hashicorp / hashicorp/vault

Improvement: Remove testify from production binaries

Open
#31,707 0 comments 0 reactions 0 assignees View on GitHub
dependencies
Dominant language
Go
Stars
36.3k
Forks
4.8k
PR merge metrics
PR metrics pending

Description

**Is your feature request related to a problem? Please describe.**

The `vault` production binary currently includes the `github.com/stretchr/testify` library.

The `github.com/stretchr/testify/assert` package is being imported within production source files rather than being restricted to `_test.go` files. Because `testify` includes global variable initializers (e.g. [here](https://github.com/stretchr/testify/blob/master/assert/assertion_compare.go)), Go cannot eliminate the code, even if the functions themselves are likely unreachable in production.

**Describe the solution you'd like**

I would like `testify` to be completely eliminated from the production binary.

Motivation:

* It's a bit strange for a tool like Vault to include this unrelated test package in the final build.
* It might cause extra work if there's a vulnerability anywhere in the `testify` project, or its dependencies, it will show up as a vulnerability for Vault too

**Describe alternatives you've considered**

**Explain any additional use-cases**

**Additional context**

Here is minimal "reproduction" case on how the additional dependency is introduced with a trivial Go program:

```
$ go mod init example.com/test
$ go get github.com/stretchr/testify
$ cat > main.go <

Contributor guide

Open the contributing guide

Research direction

Start by locating production, non-_test.go imports of github.com/stretchr/testify/assert and inspect how they enter the Vault build. Use go build and go tool nm to compare dependencies and symbols; done means the production binary no longer includes testify while the existing tests still pass.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
build-system
Issue type
Refactor
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.