What to do about archived go dependencies?

[popey]

Hey gang!

There was mention somewhere last week that mitchellh (Mitchell Hashimoto) · GitHub archived a bunch of their repos as they’ve moved on from Go development to something else, zig?

Anyway, I wondered, other than Mitchell’s Go projects that we depend on, how many others have been archived. So I wrote a script, and here’s the result after pointing it at Syft, Grype, Grant and Stereoscope as a test. I can scan all the other open source repos, but figured I’d start the conversation with what we have here:

Do we have a plan for “dealing” with these?

All

• GitHub - facebookincubator/nvdtools: A set of tools to work with the feeds (vulnerabilities, CPE dictionary etc.) distributed by National Vulnerability Database (NVD)
• GitHub - mitchellh/copystructure: Go (golang) library for deep copying values in Go.
• GitHub - mitchellh/go-homedir: Go library for detecting and expanding the user's home directory without cgo.
• https://github.com/mitchellh/hashstructure/v2
• GitHub - mitchellh/mapstructure: Go library for decoding generic map values into native Go structures and vice versa.
• GitHub - mitchellh/reflectwalk: reflectwalk is a Go library for "walking" complex structures, similar to walking a filesystem.
• GitHub - pkg/errors: Simple error handling primitives
• GitHub - sagikazarmark/slog-shim: Backward-compatible shim for log/slog

Grype & Syft

• https://github.com/facebookincubator/nvdtools/wfn

Grype

• GitHub - mitchellh/go-testing-interface: Go (golang) library to expose *testing.T as an interface.

Grant

• https://github.com/mholt/archiver/v3

[kzantow]

It looks like we should probably update to use the Viper fork of mapstructure anywhere we’re directly depending on it: GitHub - go-viper/mapstructure: Go library for decoding generic map values into native Go structures and vice versa., especially since we’re already pulling this in with Viper updates.