spire go.mod points at non-main branch of spire-api-sdk

[zmt]

• Version: v1.9.6
• Platform: N/A
• Subsystem: server

I noticed that at least as far back as 1.8.11, the release branch of spire references commits not landed on main in spire-api-sdk. As a result, updates include potentially confusing pseudo-versions and risks deletion of non-main branches affecting spire. Fortunately, it appears to be the same code, just different commits.

In clone of spire repo:

% git diff v1.8.11..v1.9.6 -- go.mod | grep spire-api-sdk
-	github.com/spiffe/spire-api-sdk v1.2.5-0.20231107161112-ba57e0e943a2
+	github.com/spiffe/spire-api-sdk v1.2.5-0.20240301205221-967353a5c821

In clone of spire-api-sdk repo:

% git log --oneline v1.8.11..v1.9.6
a201a66 (HEAD -> main, tag: v1.9.6, tag: v1.10.0, origin/main, origin/HEAD) Add filters (#52)
2e20525 (tag: v1.9.5, tag: v1.9.4, tag: v1.9.3, tag: v1.9.2, origin/update-main-for-v1.9.2) Merge Log Level API work into the next branch (#57)
% git show -q --oneline v1.9.6
a201a66 (HEAD -> main, tag: v1.9.6, tag: v1.10.0, origin/main, origin/HEAD) Add filters (#52)
% git show -q --oneline v1.8.11
54e821e (tag: v1.9.1, tag: v1.9.0, tag: v1.8.9, tag: v1.8.8, tag: v1.8.7, tag: v1.8.11, tag: v1.8.10) New SyncAuthorizedEntries RPC (#49)
% git log --oneline ba57e0e943a2..967353a5c821
967353a Add filters (#52)
08f5a1a Merge Log Level API work into the next branch (#57)
% git branch -r --contains 967353a
  origin/azdagron/add-preferred-ttl   origin/next
% git branch -r --contains 08f5a1a
  origin/azdagron/add-preferred-ttl   origin/next

[evan2645]

@zmt I believe this is intentional? See #5235

[azdagron]

Yes, this is intentional. SPIRE always tracks a pseudo-version from the next branch in the SDK repos, so that we can develop new features in next without making them available to general SDK consumers . When we do a release, we pick over commits from next into main that are being lit up in that release.

Unfortunately, we do have a few changes made in main (superficial stuff mostly like docs) that didn't make their way into next that can make the diff noisy.

The add-preferred-ttl commit is not released yet (part of 1.10.1) so it is expected that it is only in next currently.

[azdagron]

This documentation might be helpful in understanding how the SDKs are released/tagged/used https://github.com/spiffe/spire/blob/main/RELEASING.md#sdk-releases.