chore: remove dep on go-funk and go-password

go.mod

@@ -1,8 +1,6 @@
 module github.com/cidverse/cid
 
-go 1.22
-
-toolchain go1.22.2
+go 1.21
 
 require (
 	github.com/ProtonMail/gopenpgp/v2 v2.7.5
@@ -31,10 +29,8 @@ require (
 	github.com/oriser/regroup v0.0.0-20230527212431-1b00c9bdbc5b
 	github.com/rs/zerolog v1.32.0
 	github.com/samber/lo v1.39.0
-	github.com/sethvargo/go-password v0.3.0
 	github.com/spf13/cobra v1.8.0
 	github.com/stretchr/testify v1.9.0
-	github.com/thoas/go-funk v0.9.3
 	gopkg.in/yaml.v3 v3.0.1
 	oras.land/oras-go/v2 v2.5.0
 )

go.sum

@@ -183,8 +183,6 @@ github.com/secure-systems-lab/go-securesystemslib v0.8.0 h1:mr5An6X45Kb2nddcFlbm
 github.com/secure-systems-lab/go-securesystemslib v0.8.0/go.mod h1:UH2VZVuJfCYR8WgMlCU1uFsOUU+KeyrTWcSS73NBOzU=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3 h1:n661drycOFuPLCN3Uc8sB6B/s6Z4t2xvBgU1htSHuq8=
 github.com/sergi/go-diff v1.3.2-0.20230802210424-5b0b94c5c0d3/go.mod h1:A0bzQcvG0E7Rwjx0REVgAGH58e96+X0MeOfepqsbeW4=
-github.com/sethvargo/go-password v0.3.0 h1:OLFHZ91Z7NiNP3dnaPxLxCDXlb6TBuxFzMvv6bu+Ptw=
-github.com/sethvargo/go-password v0.3.0/go.mod h1:p6we8DZ0eyYXof9pon7Cqrw98N4KTaYiadDml1dUEEw=
 github.com/shibumi/go-pathspec v1.3.0 h1:QUyMZhFo0Md5B8zV8x2tesohbb5kfbpTi9rBnKh5dkI=
 github.com/shibumi/go-pathspec v1.3.0/go.mod h1:Xutfslp817l2I1cZvgcfeMQJG5QnU2lh5tVaaMCl3jE=
 github.com/sirupsen/logrus v1.7.0/go.mod h1:yWOB1SBYBC5VeMP7gHvWumXLIWorT60ONWic61uBYv0=
@@ -211,8 +209,6 @@ github.com/stretchr/testify v1.8.1/go.mod h1:w2LPCIKwWwSfY2zedu0+kehJoqGctiVI29o
 github.com/stretchr/testify v1.8.4/go.mod h1:sz/lmYIOXD/1dqDmKjjqLyZ2RngseejIcXlSw2iwfAo=
 github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
 github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
-github.com/thoas/go-funk v0.9.3 h1:7+nAEx3kn5ZJcnDm2Bh23N2yOtweO14bi//dvRtgLpw=
-github.com/thoas/go-funk v0.9.3/go.mod h1:+IWnUfUmFO1+WVYQWQtIJHeRRdaIyyYglZN7xzUPe4Q=
 github.com/valyala/bytebufferpool v1.0.0 h1:GqA5TC/0021Y/b9FG4Oi9Mr3q7XYx6KllzawFIhcdPw=
 github.com/valyala/bytebufferpool v1.0.0/go.mod h1:6bBcMArwyJ5K/AmCkWv1jt77kVWyCJ6HpOuEn7z0Csc=
 github.com/valyala/fasttemplate v1.2.2 h1:lxLXG0uE3Qnshl9QyaK6XJxMXlQZELvChBOCmQD0Loo=

pkg/cmd/info.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"fmt"
+	"slices"
 	"strings"
 
 	"github.com/cidverse/cid/pkg/app"
@@ -12,7 +13,6 @@ import (
 	"github.com/cidverse/repoanalyzer/analyzerapi"
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/cobra"
-	"github.com/thoas/go-funk"
 	"gopkg.in/yaml.v3"
 )
 
@@ -52,10 +52,10 @@ var infoCmd = &cobra.Command{
 
 		// detect project modules
 		for _, module := range analyzer.ScanDirectory(projectDir) {
-			if funk.Contains(excludes, "dep") {
+			if slices.Contains(excludes, "dep") {
 				module.Dependencies = nil
 			}
-			if funk.Contains(excludes, "files") {
+			if slices.Contains(excludes, "files") {
 				module.Files = nil
 				module.FilesByExtension = nil
 			}
@@ -87,7 +87,7 @@ var infoCmd = &cobra.Command{
 			api.AutoProtectValues(key, value, value)
 			response.Environment[key] = value
 		}
-		if funk.Contains(excludes, "hostenv") {
+		if slices.Contains(excludes, "hostenv") {
 			for key := range env {
 				if !strings.HasPrefix(key, "NCI") {
 					delete(response.Environment, key)

pkg/cmd/root.go

@@ -2,6 +2,7 @@ package cmd
 
 import (
 	"os"
+	"slices"
 	"strings"
 	"sync"
 
