendor dir and regenerate it instead. ref: dependabot/dependabot-core#4740
|
@drewvanstone: changing LGTM is restricted to collaborators In response to this:
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository. |
|
/retest |
|
/lgtm |
|
/approve |
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: jaxesn The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
|
BTW, GitHub fixed it so |
The previous PR which fixes this did not actually remove the bad version
from the go.sum file.
Funny story, go.sum is not really a list of
deps included in the actually binary, its more of a manifest that go
used to walk the dep tree. Dependabot will sometimes improperly use this
as the source of truth which is not 100% correct. I am not 100% sure
if that is what is happening here, but it def could be because the final
binary is only including 1.3.2 of protobuf.
The reason this wasnt cleaned up is that go 1.15's
go mod tidydoesnot do as good of job of cleaning up the go.sum as 1.16. I have modified
my patching scripts to delete the go.sum along with the vendor dir and regenerate
it instead.
ref: dependabot/dependabot-core#4740
Issue #, if available:
Description of changes:
By submitting this pull request, I confirm that you can use, modify, copy, and redistribute this contribution, under the terms of your choice.