Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove go-kit from being used in the core code #20

Merged
merged 3 commits into from
Sep 25, 2024
Merged

Conversation

hslatman
Copy link
Member

@hslatman hslatman commented Sep 25, 2024

Replaces #19 and #11.

This PR removes usage of go-kit from the core code. We still
allow a go-kit logger to be injected for backwards compatibility
purposes.

One behavioral change is introduced, coming down to the logging
calls not setting the log level directly. If one needs the old
behavior, they should initialize the logger like this:

logger = level.NewInjector(logger, level.DebugValue())

This will ensure the logger will add a level=debug attribute for
the log lines where those were removed. An example of this, and
verification can be found in the tests.

IMO this shouldn't cause too much trouble for people relying on it,
so I think it's OK to make this backwards incompatible behavior
change without cutting a v2. In a v2 we would likely use log/slog.

@jessepeterson thanks for the nudge. The go-kit dependency
was a thorn in the eye 😅 The tests didn't take into account the
actual log output, so that's why they succeeded with your changes.
I've added additional verification logic for the logs. That means
we still rely on go-kit in the tests, but for dependents of the code,
that shouldn't be an issue.

This commit removes usage of `go-kit` from the core code. We still
allow a `go-kit` logger to be injected for backwards compatibility
purposes.

One behavioral change is introduced, resulting in the logging
calls not setting the log level directly. If one needs the old
behavior, they should initialize the logger like this:

 `logger = level.NewInjector(logger, level.DebugValue())`

This will ensure the logger will add a `level=debug` attribute for
the log lines where those were removed.
@hslatman hslatman linked an issue Sep 25, 2024 that may be closed by this pull request
@hslatman hslatman mentioned this pull request Sep 25, 2024
@hslatman hslatman requested review from a team and dopey September 25, 2024 10:11
@hslatman hslatman merged commit 18439bc into main Sep 25, 2024
13 checks passed
@hslatman hslatman deleted the herman/remove-go-kit branch September 25, 2024 13:10
@jessepeterson
Copy link
Contributor

Part of the motivation here was to remove the dependency completely (to have it removed from the go.sum). But I see the package is still used (in the test). Can it be removed completely?

@hslatman
Copy link
Member Author

@jessepeterson what is the goal of fully removing it from go.sum? The file is not intended to be ingested for determining dependencies or vulnerabilities; that should be based on go.mod. If it's solely to get a smaller/cleaner file, I think we shouldn't make our lives harder than needed.

@jessepeterson
Copy link
Contributor

Downstream dependencies also include references of their dependents, don't they? But more to the point if the dependency is still there.. why even remove it at all?

@hslatman
Copy link
Member Author

Well, we got rid of github.com/go-stack/stack and github.com/go-logfmt/logfmt, so that's at least something.

go-kit is only needed for the tests. If we remove its usage from the test, there's no guarantee that it'll work as expected, as the level can't be injected/faked from outside the go-kit/log package. We could choose to fully fake the logger by emulating its behavior using log/slog, though.

go-kit is used in several places in https://github.com/micromdm/scep directly, so it's already a dependency there. Removing it from this package doesn't seem to help there, unless there's plans to use a different logger?

@jessepeterson
Copy link
Contributor

Well, we got rid of github.com/go-stack/stack and github.com/go-logfmt/logfmt, so that's at least something.

Yep, that's great!

But here's an example project that tries to include it: https://gist.github.com/jessepeterson/671b3b7fe2140dda535dbb30166f33c4

As you can see from the go.sum it includes this project's dependencies (go-kit) when I'm not using them. No, it doesn't interfere with anything — perhaps this my own personal desire to simply de-clutter go.sum files. It irks me that dependencies I'm not using show up in my project unnecessarily. :) Probably quibbling over small details, but 🤷 .

go-kit is only needed for the tests. If we remove its usage from the test, there's no guarantee that it'll work as expected, as the level can't be injected/faked from outside the go-kit/log package. We could choose to fully fake the logger by emulating its behavior using log/slog, though.

Yeah by moving away from go-kit logging to our own logging package there is no guarantee it'll work. I think that's implied. We now guarantee that we work with our logging interface (in logger.go). It just so happens to also be compatible (at the time of writing) with Go-kit's logger interface. Yes — I would mock the logger (though, I wouldn't mock it with slog just yet — requiring Go 1.21 seems a little steep—but that's just my personal preference).

go-kit is used in several places in https://github.com/micromdm/scep directly, so it's already a dependency there. Removing it from this package doesn't seem to help there, unless there's plans to use a different logger?

Yes, micromdm/scep is heavily invested in Go-kit in general but the plan is to move away from it. Who knows when that'll come—perhaps when when we drop server capability. The Nano* projects have been using jessepeterson/go-log (embedded) for some time but have recently switched to importing micromdm/nanolib/log which is the same, just imported. We'll write an adapter to slog at some point, too.

@hslatman
Copy link
Member Author

@jessepeterson I've opened #21.

Given that implementations should adhere to the scep.Logger interface, and the fact that we already "broke" setting the debug level in the messages, I think we can do it like this.

Not sure why we got some of the new lines in go.sum after upgrading pkcs7. They're not used in the package itself 🧐

@jessepeterson
Copy link
Contributor

jessepeterson commented Sep 26, 2024

I've opened #21.

Thanks!

I'll also just add, when the eventual refactor comes about (I know, when we all have free time, right?), I would question even including a logger facility at all. This package is largely for data structures and marshaling to and fro. I'd prefer to have ways to access (or be able to export) the relevant logged data and push logging up to the package/library users. This was also brought up (forever ago) in the previous project over in micromdm/scep#62.

I just thought removing the go-kit dependency (for now) was a step along the way, considering we have a local interface defined. Fwiw the logging could be removed now and keep the API unchanged (just not using any provided logger). ;P

@hslatman
Copy link
Member Author

I've opened #21.

Thanks!

I'll also just add, when the eventual refactor comes about (I know, when we all have free time, right?), I would question even including a logger facility at all. This package is largely for data structures and marshaling to and fro. I'd prefer to have ways to access (or be able to export) the relevant logged data and push logging up to the package/library users. This was also brought up (forever ago) in the previous project over in micromdm/scep#62.

Yeah, I mostly agree. We should make use of some more sentinel errors or typed errors with appropriate context. And we could look into adding a method to get a slog.Attr from a SCEP message to ease logging, potentially with a fallback for older Go versions if deemed necessary. There's a few operations that take a couple of steps, specifically the ones that call into pkcs7. For those it might make sense to be able to optionally pass a logger for debugging purposes, as I've sometimes opted to logging i.e. DER contents of a request while looking into issues, so I'm keeping that option open for now. But I agree that it would be nicer to be able to handle it outside the package.

I just thought removing the go-kit dependency (for now) was a step along the way, considering we have a local interface defined. Fwiw the logging could be removed now and keep the API unchanged (just not using any provided logger). ;P

😅

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

Remove go-kit dependencies
3 participants