@@ -10,7 +11,6 @@ import (
 	"github.com/rs/zerolog"
 	"github.com/rs/zerolog/log"
 	"github.com/spf13/cobra"
-	"github.com/thoas/go-funk"
 )
 
 var (
@@ -35,7 +35,7 @@ var rootCmd = &cobra.Command{
 	Long:  `cid is a cli to run pipeline actions locally and as part of your ci/cd process`,
 	PersistentPreRun: func(cmd *cobra.Command, args []string) {
 		// log format
-		if !funk.ContainsString(validLogFormats, cfg.LogFormat) {
+		if !slices.Contains(validLogFormats, cfg.LogFormat) {
 			log.Error().Str("current", cfg.LogFormat).Strs("valid", validLogFormats).Msg("invalid log format specified")
 			os.Exit(1)
 		}
@@ -57,7 +57,7 @@ var rootCmd = &cobra.Command{
 		zerolog.TimeFieldFormat = zerolog.TimeFormatUnix
 
 		// log level
-		if !funk.ContainsString(validLogLevels, cfg.LogLevel) {
+		if !slices.Contains(validLogLevels, cfg.LogLevel) {
 			log.Error().Str("current", cfg.LogLevel).Strs("valid", validLogLevels).Msg("invalid log level specified")
 			os.Exit(1)
 		}

pkg/common/workflowrun/workflow.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"path/filepath"
+	"slices"
 	"strings"
 	"time"
 
@@ -18,7 +19,6 @@ import (
 	"github.com/cidverse/cid/pkg/core/config"
 	"github.com/cidverse/cid/pkg/core/rules"
 	"github.com/rs/zerolog/log"
-	"github.com/thoas/go-funk"
 	"gopkg.in/yaml.v3"
 )
 
@@ -84,7 +84,7 @@ func RunWorkflow(cfg *config.CIDConfig, wf *catalog.Workflow, env map[string]str
 
 	if rules.AnyRuleMatches(wf.Rules, ruleContext) {
 		for i := range wf.Stages {
-			if len(stagesFilter) == 0 || funk.Contains(stagesFilter, wf.Stages[i].Name) {
+			if len(stagesFilter) == 0 || slices.Contains(stagesFilter, wf.Stages[i].Name) {
 				RunWorkflowStage(cfg, &wf.Stages[i], env, projectDir, modulesFilter)
 			} else {
 				log.Debug().Str("workflow", wf.Name).Str("stage", wf.Stages[i].Name).Strs("filter", stagesFilter).Msg("stage has been skipped")
@@ -149,7 +149,7 @@ func RunWorkflowAction(cfg *config.CIDConfig, action *catalog.WorkflowAction, en
 			ctx.CurrentModule = &moduleRef
 
 			// check module filter
-			if len(modulesFilter) > 0 && !funk.Contains(modulesFilter, moduleRef.Name) {
+			if len(modulesFilter) > 0 && !slices.Contains(modulesFilter, moduleRef.Name) {
 				log.Trace().Str("action", action.ID).Str("module", moduleRef.Slug).Strs("filter", modulesFilter).Msg("action skipped by module filter")
 				continue
 			}

pkg/core/actionexecutor/containeraction/containerexecutor.go

@@ -51,7 +51,7 @@ func (e Executor) Execute(ctx *commonapi.ActionExecutionContext, localState *sta
 	apiPort := strconv.Itoa(freePort)
 
 	// properties
-	secret := generateSecret()
+	secret := generateSecret(32)
 	buildID := generateSnowflakeId()
 	jobID := generateSnowflakeId()
 

pkg/core/actionexecutor/containeraction/util.go

@@ -1,12 +1,12 @@
 package containeraction
 
 import (
+	"crypto/rand"
+	"math/big"
 	"strings"
 
 	"github.com/bwmarrin/snowflake"
 	"github.com/cidverse/cid/pkg/core/catalog"
-	"github.com/rs/zerolog/log"
-	"github.com/sethvargo/go-password/password"
 )
 
 func insertCommandVariables(input string, action catalog.Action) string {
@@ -15,24 +15,21 @@ func insertCommandVariables(input string, action catalog.Action) string {
 	return input
 }
 
