Internalize more dependencies

[ericchiang]

This package has several external imports. Namely

• github.com/pquerna/cachecontrol
• golang.org/x/net/context (*: use std library's context package #135)
• gopkg.in/square/go-jose.v2
• golang.org/x/oauth2

As we move forward we might try to internalize some of these dependencies. E.g. context is now part of the standard library, and we might try to see if we can implement some of the cachecontrol package internally.

cc @dghubble

[dghubble]

This would make adding a go-oidc dependency more alluring. 👍

[ericchiang]

Random musing.

The OpenID Connect spec indicates that the Cache-Control: max-age header is the only really supported mechanism for caching. This might be easy to implement instead of using the full cachecontrol package, which interprets way more headers.

https://openid.net/specs/openid-connect-core-1_0.html#RotateEncKeys

I think golang.org/x/oauth2 is here forever, since it's exposed as part of the API.

I don't have a good answer about gopkg.in/square/go-jose.v2. I really don't want to implement a JWT library.

[ericchiang]

I think this would be a good effort for any v3 branch. Remove the oauth2 and cachecontrol imports. No other API changes.

[jackmcguire1]

bump, I don't need to download the google dependencies used in the example...

[ericchiang]

So realistically this would require a new major version of the package to drop the oauth2 import. The cachecontrol change would also probably be significant.

I'm totally fine with a v3, but I'd want to figure out the modules story.

[jackmcguire1]

I’m fine with any of those packages imo as it’s core functionality this module relies on, I just don’t want the bundled google dependencies, remove the example to a separate repo...

[ericchiang]

What Google dependencies are you talking about?

…

On Fri, Aug 2, 2019, 12:22 AM Jack McGuire ***@***.***> wrote: I’m fine with any of those packages imo as it’s core functionality this module relies on, I just don’t want the bundled google dependencies, remove the example to a separate repo... — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#127?email_source=notifications&email_token=AAR36XK7OUBGU6QJT5QTJFLQCPOCFA5CNFSM4C4I5KD2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOD3M4IZA#issuecomment-517588068>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAR36XKP4JFCNKK4JFYSG5LQCPOCFANCNFSM4C4I5KDQ> .

[ericchiang]

cachecontrol import has been removed in #259 for v3.

I don't think we'll be able to remove gopkg.in/square/go-jose.v2 or golang.org/x/oauth2 so going to call this fixed.