Remove sget command

[luhring]

Summary

Removes the sget command for now, while the team refines the vision for the "sget" idea, how it will be manifested in code, and how we'll distribute it to users.

Ticket Link

Related to #1363

Release Note

Removes sget command

[cpanato]

also need to remove from the goreleaser:
https://github.com/sigstore/cosign/blob/main/.goreleaser.yml#L147

and from build image using ko
https://github.com/sigstore/cosign/blob/main/Makefile#L140
https://github.com/sigstore/cosign/blob/main/release/release.mk#L22

and general build
https://github.com/sigstore/cosign/blob/main/Makefile#L92

[luhring]

Thanks @cpanato for finding those! 🙏

I also found a handful of other spots we're using the sget command, and I removed them. Let me know if this was too heavy-handed.

Also, I left the sget Go package for now, since it's used in cosign policy init and in E2E testing. Let me know if you think we should work to remove this "sget" reference as well.

[cpanato]

LGTM

will defer to @dlorenc

[cpanato]

would merge this after the 1.5.1 release

[dlorenc]

I'd honestly still rather wait here until we have a plan. I don't think it's going to take forever to get something drafted, but doing it in a rush before we've figured out what the next step is feels like a mistake.

[luhring]

I'd honestly still rather wait here until we have a plan. I don't think it's going to take forever to get something drafted, but doing it in a rush before we've figured out what the next step is feels like a mistake.

Agreed 💯 . Let's do that, and this PR is here if/when we want it.

[dlorenc]

Ok so for a plan, we can leave this around until the new repo is created and we've done a release from there. That way we can delete here without causing too much confusion.

[jeff-mccoy]

Thanks @dlorenc...we already included the sget package in our go project not realizing it was possibly being removed 😳. Thanks to @imjasonh for pointing this out to us in slack.

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[imjasonh]

@dlorenc ping, possibly #2019 first?

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[imjasonh]

I think we can do this now.

#2019 was merged in 1f42a24 and released as part of cosign 1.12. We're on 1.13 now, so I think this is ample warning for folks to stop depending on it.

WDYT @dlorenc

[cpanato]

@imjasonh, when we make the release of the sget in the other repo we will continue the release version of sget and do a v1.14.0 lets say or do you want to bump to another version?

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[cpanato]

Not stale

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[cpanato]

@luhring @imjasonh @dlorenc any plans on this? should we move forward or close this PR?

[znewman01]

I think we should merge this PR. As-is, sget is only marginally useful. There's no real replacement but then again sget itself was never complete and often encouraged security antipatterns.

[github-actions]

This PR is stale because it has been open 30 days with no activity. Remove stale label or comment or this will be closed in 10 days.

[luhring]

I think we should merge this PR.

Just catching up here! 😅 I'm happy to go through the merge conflicts and resolve them if current maintainers are still into this change! Otherwise we can close this.

[cpanato]

i think we want that, the sget repo was archived and I think we should remove this as well

I can help here as well @luhring in case you need

cc @priyawadhwa @bobcallaway @lukehinds thoughts?

[priyawadhwa]

Removing it sgtm!

[luhring]

I can help here as well @luhring in case you need

@cpanato That'd be great, actually, thank you! I just tried to resolve conflicts (and I'll push this state of my branch here), but it looks like there are additional uses of sget that have popped up since this PR was first opened (seeing several more references with grep -Rni 'sget' .).

I defer to you on how best to move forward.

[codecov]

Codecov Report

Merging #1364 (912848f) into main (5b8af9c) will not change coverage.
The diff coverage is n/a.

@@           Coverage Diff           @@
##             main    #1364   +/-   ##
=======================================
  Coverage   29.47%   29.47%           
=======================================
  Files         151      151           
  Lines        9678     9678           
=======================================
  Hits         2853     2853           
  Misses       6386     6386           
  Partials      439      439           

Help us with your feedback. Take ten seconds to tell us how you rate us. Have a feature suggestion? Share it here.

[cpanato]

from where this come from? this was deprecated a long time and not have it own repo (policy-controller)

[cpanato]

@luhring maybe you rebased using an older base?
it is okay to close this and I open a fresh one?

[luhring]

@cpanato Please! 🙏

[cpanato]

closing in favor of #2885