Remove github.com/otiai10/copy dependency

[alexandear]

This PR replaces usage of copy.Copy with hand-written copyDir function. It's not worth keeping this dependency used only in tests.

Yeah, copyDir is not ideal, and copy.Copy is much more powerful and covers many of OS's corner cases, but for tests it's good. In the future, we can return this dependency if copy.Copy will be needed for the prod code.

[rhatdan]

LGTM
@mtrmac PTAL

[mtrmac]

Thanks!

I don’t feel strongly about the change itself.

It’s just… This is a unit test. It does not show up in any dependency of c/image. So why is it important to trim dependencies? To me, adding and reviewing extra ~55 lines of code for no end-user benefit seems like a bad trade. So what am I missing? Are there any negative effects of that dependency I don’t know about, which would also apply to other dependencies in the future?

[alexandear]

@mtrmac The README indeed categorizes containers/image as "image is a set of Go libraries", implying its main purpose is to be imported by users. Each time a user imports the package, it automatically imports its dependencies. This reduces download speed and increases the user's application dependency list. To maintain efficient use and management, it's critical to keep a minimal list of dependencies.

Adding to this, having fewer dependencies enhances the overall control we have on the application. Reviewing and adding 55 lines of code is a one-time task. But every extra dependency is an added layer of complexity, potential security risk, and another component that should be maintained and kept updated. We are simplifying the application maintenance process by trimming down dependencies, just as Rob Pike mentioned about keeping the dependency tree small (check video).

https://medium.com/@cep21/aspects-of-a-good-go-library-7082beabb403

[mtrmac]

Each time a user imports the package, it automatically imports its dependencies.

I mean…

% cat foo.go 
package foo

import "github.com/containers/image/v5/oci/layout"

func main() {
  _ = layout.Transport
}
% go mod tidy && go mod vendor
% grep -lr 10/copy
./go.sum

Test-only dependencies don’t really “infect” the consumer.

[mtrmac]

The recent commits need to follow https://github.com/containers/image/blob/main/CONTRIBUTING.md#sign-your-prs .

(And eventually, please squash them into one.)

[alexandear]

Actually, you're right. Test dependencies won't inflect customer since Go 1.18. Found this change
https://go-review.googlesource.com/c/go/+/357310/

Closing PR.