integrate github.com/pmezard/go-difflib

[obsti8383]

Summary

Since go-difflib is unmaintained since quite some time, the required functions have been taken over into a separate testify package.

Motivation

Unmaintained packages might vanish or be taken over by attackers.

Related issues

Closes #1187
Closes #1159
Closes #736

[boyan-soubachov]

It's a good idea but would it not be easier to just pin to the latest version in our go.mod file and break on any hash changes (go.sum, we already do that in the CI jobs).

I get the problem of what happens if the package vanishes, would vendoring not be an easier solution then?

[obsti8383]

It's a good idea but would it not be easier to just pin to the latest version in our go.mod file and break on any hash changes (go.sum, we already do that in the CI jobs).

go.mod already PINs the version, so that doesn't change anything. Pulling everything into this repo gives the advantage that you don't upgrade to a malicious version by accident.

Main advantage of moving all used code into this repo is that you get rid of concerns by using an unmaintained source code, by maintaining it yourself (see all three issues).

I've also included only the used functions, which makes the code base smaller.

I get the problem of what happens if the package vanishes, would vendoring not be an easier solution then?

As far as I understand vendoring it doesn't bring any advantages here, since command like "go get" will still use the original repository and you don't get rid of the dependency.

[miguelalcantar]

Everything seems good to me. Also I need this upgrade

[miguelalcantar]

@boyan-soubachov @ernesto-jimenez, could we have a look at this?

[ilkka]

Would love to see this integrated as well.

[TReadOnly]

Looking forward to having github.com/pmezard/go-difflib integrated.

[bmv126]

Any update on this ?
Can this be merged.

[dolmen]

We have enough code to maintain and not enough maintainer.

We should instead investigate using another library that provides the same features.

[bmv126]

How about https://github.com/martinohmann/go-difflib ?

[dolmen]

Move package difflib to internal/difflib.

[dolmen]

@miguelalcantar Why do you "need" that change?

[obsti8383]

Move package difflib to internal/difflib.

@dolmen You closed this PR 3 weeks ago. What do you mean?