Skip to content

fix: eliminate usage of text/template#2288

Merged
Hayden-IO merged 1 commit into
sigstore:mainfrom
smira:fix/eliminate-template
Mar 4, 2026
Merged

fix: eliminate usage of text/template#2288
Hayden-IO merged 1 commit into
sigstore:mainfrom
smira:fix/eliminate-template

Conversation

@smira

@smira smira commented Mar 2, 2026

Copy link
Copy Markdown
Contributor

Any usage of text/template blocks deadcode elimination in Go linker.

This packages gets transitively imported when using cosign package:

This shows up as:

0.050 Dead code elimination problem found:
0.052 text/template.(*state).evalField reachable from:
0.052    text/template.(*state).evalFieldChain
0.052    text/template.(*state).evalCommand
0.052    text/template.(*state).evalPipeline
0.052    text/template.(*state).walk
0.052    text/template.(*Template).execute
0.052    github.com/sigstore/sigstore/pkg/oauth.GetInteractiveSuccessHTML
0.052    github.com/sigstore/sigstore/pkg/oauthflow.init.0
0.052    github.com/sigstore/sigstore/pkg/oauthflow..inittask
0.052    go:main.inittasks
0.052    _

Summary

Fix deadcode elimination issue.

Release Note

None.

Documentation

None

@smira
fix: eliminate usage of text/template
a53c72f 
Any usage of `text/template` blocks deadcode elimination in Go linker.

This packages gets transitively imported when using `cosign` package:

* https://github.com/sigstore/sigstore/blob/1d8faff85795ce7679df89a6d78afcc0b0185aa9/pkg/oauthflow/flow.go#L50-L60
* https://github.com/sigstore/sigstore-go/blob/d276dc85c9fd79a96f27753d0aab5ad1bad7d198/pkg/sign/certificate.go#L33-L34
* https://github.com/sigstore/cosign/blob/8bce2dc8bb70efad54a9221612e2208ec615c6fc/pkg/cosign/bundle/sign.go#L28-L29

This shows up as:

```
0.050 Dead code elimination problem found:
0.052 text/template.(*state).evalField reachable from:
0.052    text/template.(*state).evalFieldChain
0.052    text/template.(*state).evalCommand
0.052    text/template.(*state).evalPipeline
0.052    text/template.(*state).walk
0.052    text/template.(*Template).execute
0.052    github.com/sigstore/sigstore/pkg/oauth.GetInteractiveSuccessHTML
0.052    github.com/sigstore/sigstore/pkg/oauthflow.init.0
0.052    github.com/sigstore/sigstore/pkg/oauthflow..inittask
0.052    go:main.inittasks
0.052    _
```

Signed-off-by: Andrey Smirnov <andrey.smirnov@siderolabs.com>
@smira smira requested a review from a team as a code owner March 2, 2026 15:28
Hayden-IO
Hayden-IO reviewed Mar 2, 2026
View reviewed changes

@Hayden-IO Hayden-IO left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not following the issue, how is this dead code?

@smira

smira commented Mar 2, 2026

Copy link
Copy Markdown
Contributor Author

I'm not following the issue, how is this dead code?

This is not dead code itself of course.

Go has a feature (as part of the linker) which is called dead code elimination which reduces binary size a lot when you have lots of heavy dependencies (e.g. Kubernetes API client), while you use only part of it.

For the deadcode elimination to be enabled, we need avoid calls to Go reflect package, specifically MethodByName with non-constant arguments.

So text/template whenever it gets imported, basically disables dedcode elimination, as long as the code which touches is reachable.

In this case what I (as a developer) want to do is to verify an image signature with cosign as a library. I import it as a library, and through the import path I highlighted above (via init()) functions it unconditionally runs text/template which disables DCE for my whole program.

There are many ways it can be resolved, but this PR is one of them - just get rid of text/template completely.
Another option is to avoid the import chain with leads into the oauth package, but I guess this would be breaking the API, so I tried to avoid it for my change, but you might decide to take a different path if you don't like the proposed change.

@Hayden-IO

Hayden-IO commented Mar 4, 2026

Copy link
Copy Markdown
Contributor

@smira Thanks for the detailed explanation, TIL about the linker and dead code elimination!

@Hayden-IO Hayden-IO merged commit b56c866 into sigstore:main Mar 4, 2026
15 checks passed
This was referenced May 2, 2026
Closed
Merged
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@Hayden-IO Hayden-IO Hayden-IO approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@smira @Hayden-IO