Bug 2091534

Summary:	Drop golang-github-BurntSushi-toml and golang-gopkg-yaml
Product:	Red Hat OpenStack	Reporter:	Miguel Garcia <mgarciac>
Component:	distribution	Assignee:	Miguel Garcia <mgarciac>
Status:	CLOSED CURRENTRELEASE	QA Contact:	Lon Hohberger <lhh>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	17.0 (Wallaby)	CC:	jjoyce, jschluet, lhh, mburns, mgarciac, rhos-maint, shrjoshi
Target Milestone:	z10	Keywords:	Triaged
Target Release:	16.1 (Train on RHEL 8.2)
Hardware:	Unspecified
OS:	Unspecified
Whiteboard:
Fixed In Version:	golang-github-urfave-cli-1.20.0-6.el8ost	Doc Type:	If docs needed, set a value
Doc Text:		Story Points:	---
Clone Of:	2091533	Environment:
Last Closed:	2024-09-18 19:25:09 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	2091532, 2091533
Bug Blocks:

Description Miguel Garcia 2022-05-30 08:59:26 UTC

+++ This bug was initially created as a clone of Bug #2091533 +++

+++ This bug was initially created as a clone of Bug #2091532 +++

golang-github-BurntSushi-toml and golang-gopkg-yaml were originally added as dependencies of golang-github-urfave-cli, which was added as a dependency of golang-github-vbatts-tar-split.

tar-split doesn't use the toml/yaml functionalities from urfave-cli, and those are very easily severable from the latter.

Patching toml/yaml out allows us to remove both packages, reducing our dependencies and our CVE attack surface.

--- Additional comment from RHEL Program Management on 2022-05-30 08:58:10 UTC ---

This item has been properly Triaged and planned for the release, and Target Release is now set to match the release flag. For details, see https://mojo.redhat.com/docs/DOC-1195410

Comment 3 Lon Hohberger 2024-09-18 19:25:09 UTC

Red Hat OpenStack Platform 16.1 was retired on April 30, 2024. This issue has been resolved in a later release.