Skip to content

Conversation

@rosstimothy
Copy link
Contributor

The inclusion of the test helper outside of a _test.go file results in any downstream consumer of this library, either directly or transitively, having the testing package reachable in their binaries. See the following dependency tree for an example which shows how testing ends up being included in github.com/sigstore/sigstore-go.

 goda tree "reach(github.com/sigstore/sigstore-go/pkg/tlog...:all,  testing)"
  ├ github.com/sigstore/sigstore-go/pkg/tlog
    ├ github.com/sigstore/rekor/pkg/types/dsse/v0.0.1
      └ github.com/in-toto/in-toto-golang/in_toto
        └ github.com/secure-systems-lab/go-securesystemslib/signerverifier
    └ github.com/sigstore/rekor/pkg/types/intoto/v0.0.2
      └ github.com/in-toto/in-toto-golang/in_toto ~

Since the hexDecode helper was only being consumed in tests it was relocated from signerverifier/utils.go to signerverifier/utils_test.go.

The inclusion of the test helper outside of a _test.go file results
in any downstream consumer of this library, either directly or
transitively, having the testing package reachable in their binaries.
See the following dependency tree for an example which shows how
`testing` ends up being included in `github.com/sigstore/sigstore-go`.

```bash
 goda tree "reach(github.com/sigstore/sigstore-go/pkg/tlog...:all,  testing)"
  ├ github.com/sigstore/sigstore-go/pkg/tlog
    ├ github.com/sigstore/rekor/pkg/types/dsse/v0.0.1
      └ github.com/in-toto/in-toto-golang/in_toto
        └ github.com/secure-systems-lab/go-securesystemslib/signerverifier
    └ github.com/sigstore/rekor/pkg/types/intoto/v0.0.2
      └ github.com/in-toto/in-toto-golang/in_toto ~
```

Since the hexDecode helper was only being consumed in tests it was
relocated from signerverifier/utils.go to signerverifier/utils_test.go.
@rosstimothy
Copy link
Contributor Author

@adityasaky would you, or someone else from your team, be able to take a look at this?

Copy link
Member

@adityasaky adityasaky left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks!

@adityasaky adityasaky merged commit 4f201c1 into secure-systems-lab:main Jul 29, 2025
7 checks passed
@rosstimothy
Copy link
Contributor Author

@adityasaky would you be able to cut a new tag with this change?

@adityasaky
Copy link
Member

done!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants