Switch to v2 development

There is already a v1 release published to pkg.dev. This was premature
as a number of breaking changes to the API are still planned. The
underlying spec is still in development with regular drafts being
released. This code is going to change tracking the changes in the spec,
as well as likely making non-spec changes to the API as they slowly
mature.

In order to stay compliant with golang [versioning
workflow](https://go.dev/doc/modules/release-workflow), development is
witching over to v2, so that v1 can remain stable.

(note: the first full v2 release is expected to align with the
final publication of the CoRIM spec, and so will not happen for some
time. In the mean time, "release candidates" will be published to
provided milestone references for dependents)

Signed-off-by: Sergei Trofimov <[email protected]>

Makefile

@@ -4,10 +4,10 @@ SHELL := /bin/bash
 
 GO111MODULE := on
 
-GOPKG := github.com/veraison/corim/corim
-GOPKG += github.com/veraison/corim/comid
-GOPKG += github.com/veraison/corim/cots
-GOPKG += github.com/veraison/corim/cocli/cmd
+GOPKG := github.com/veraison/corim/v2/corim
+GOPKG += github.com/veraison/corim/v2/comid
+GOPKG += github.com/veraison/corim/v2/cots
+GOPKG += github.com/veraison/corim/v2/cocli/cmd
 
 MOCKGEN := $(shell go env GOPATH)/bin/mockgen
 INTERFACES := cocli/cmd/isubmitter.go

README.md

@@ -6,6 +6,11 @@
 
 The [`corim/corim`](corim) and [`corim/comid`](comid) packages provide a golang API for low-level manipulation of [Concise Reference Integrity Manifest (CoRIM)](https://datatracker.ietf.org/doc/draft-birkholz-rats-corim/) and Concise Module Identifier (CoMID) tags respectively.
 
+> [!NOTE]
+> These API are still in active development (as is the underlying CoRIM spec).
+> They are **subject to change** going forward, and should not be considered
+> stable at this time.
+
 The [`corim/cocli`](cocli) package uses the API above (as well as the API from [`veraison/swid`](https://github.com/veraison/swid) package) to provide a user friendly command line interface for working with CoRIM, CoMID, CoSWID and CoTS.  Specifically it allows creating, signing, verifying, displaying, uploading, and more.  See [`cocli/README.md`](cocli/README.md) for further details.
 
 ## Developer tips

cocli/cmd/comidCreate.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 var (

cocli/cmd/comidCreate_test.go

@@ -9,7 +9,7 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 func Test_ComidCreateCmd_unknown_argument(t *testing.T) {

cocli/cmd/comidValidate.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 var (

cocli/cmd/common.go

@@ -10,8 +10,8 @@ import (
 	"strings"
 
 	"github.com/spf13/afero"
-	"github.com/veraison/corim/comid"
-	"github.com/veraison/corim/cots"
+	"github.com/veraison/corim/v2/comid"
+	"github.com/veraison/corim/v2/cots"
 	"github.com/veraison/swid"
 )
 

cocli/cmd/corimCreate.go

@@ -9,9 +9,9 @@ import (
 
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
-	"github.com/veraison/corim/comid"
-	"github.com/veraison/corim/corim"
-	"github.com/veraison/corim/cots"
+	"github.com/veraison/corim/v2/comid"
+	"github.com/veraison/corim/v2/corim"
+	"github.com/veraison/corim/v2/cots"
 	"github.com/veraison/swid"
 )
 

cocli/cmd/corimDisplay.go

@@ -11,8 +11,8 @@ import (
 
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
-	"github.com/veraison/corim/corim"
-	"github.com/veraison/corim/cots"
+	"github.com/veraison/corim/v2/corim"
+	"github.com/veraison/corim/v2/cots"
 )
 
 var (

cocli/cmd/corimExtract.go

@@ -11,8 +11,8 @@ import (
 
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
-	"github.com/veraison/corim/corim"
-	"github.com/veraison/corim/cots"
+	"github.com/veraison/corim/v2/corim"
+	"github.com/veraison/corim/v2/cots"
 )
 
 var (

cocli/cmd/corimSign.go

@@ -9,7 +9,7 @@ import (
 
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
-	"github.com/veraison/corim/corim"
+	"github.com/veraison/corim/v2/corim"
 	cose "github.com/veraison/go-cose"
 )
 

cocli/cmd/corimSubmit_test.go

@@ -8,7 +8,7 @@ import (
 	"github.com/spf13/afero"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	mock_deps "github.com/veraison/corim/cocli/cmd/mocks"
+	mock_deps "github.com/veraison/corim/v2/cocli/cmd/mocks"
 )
 
 func Test_CorimSubmitCmd_bad_server_url(t *testing.T) {

cocli/cmd/corimVerify.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
-	"github.com/veraison/corim/corim"
+	"github.com/veraison/corim/v2/corim"
 )
 
 var (

cocli/cmd/cotsCreate.go

@@ -11,7 +11,7 @@ import (
 	"github.com/google/uuid"
 	"github.com/spf13/afero"
 	"github.com/spf13/cobra"
-	"github.com/veraison/corim/cots"
+	"github.com/veraison/corim/v2/cots"
 )
 
 var (

cocli/cmd/test_vars.go

@@ -3,7 +3,7 @@
 
 package cmd
 
-import "github.com/veraison/corim/comid"
+import "github.com/veraison/corim/v2/comid"
 
 var (
 	minimalCorimTemplate = []byte(`{

cocli/main.go

@@ -4,7 +4,7 @@
 package main
 
 import (
-	"github.com/veraison/corim/cocli/cmd"
+	"github.com/veraison/corim/v2/cocli/cmd"
 )
 
 func main() {

corim/cbor.go

@@ -7,7 +7,7 @@ import (
 	"reflect"
 
 	cbor "github.com/fxamacker/cbor/v2"
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 var (

corim/entity.go

@@ -6,7 +6,7 @@ package corim
 import (
 	"fmt"
 
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 // Entity stores an entity-map capable of CBOR and JSON serializations.

corim/entity_test.go

@@ -8,7 +8,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 func TestEntity_Valid_uninitialized(t *testing.T) {

corim/meta.go

@@ -9,7 +9,7 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 type Signer struct {

corim/meta_test.go

@@ -10,7 +10,7 @@ import (
 
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 var (

corim/signedcorim.go

@@ -45,7 +45,7 @@ func (o *SignedCorim) processHdrs() error {
 
 	// TODO(tho) key id is apparently mandatory, which doesn't look right.
 	// TODO(tho) Check with the CoRIM design team.
-	// See https://github.com/veraison/corim/issues/14
+	// See https://github.com/veraison/corim/v2/issues/14
 
 	v, ok = hdr.Protected[HeaderLabelCorimMeta]
 	if !ok {

corim/unsignedcorim.go

@@ -9,9 +9,9 @@ import (
 	"fmt"
 	"time"
 
-	"github.com/veraison/corim/cots"
+	"github.com/veraison/corim/v2/cots"
 
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 	"github.com/veraison/eat"
 	"github.com/veraison/swid"
 )

corim/unsignedcorim_test.go

@@ -11,8 +11,8 @@ import (
 	"github.com/google/uuid"
 	"github.com/stretchr/testify/assert"
 	"github.com/stretchr/testify/require"
-	"github.com/veraison/corim/comid"
-	"github.com/veraison/corim/cots"
+	"github.com/veraison/corim/v2/comid"
+	"github.com/veraison/corim/v2/cots"
 	"github.com/veraison/swid"
 )
 

cots/cbor.go

@@ -7,7 +7,7 @@ import (
 	"reflect"
 
 	cbor "github.com/fxamacker/cbor/v2"
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 var (

cots/cots.go

@@ -8,7 +8,7 @@ import (
 	"errors"
 	"fmt"
 
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 	"github.com/veraison/swid"
 )
 

cots/cots_test.go

@@ -7,7 +7,7 @@ import (
 	"testing"
 
 	"github.com/stretchr/testify/assert"
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 func TestConciseTaStore_Valid_no_environment_groups(t *testing.T) {

cots/env_group.go

@@ -7,7 +7,7 @@ import (
 	"encoding/json"
 	"fmt"
 
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 )
 
 // EnvironmentGroup is the top-level representation of the unsigned-corim-map with

cots/env_group_test.go

@@ -6,7 +6,7 @@ package cots
 import (
 	"testing"
 
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 	"github.com/veraison/swid"
 
 	"github.com/stretchr/testify/assert"

cots/example_test.go

@@ -4,7 +4,7 @@ import (
 	"fmt"
 	"os"
 
-	"github.com/veraison/corim/comid"
+	"github.com/veraison/corim/v2/comid"
 	"github.com/veraison/swid"
 )
 

go.mod

@@ -1,4 +1,4 @@
-module github.com/veraison/corim
+module github.com/veraison/corim/v2
 
 go 1.18