Improvement: Remove testify from production binaries
- Dominant language
- Go
- Stars
- 36.3k
- Forks
- 4.8k
- PR merge metrics
- PR metrics pending
Description
**Is your feature request related to a problem? Please describe.**
The `vault` production binary currently includes the `github.com/stretchr/testify` library.
The `github.com/stretchr/testify/assert` package is being imported within production source files rather than being restricted to `_test.go` files. Because `testify` includes global variable initializers (e.g. [here](https://github.com/stretchr/testify/blob/master/assert/assertion_compare.go)), Go cannot eliminate the code, even if the functions themselves are likely unreachable in production.
**Describe the solution you'd like**
I would like `testify` to be completely eliminated from the production binary.
Motivation:
* It's a bit strange for a tool like Vault to include this unrelated test package in the final build.
* It might cause extra work if there's a vulnerability anywhere in the `testify` project, or its dependencies, it will show up as a vulnerability for Vault too
**Describe alternatives you've considered**
**Explain any additional use-cases**
**Additional context**
Here is minimal "reproduction" case on how the additional dependency is introduced with a trivial Go program:
```
$ go mod init example.com/test
$ go get github.com/stretchr/testify
$ cat > main.go <
Contributor guide
Research direction
Start by locating production, non-_test.go imports of github.com/stretchr/testify/assert and inspect how they enter the Vault build. Use go build and go tool nm to compare dependencies and symbols; done means the production binary no longer includes testify while the existing tests still pass.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- build-system
- Issue type
- Refactor
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100