Add a presubmit to restrict test only libraries from linking into prod binaries

[mikedanese]

We have many "test only" packages through out the project, containing fixtures, helpers, utilities, etc... These test libraries are not intended for use in production binaries. They often lack rigorous review and sufficient testing for use in production binaries. We should make sure they don't accidentally get pulled in.

Strawman proposal, test only packages must import "testing". Blank import is sufficient:

import (
  ...

  // Restrict to tests
  _ "testing"
)

Then write a presubmit that fails if we find testing.init symbol in the release binary.

$ go list -json ./cmd/kubectl | jq 'any(.Deps[]; . == "testing")'
true

This approach is trivial and fairly effective although a more sophisticated approach could print a dep chain.

[akshatdalton]

/assign

[akshatdalton]

I hope I will be able to contribute once this gets marked as triage/accepted.

[aojea]

/triage accepted

[aojea]

Then write a presubmit that fails if we find testing.init symbol in the release binary.

@mikedanese I think that will be enough a new hack\verify-testing-import.sh script or a check in the building scripts

/cc @BenTheElder since he has experience from the providerless building effort

[akshatdalton]

@mikedanese @aojea I got what we want to achieve here but I'm little confused about:

Then write a presubmit that fails if we find testing.init symbol in the release binary.

$ go list -json ./cmd/kubectl | jq 'any(.Deps[]; . == "testing")'
true

• how can I create a binary and search for testing.init?
• If I execute: go list -json ./cmd/kubectl | jq 'any(.Deps[]; . == "testing")' after adding the import _ "testing" then only it is giving true - what do we want to achieve by executing this command exactly? I got what it is doing.

I've opened a thread in slack as well: https://kubernetes.slack.com/archives/CDHA7K9L5/p1674680329897449

[vlasebian]

Hello! Is there anyone working on this issue at the moment? If not and the issue it's still relevant, I would like to work on it if possible. Thank you.

[vlasebian]

I opened a PR in the meantime, if it's not needed anymore, I can close it.