Details
-
Task
-
Resolution: Done
-
Major
-
None
-
0
Description
From the implementation of PROJQUAY-731 we now have these 3 Golang containers listed in the Product Security manifest automatically. However they are lacking version information for each Golang dependency, eg quay-bridge-operator manifest.
Instead of vendoring the dependencies into distgit we should use cachito to fetch the dependencies for us on demand. I tried this in a scratch build for quay-bridge-operator in the 3.4-rhel-8 branch and it does allow us to get version information for each dependency.