Skip to content

x/exp/cmd/gorelease: report requirements on retracted module versions #37781

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Closed
Tracked by #46371
jayconrod opened this issue Mar 10, 2020 · 7 comments
Closed
Tracked by #46371

x/exp/cmd/gorelease: report requirements on retracted module versions #37781

jayconrod opened this issue Mar 10, 2020 · 7 comments
Labels
FeatureRequest Issues asking for a new feature that does not need a proposal. FrozenDueToAge modules NeedsFix The path to resolution is known, but the work has not been done. Tools This label describes issues relating to any tools in the x/tools repository.
Milestone
gorelease

Comments

@jayconrod
Copy link
Contributor

A mechanism for retracting module versions is described in #24031, specifically in this comment.

gorelease should report an error if the module requires a retracted module version directly or transitively. This will help module authors avoid depending on retracted versions.
@gopherbot gopherbot added this to the Unreleased milestone Mar 10, 2020
@jayconrod jayconrod added FeatureRequest Issues asking for a new feature that does not need a proposal. modules NeedsFix The path to resolution is known, but the work has not been done. Tools This label describes issues relating to any tools in the x/tools repository. labels Mar 10, 2020
@jayconrod jayconrod mentioned this issue Mar 10, 2020
Closed
@jeanbza
Copy link
Contributor

jeanbza commented Oct 14, 2020

Impl note: go list -m -u, go list -retracted, and go get will note whether a dependency is retracted.

Impl note: definitely should report direct dependencies, maybe transitive.

@jayconrod jayconrod modified the milestones: Unreleased, gorelease Oct 14, 2020
@jayconrod
Copy link
Contributor Author

In particular, the command below will list retracted dependencies in a machine-readable format.

go list -m -retracted -f '{{with .Retracted}}{{.Path}}@{{.Version}}{{end}}' all

@myitcv
Copy link
Member

myitcv commented Nov 8, 2020

Arrived here on the back of trying out module retractions

Impl note: definitely should report direct dependencies, maybe transitive.

I would say definitely should report transitive deps. After all, a module is marked as retracted for at least the following reasons:

(quoting #24031 (comment))

I would suggest this is a fairly important feature to land "soon". Reason being, gorelease will then become the go-to tool for people running CI checks on their modules (which is a good place to be).

@jeanbza
Copy link
Contributor

jeanbza commented Apr 15, 2021

(starting work in https://go-review.googlesource.com/c/exp/+/310370)

@gopherbot
Copy link
Contributor

Change https://golang.org/cl/310370 mentions this issue: cmd/gorelease: report a diagnostic error for retracted dependencies

@jeanbza jeanbza self-assigned this Apr 15, 2021
@jeanbza
Copy link
Contributor

jeanbza commented May 14, 2021

In particular, the command below will list retracted dependencies in a machine-readable format.

go list -m -retracted -f '{{with .Retracted}}{{.Path}}@{{.Version}}{{end}}' all

Note: this format seems to not work for me :(

deklerk at deklerk1 in /tmp/gorelease-load714449427
$ go list -m -u -retracted -f '{{with .Retracted}}{{.Path}}@{{.Version}}{{end}}' all
template: main:1:21: executing "main" at <.Path>: can't evaluate field Path in type []string
deklerk at deklerk1 in /tmp/gorelease-load714449427
$ go list -m -u all
gorelease-load-module
example.com/retract v0.0.0-gorelease [v0.0.1] => /tmp/gorelease892838020
example.com/retractdep v1.0.0 (retracted) [v1.0.1]

I'm able to get programmatic output with -json, though!

deklerk at deklerk1 in /tmp/gorelease-load714449427
$ go list -m -u -json all
{
	"Path": "gorelease-load-module",
	"Main": true,
	"Dir": "/tmp/gorelease-load714449427",
	"GoMod": "/tmp/gorelease-load714449427/go.mod",
	"GoVersion": "1.12"
}
{
	"Path": "example.com/retract",
	"Version": "v0.0.0-gorelease",
	"Replace": {
		"Path": "/tmp/gorelease892838020",
		"Dir": "/tmp/gorelease892838020",
		"GoMod": "/tmp/gorelease892838020/go.mod",
		"GoVersion": "1.12"
	},
	"Update": {
		"Path": "example.com/retract",
		"Version": "v0.0.1",
		"Time": "0001-01-01T00:00:00Z"
	},
	"Dir": "/tmp/gorelease892838020",
	"GoMod": "/tmp/gorelease892838020/go.mod",
	"GoVersion": "1.12"
}
{
	"Path": "example.com/retractdep",
	"Version": "v1.0.0",
	"Time": "0001-01-01T00:00:00Z",
	"Update": {
		"Path": "example.com/retractdep",
		"Version": "v1.0.1",
		"Time": "0001-01-01T00:00:00Z"
	},
	"Dir": "/tmp/gorelease_test-gocache487883119/pkg/mod/example.com/retractdep@v1.0.0",
	"GoMod": "/tmp/gorelease_test-gocache487883119/pkg/mod/cache/download/example.com/retractdep/@v/v1.0.0.mod",
	"GoVersion": "1.12",
	"Retracted": [
		"retracted by module author"
	]
}

@jeanbza
Copy link
Contributor

jeanbza commented May 14, 2021

Ah, nevermind, I see the issue: {{with}} inner block has the {{with .Foo}} thing scoped to .. Switching the inner block to use . rather than the other vars fixes the issue, but it seems like you can only use .Foo in the inner block.

I was able to get at the same thing with:

$ go list -m -u -f '{{if .Retracted}}{{.Path}}@{{.Version}}{{end}}' all
example.com/retractdep@v1.0.0

@jayconrod jayconrod mentioned this issue May 25, 2021
Open
8 tasks
@rsc rsc unassigned jeanbza Jun 23, 2022
@golang golang locked and limited conversation to collaborators Jun 23, 2023
misak113 pushed a commit to misak113/exp that referenced this issue Mar 14, 2025
@jeanbza @misak113
cmd/gorelease: report a diagnostic error for retracted dependencies

Verified

This commit was signed with the committer’s verified signature.
misak113 Michael Zabka
GPG key ID: FF24D1DC831883CC
Verified
Learn about vigilant mode
4721d60 
Fixes golang/go#37781

Change-Id: I109ce5da26c757e7e1bdd6bdcee0ff14be35230b
Reviewed-on: https://go-review.googlesource.com/c/exp/+/310370
Trust: Jean de Klerk <deklerk@google.com>
Run-TryBot: Jean de Klerk <deklerk@google.com>
TryBot-Result: Go Bot <gobot@golang.org>
Reviewed-by: Jay Conrod <jayconrod@google.com>
Sign up for free to subscribe to this conversation on GitHub. Already have an account? Sign in.
Assignees
No one assigned
Labels
FeatureRequest Issues asking for a new feature that does not need a proposal. FrozenDueToAge modules NeedsFix The path to resolution is known, but the work has not been done. Tools This label describes issues relating to any tools in the x/tools repository.
Projects
None yet
Milestone
gorelease
Development

No branches or pull requests
4 participants
@jayconrod @myitcv @jeanbza @gopherbot