Implement verify-vendor.sh in pure Go

[aep-sunlife]

Feature request checklist

• There are no issues that match the desired change
• The change is large enough it can't be addressed with a simple Pull Request
• If this is a bug, please file a Bug Report.

Change

Please rewrite the helper script verify-vendor.sh in pure Go, for the benefit of the Go community.

Shell scripts are inherently fragile and difficult to maintain compared to higher level languages. Migrating to Go simplifies the installation process. It increases portability. It increases reliability, enabling richer test suites.

[TristonianJones]

Hi @aep-sunlife, the script was contributed to the CEL repo, so I'm not sure what this would entail. Would this be related to go mod verify? Or did you have something else in mind?

[aep-sunlife]

Shell scripts tend to complicate things for Windows contributors and Windows users. But shell scripts can break UNIX environment as well, such as Alpine Linux and FreeBSD (bash is not the default shell there). Shell is harder to test, harder to guarantee portability, and harder to lint/SAST than general purpose programming languages like Go.

Even shellcheck, set... flags, and sticking to 100% POSIX tools and CLI flags are not sufficient to produce perfect shell scripts.

Go is Turing complete, capable of performing a wide variety of tasks without resorting to (inherently less portable) shell tricks.

Let's publish the same logic in pure Go code, such as an ordinary Go program.

[TristonianJones]

That's all well and good, but an example implementation that matches what you have in mind would be very helpful.