fabric8-services/fabric8-wit, goadesign/goa and satori/go.uuid

[jiekang]

f8-wit depends on goadesign/goa, specifying version 1.3.0
f8-wit depends on satori/go.uuid, specifying version 1.2.0

goa, unfortunately, also depends on satori/go.uuid but does not specify a version, instead using go get and grabbing the latest commit in the master branch.

I would like to update goa to version 1.4.0 which contains some fixes I have submitted to use for a websockets events api. However, goa version 1.4.0 also includes changes to support the latest commit in satori/go.uuid rather than it's last release tag, 1.2.0.

satori/go.uuid has breaking changes in the latest commits after the last release tag (1.2.0) in master branch, that also introduce a critical bug [1], TLDR: uuid's are not entirely random. As well the repository seems to no longer be maintained [2]. There are a number of forks of satori/go.uuid that various users have made, with differing changes. As well, it looks like the issue with satori/go.uuid in goa v1 has been closed as won't fix [3].

With this knowledge, I do not think an upgrade for goa to version 1.4.0 is possible. I would like to continue my work for the websockets events api by introducing a local copy of the single function I need [4] that is compatible with goa: 1.3.0. Thoughts? Are there any alternative paths that aren't very long term?

[1] satori/go.uuid#73
[2] satori/go.uuid#83
[3] goadesign/goa#1810
[4] https://github.com/goadesign/goa/blob/v1/middleware/security/jwt/jwt.go#L58

[joshuawilson]

@aslakknutsen @alexeykazakov do you want to close this since no one answered him?

[jiekang]

I have opened issues in the OSIO planner to track this better following discussions with Aslak that I did not document here. Sorry for the confusion. I think this can be closed.