https://github.com/Azure/go-autorest is deprecated

[sudheermygapula]

Summary

[What change needs making?]

(https://azure.microsoft.com/en-us/updates/support-for-azure-sdk-libraries-that-do-not-conform-to-our-current-azure-sdk-guidelines-will-be-retired-as-of-31-march-2023/)

Use Cases

Avoid end-of-life technologies

---

Message from the maintainers:

Love this feature request? Give it a 👍. We prioritise the proposals with the most 👍.

[agilgur5]

go-autorest is an indirect dependency, per the go.mod. That means one of the direct deps pulls it in, but not Argo itself. If there's an update to one of those that would remove it, then we can do that. Otherwise, Argo cannot control upstream deps and this should be an issue for an upstream dep

[agilgur5]

go mod why https://github.com/Azure/go-autorest is unfortunately not very helpful:

# https:/github.com/Azure/go-autorest/autorest
(main module does not need package https:/github.com/Azure/go-autorest/autorest)

This might be a case of golang/go#27900 (comment) where it's actually unused.

Looking at go mod graph, per golang/go#27900 (comment), shows a handful of relevant items:

github.com/chrismellard/[email protected] github.com/Azure/go-autorest/[email protected]
github.com/chrismellard/[email protected] github.com/Azure/go-autorest/autorest/[email protected]
github.com/chrismellard/[email protected] github.com/Azure/go-autorest/autorest/azure/[email protected]
github.com/chrismellard/[email protected] github.com/Azure/[email protected]+incompatible
github.com/chrismellard/[email protected] github.com/Azure/go-autorest/autorest/azure/[email protected]
github.com/chrismellard/[email protected] github.com/Azure/go-autorest/autorest/[email protected]
github.com/chrismellard/[email protected] github.com/Azure/go-autorest/[email protected]
github.com/chrismellard/[email protected] github.com/Azure/go-autorest/[email protected]

# [...]

github.com/google/go-containerregistry/pkg/authn/[email protected] github.com/Azure/[email protected]+incompatible
github.com/google/go-containerregistry/pkg/authn/[email protected] github.com/Azure/go-autorest/[email protected]
github.com/google/go-containerregistry/pkg/authn/[email protected] github.com/Azure/go-autorest/autorest/[email protected]
github.com/google/go-containerregistry/pkg/authn/[email protected] github.com/Azure/go-autorest/autorest/azure/[email protected]
github.com/google/go-containerregistry/pkg/authn/[email protected] github.com/Azure/go-autorest/autorest/azure/[email protected]
github.com/google/go-containerregistry/pkg/authn/[email protected] github.com/Azure/go-autorest/autorest/[email protected]
github.com/google/go-containerregistry/pkg/authn/[email protected] github.com/Azure/go-autorest/[email protected]
github.com/google/go-containerregistry/pkg/authn/[email protected] github.com/Azure/go-autorest/[email protected]

# [...]

k8s.io/[email protected] github.com/Azure/go-autorest/[email protected]
k8s.io/[email protected] github.com/Azure/go-autorest/autorest/[email protected]

i.e. older versions of container registry packages and an older version of client-go, which I actually traced to being from argoproj/pkg: https://github.com/argoproj/pkg/blob/7dc18479d378b4f8888f0c8866ebe5a71f0452ef/go.mod#L24

[agilgur5]

Looks like go-containerregistry still has it as an indirect dep even in its latest version (which I tried upgrading to in the go.mod as well): https://github.com/google/go-containerregistry/blob/00f182b8d3070d2c0a0334657fd58a284778ef83/pkg/authn/k8schain/go.mod#L23

and docker-credential-acr-env has a direct dep on it in its latest: https://github.com/chrismellard/docker-credential-acr-env/blob/82a0ddb2758901b711d9d1614755b77e401598a1/go.mod#L7

So I think this is solidly blocked by upstream and there's not much Argo can really do about it right now. We can re-open this issue at a later date once it is actionable.
It may make sense to open similar issues upstream so that those packages can remove their dependency on the EoL package and then we can update to the latest version of those deps