Evaluate alternative static file embedder

[fabxc]

The tool we use to embed assets into the binary has issues around timestamping. That's the reason why we don't always trigger it on build (commit pollution), which often leads to it being forgotten on actual changes.

https://github.com/rakyll/statik might be an alternative.

[tamalsaha]

Hi,
One way to fix this timestamp issue with go-bindata is to set a fixed timestamp. That's how we solved this issue in our codedbase;

go-bindata -ignore=\\.go -ignore=\\.DS_Store -mode=0644 -modtime=1453795200 -o pkg/templates/bindata.go -pkg templates pkg/templates/...

[fabxc]

Interesting. But I'm assuming that this timestamp is used in HTTP header fields, which in return are used to do cache invalidation in the browser so users actually see changes happening.

[tamalsaha]

I see. In our usecase w don't serve them from via HTTP. So, it was not an issue. go-bindata sets this timestamp from the actual file timestamp. So, sounds like you want to have the timestamp.

[agaoglu]

I tried statik and can confirm it also uses modification-date from filesystem so it has the same "issue". touch any file and generated file will change. In contrast same http cache invalidation will happen on plain files sitting in filesystem served with nginx for example.

go-bintool fixed timestamp parameter generated from the last commit timestamp on web/ui/static might be viable idea. But i'm not sure if that's possible in build environment.

[agaoglu]

A related improvement was proposed to bindata but seems dismissed without any progress. https://github.com/jteeuwen/go-bindata/issues/120

[knweiss]

Also, go-bindata was abandoned in February 2018 and there are now lots of forks with no designated successor (AFAICS). The (incomplete) history can be found here. Lots of projects are evaluating the situation and are looking for an alternative or started to vendor go-bindata (e.g. Kubernetes).

BTW: Currently, go-bindata is not vendored in Prometheus. Instead the Makefile go gets it on demand. This could be dangerous if the upstream project really gets backdoored.

FWIW: Yesterday, I was searching for a designated successor to go-bindata (for a private project) and found this interesting article: Choosing A Library to Embed Static Assets in Go. It evaluates alternatives with some additional features:

• Compression
• Optional Decompression
• Loading from the local File System
• Reproducible Builds
• Config File
• http.FileSystem interface

[brian-brazil]

Thanks for the information, that bumps the priority. If someone could help with this that'd be great, we've struggled with getting this right a fair bit over the years.

[simonpasquier]

Head-up: I'm looking into it right now and https://github.com/shurcooL/vfsgen looks promising.

[lock]

This thread has been automatically locked since there has not been any recent activity after it was closed. Please open a new issue for related bugs.