Building v0.47.0 fails - cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation

[verkaufer]

Preflight checklist

• I could not find a solution in the existing issues, docs, nor discussions.
• I agree to follow this project's Code of Conduct.
• I have read and am following this repository's Contribution Guidelines.
• I have joined the Ory Community Slack.
• I am signed up to the Ory Security Patch Newsletter.

Ory Network Project

No response

Describe the bug

I'm building a local OIDC provider and using BadgerDB as my storage for users and registered applications.

After adding BadgerDB v4.3.0 , the go build command fails with output suggesting ristretto.Config is not instantiated corrected.

Reproducing the bug

Create a go.mod with these dependencies:

require (
	github.com/dgraph-io/badger/v4 v4.3.0
	github.com/ory/fosite v0.47.0
)

Create a main.go that instantiates BadgerDB and ory/fosite:

Click to expand...

package main

import (

	"crypto/rand"
	"crypto/rsa"
	"time"

	"github.com/dgraph-io/badger/v4"
	"github.com/ory/fosite"
	"github.com/ory/fosite/compose"
	"github.com/ory/fosite/handler/openid"
	"github.com/ory/fosite/storage"
	"github.com/ory/fosite/token/jwt"

)

var (
	// TODO: read from env
	secret = []byte("some-cool-secret-that-is-32bytes")

	config = &fosite.Config{
		AccessTokenLifespan:         time.Minute * 30,
		IDTokenIssuer:               "https://foobar123456.com",
		EnforcePKCEForPublicClients: true,
	}

	// TODO replace with custom storage
	store         = storage.NewExampleStore()
	privateKey, _ = rsa.GenerateKey(rand.Reader, 2048)
)

// Build a fosite instance with all OAuth2 and OpenID Connect handlers enabled, plugging in our configurations as specified above.
var oauth2 = compose.ComposeAllEnabled(config, store, privateKey)

// A session is passed from the `/auth` to the `/token` endpoint. You probably want to store data like: "Who made the request",
func newSession(user string) *openid.DefaultSession {

	return &openid.DefaultSession{
		Claims: &jwt.IDTokenClaims{
			Subject:     user,
			Audience:    []string{"https://my-client.my-application.com"},
			ExpiresAt:   time.Now().Add(time.Hour * 6),
			IssuedAt:    time.Now(),
			RequestedAt: time.Now(),
			AuthTime:    time.Now(),
		},
		Headers: &jwt.Headers{
			Extra: make(map[string]interface{}),
		},
	}
}

func main() {

	db, err := badger.Open(badger.DefaultOptions("tmp/badger"))
	if err != nil {
		log.Fatal(err)
	}
	defer db.Close()

	session := newSession("foobar")
	fmt.Println(session.Subject)
}

Run go build

Relevant log output

# github.com/ory/fosite
../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:33:20: cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation
../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:40:33: cannot use generic type ristretto.Config[K z.Key, V any] without instantiation
../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:74:34: cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation

### Relevant configuration

_No response_

### Version

v0.47.0

### On which operating system are you observing this issue?

macOS

### In which environment are you deploying?

Other

### Additional Context

I tried using the `replace` directive but BadgerDB is incompatible with a lower version of `dgraph-io/ristretto` . 

Using `v0.1.1` caused compiler issues with BadgerDB.

[verkaufer]

It looks like v0.12.0 uses generics more heavily and the maintainers are aware?

[james-d-elliott]

Yeah this compatibility was broken here: dgraph-io/badger@8e08c43 without a v5 bump, I'd suggest downgrading to 4.2.x until the fix this breaking change.

The change doesn't need to happen at ristretto, but needs to occur at the implementation end. As ristretto is v0 the guarantee doesn't effectively exist, but the implementer needs (badger) to bump in this instance since the bump to this untagged version causes the breakage.

[aeneasr]

Upgrade Go please

[verkaufer]

Upgrade Go please

I'm running go 1.22.5. Is there a version you had in mind @aeneasr ?

The change doesn't need to happen at ristretto, but needs to occur at the implementation end. As ristretto is v0 the guarantee doesn't effectively exist, but the implementer needs (badger) to bump in this instance since the bump to this untagged version causes the breakage.

Agreed, this is an unfortunate combination of factors. Will discuss in this issue in the ristretto repo 👍

[ptman]

The API of ristretto changed from 0.1.1 -> 1.0.0. github.com/ory/[email protected] seems to have bumped ristretto

[mowtschan]

I am unsure why the issue has been closed, as it remains unresolved 😢 :

$ go get github.com/ory/x@latest
go: upgraded github.com/dgraph-io/ristretto v0.2.0 => v1.0.0
go: upgraded github.com/ory/x v0.0.662 => v0.0.674

$ go mod tidy
$ go build cmd/app/main.go
# github.com/ory/fosite
../../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:33:20: cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation
../../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:40:33: cannot use generic type ristretto.Config[K z.Key, V any] without instantiation
../../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:74:34: cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation

[ptman]

Because of the incompatibility, ristretto 1.0.0 has been retracted:

go: accepting indirect upgrade from github.com/dgraph-io/[email protected] to v1.0.0
go: warning: github.com/dgraph-io/[email protected]: retracted by module author: we retract v1.0.0 because v0.2.0 is not backwards compatible with v1.0.0.
go: to switch to the latest unretracted version, run:
	go get github.com/dgraph-io/ristretto@latest

[aeneasr]

I am unsure why the issue has been closed, as it remains unresolved 😢 :

$ go get github.com/ory/x@latest
go: upgraded github.com/dgraph-io/ristretto v0.2.0 => v1.0.0
go: upgraded github.com/ory/x v0.0.662 => v0.0.674

$ go mod tidy
$ go build cmd/app/main.go
# github.com/ory/fosite
../../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:33:20: cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation
../../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:40:33: cannot use generic type ristretto.Config[K z.Key, V any] without instantiation
../../../go/pkg/mod/github.com/ory/[email protected]/client_authentication_jwks_strategy.go:74:34: cannot use generic type ristretto.Cache[K z.Key, V any] without instantiation

I mean you're upgrading ory/x ? Just don't upgrade it?

The warning is just a warning, it doesn't break the build. You can ignore it. The warning just is there because they messed up the versioning.