-func generateSecret() string {
-	generator, err := password.NewGenerator(&password.GeneratorInput{
-		LowerLetters: "abcdefghijklmnopqrstuvwxyz",
-		UpperLetters: "ABCDEFGHIJKLMNOPQRSTUVWXYZ",
-		Digits:       "0123456789",
-		Symbols:      "~#^*()_+-=|[]<>,./",
-		Reader:       nil,
-	})
-	if err != nil {
-		log.Fatal().Msg("failed to generate secret")
-	}
+var allowedChars = "abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789~#^*()_+-=|[]<>,./"
+
+func generateSecret(passwordLength int) string {
+	password := make([]byte, passwordLength)
+	allowedCharCount := big.NewInt(int64(len(allowedChars)))
 
-	secret, err := generator.Generate(32, 10, 10, false, false)
-	if err != nil {
-		log.Fatal().Msg("failed to generate secret")
+	for i := range password {
+		randomIndex, err := rand.Int(rand.Reader, allowedCharCount)
+		if err != nil {
+			panic(err)
+		}
+		password[i] = allowedChars[randomIndex.Int64()]
 	}
 
-	return secret
+	return string(password)
 }
 
 func generateSnowflakeId() string {

pkg/core/config/lookup.go

@@ -5,14 +5,14 @@ import (
 	"os/exec"
 	"path/filepath"
 	"runtime"
+	"slices"
 	"sort"
 
 	"github.com/cidverse/cid/pkg/core/catalog"
 	"github.com/cidverse/cidverseutils/filesystem"
 	"github.com/cidverse/cidverseutils/version"
 	"github.com/cidverse/normalizeci/pkg/normalizer/api"
 	"github.com/rs/zerolog/log"
-	"github.com/thoas/go-funk"
 )
 
 type ExecutionType string
@@ -64,7 +64,7 @@ func (c *CIDConfig) FindExecutionCandidates(binary string, constraint string, pr
 	// container
 	for _, entry := range c.Registry.ContainerImages {
 		for _, provided := range entry.Provides {
-			if binary == provided.Binary || funk.Contains(provided.Alias, binary) {
+			if binary == provided.Binary || slices.Contains(provided.Alias, binary) {
 				log.Trace().Str("version", provided.Version).Str("constraint", constraint).Str("binary", binary).Str("image", entry.Image).Msg("checking version constraint")
 				if version.FulfillsConstraint(provided.Version, constraint) {
 					options = append(options, BinaryExecutionCandidate{
@@ -86,7 +86,7 @@ func (c *CIDConfig) FindExecutionCandidates(binary string, constraint string, pr
 	// exec
 	env := api.GetMachineEnvironment()
 	for _, entry := range c.LocalTools {
-		if funk.Contains(entry.Binary, binary) {
+		if slices.Contains(entry.Binary, binary) {
 			for _, lookup := range entry.Lookup {
 				// special case - PATH
 				if lookup.Key == "PATH" {
@@ -169,7 +169,7 @@ func (c *CIDConfig) FindImageOfBinary(binary string, constraint string) *catalog
 	// lookup
 	for _, entry := range c.Registry.ContainerImages {
 		for _, provided := range entry.Provides {
-			if binary == provided.Binary || funk.Contains(provided.Alias, binary) {
+			if binary == provided.Binary || slices.Contains(provided.Alias, binary) {
 				log.Trace().Str("version", provided.Version).Str("constraint", constraint).Str("binary", binary).Str("image", entry.Image).Msg("checking version constraint")
 				if version.FulfillsConstraint(provided.Version, constraint) {
 					return &entry
@@ -186,7 +186,7 @@ func (c *CIDConfig) FindPathOfBinary(binary string, constraint string) *ToolLoca
 	// lookup
 	env := api.GetMachineEnvironment()
 	for _, entry := range c.LocalTools {
-		if funk.Contains(entry.Binary, binary) {
+		if slices.Contains(entry.Binary, binary) {
 			for _, lookup := range entry.Lookup {
 				// special case - PATH
 				if lookup.Key == "PATH" {

pkg/core/restapi/artifact.go

@@ -9,6 +9,7 @@ import (
 	"os"
 	"path"
 	"path/filepath"
+	"slices"
 	"strconv"
 	"strings"
 
@@ -21,7 +22,6 @@ import (
 	"github.com/in-toto/in-toto-golang/in_toto/slsa_provenance/v1"
 	"github.com/labstack/echo/v4"
 	"github.com/rs/zerolog/log"
-	"github.com/thoas/go-funk"
 )
 
 // artifactList lists all generated reports
@@ -81,7 +81,7 @@ func (hc *APIConfig) artifactUpload(c echo.Context) error {
 	}
 
 	// generate build provenance?
-	if funk.Contains(provenance.FileTypes, fileType) {
+	if slices.Contains(provenance.FileTypes, fileType) {
 		log.Info().Str("artifact", file.Filename).Str("type", fileType).Msg("generating provenance for artifact")
 		prov := provenance.GenerateInTotoPredicate(file.Filename, fileHash, hc.Env, hc.State)