Dependency on go-cose version that does not exist. #2162

Activity

1. lktoken commented on Jul 17, 2024

   

   lktoken (lktoken)

   on Jul 17, 2024

   More actions

   Can someone explain this?
2. lingdie commented on Jul 31, 2024

   

   yy (lingdie)

   on Jul 31, 2024

   More actions

   Can someone explain this?
3. andrew-lawson-tumelo commented on Sep 2, 2024

   

   Andrew (andrew-lawson-tumelo)

   on Sep 2, 2024

   Last edited by andrew-lawson-tumelo

   Author

   More actions

   To explain;
   I think go-cose retracted a published version since the last version of hcsshim was published.

   It plays havoc with our internal build process, in that we are unable to allow "go mod" and "tidy" to run without explicitly pinning specific dependencies, which is never best practice, especially if there are other third-party libraries in the mix.

   When building and fetching dependencies everything blows up with an unresolved dependency on go-cose v1.2.0 because the go.mod for hcsshim specifies go-cose v1.2.0 as a dependency. The dependency resolution step of the go build process attempts to go and download this specific go-cose version and fails because it doesn't exist.

   Ideally, the fix here would be for the maintainers of hcsshim to update the go.mod to reference an active "published" version of go-cose (followed by a run of "go mod tidy" to ensure that the go.sum file is present and correct).

   Hopefully, that makes a bit more sense. Sorry for my original cryptic message.

   👍React with 👍1Reacted by lktoken
4. stlaz commented on Sep 25, 2024

   

   Standa Láznička (stlaz)

   on Sep 25, 2024

   More actions

   Please note that this now also breaks Kubernetes vendoring in stricter environments (i.e. with GOPROXY=direct).

   It'd be great if you could make a stable release with the vendor fixed.
5. Harsh Rawat (rawahars)

   assigned

   Copilot

   and

   Harsh Rawat (rawahars)

   on May 26, 2026
6. Copilot

   linked a pull request that will close this issueInvestigate retracted go-cose v1.2.0 dependency #2756on May 26, 2026
7. rawahars commented on May 26, 2026

   

   Harsh Rawat (rawahars)

   on May 26, 2026

   Contributor

   More actions

   The issue reported that the indirect dependency github.com/veraison/go-cose@v1.2.0 (at commit 8beabac) was unresolvable because the upstream maintainers retracted it (veraison/go-cose#153), and suggested downgrading to v1.1.0.

   Findings

   No code changes required — the dependency has already been moved past the retracted version on main:

   • go.mod, test/go.mod, and vendor/modules.txt all pin github.com/veraison/go-cose v1.3.0.
   • v1.3.0 exists on the module proxy and its own go.mod carries retract directives for v1.2.0 ("published in error") and v1.2.1, so Go tooling will never re-select the broken versions transitively.
   • Upgrading to v1.3.0 is preferable to the v1.1.0 downgrade suggested in the issue.

   The issue can be closed as resolved.
8. Harsh Rawat (rawahars)

   closed this as completedon May 26, 2026