go installing doesn't work due to replace directive

[jamietanna]

When trying to do so, we see:

% go install github.com/StyraInc/regal@latest
go: downloading github.com/StyraInc/regal v0.13.0
go: github.com/StyraInc/regal@latest (in github.com/StyraInc/regal@v0.13.0):
        The go.mod file for the module providing named packages contains one or
        more replace directives. It must not contain directives that would cause
        it to be interpreted differently than if it were the main module.

I'd recently hit this on a personal project, and a solution that may work here is the following:

diff --git go.mod go.mod
index 1d307fd..3a86020 100644
--- go.mod
+++ go.mod
@@ -42,7 +42,8 @@ require (
 	github.com/prometheus/procfs v0.12.0 // indirect
 	github.com/rcrowley/go-metrics v0.0.0-20201227073835-cf1acfcdf475 // indirect
 	github.com/rivo/uniseg v0.4.4 // indirect
-	github.com/sirupsen/logrus v1.9.3 // indirect
+	// wasip1 support isn't in a tagged version yet, remove for v1.9.4
+	github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af // indirect
 	github.com/tchap/go-patricia/v2 v2.3.1 // indirect
 	github.com/xeipuuv/gojsonpointer v0.0.0-20190905194746-02993c407bfb // indirect
 	github.com/xeipuuv/gojsonreference v0.0.0-20180127040603-bd5ef7bd5415 // indirect
@@ -58,6 +59,3 @@ require (
 	gopkg.in/yaml.v2 v2.4.0 // indirect
 	sigs.k8s.io/yaml v1.4.0 // indirect
 )
-
-// wasip1 support isn't in a tagged version yet, remove for v1.9.4
-replace github.com/sirupsen/logrus => github.com/sirupsen/logrus v1.9.4-0.20230606125235-dd1b4c2e81af

Alternatively, we can wait until the logrus release is baked, but thought I'd flag that this could cause issues for folks.

[anderseknert]

Thanks for raising that! The workaround seems fine to me — I just didn't know you could pin indirect dependencies like that. Will that be overwritten later when we upgrade OPA to the next version, or how does that work?

Also, I'm always curious to learn how Regal is used! Something secret, or can you tell me some about it? 😃

[anderseknert]

Thinking about it, perhaps we could just use v1.9.3 for the logrus dependency, and include instructions for how to use replace in the Wasm build instructions? That's more of an experiment at this point in time, so if that breaks go get , I think it might not be worth having in main.

[jamietanna]

Yeah in this case because we're taking a commit from the same repo, we can do so - if we wanted to use a fork, then we'd need a replace, or we'd need to update the fork's go.mod to point to their forked module path.

I think taking the proposed diff - pointing to that commit hash - works for now, and should unblock any go installs.

Will that be overwritten later when we upgrade OPA to the next version, or how does that work?

Depending on how you're doing the version bump, it should be straightforward. And i.e. Dependabot/Renovate/etc will notice when there's v1.9.4 of logrus and bump that accordingly.

[anderseknert]

Since we don't really need a version above 1.9.3 for anything but the wasm experiment, I'd say let's use that for now. I can amend the instructions to the wasm section of the dev docs later. Would you want to submit a PR for the change?

Also, still curious to learn more about your Regal integration! 😊

[jamietanna]

Sure! I've raised #491 for it!

Also, I'm always curious to learn how Regal is used! Something secret, or can you tell me some about it? 😃

Certainly! I'm building dependency-management-data, a tool for understanding how you Open Source and internal dependencies are used. I'm in the process of adding Open Policy Agent support and as part of future work I'm looking at adding base + custom linting with regal - I've not done much with OPA but it's great to have a linter already available, and extensible 🚀

[anderseknert]

That's a really cool use case! Do feel free to reach out when it's ready for a demo, as I'd love to try it out. Also happy to help promote it in our various channels 😃

[jamietanna]

Thanks very much, will do!

[jamietanna]

FYI I've just shipped regal support in DMD!

[anderseknert]

Fantastic, @jamietanna! Sometime soon I'll either add an ADOPTERS.md file to the project, or a section in the README. Will make sure to include your project there 👍