Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

proposal: cmd/go: add GOSUMDBDIR to configure the location of downloaded checksum database files #59456

Open
bcmills opened this issue Apr 5, 2023 · 5 comments
Open

proposal: cmd/go: add GOSUMDBDIR to configure the location of downloaded checksum database files #59456

bcmills opened this issue Apr 5, 2023 · 5 comments
Labels
GoCommand cmd/go modules Proposal
Milestone
Proposal

Comments

@bcmills
Copy link
Contributor

bcmills commented Apr 5, 2023

Over many years we've been trying to move to a state in which GOPATH/pkg is no longer needed (#4719, #34527).

However, it appears that when we added support for the checksum database (#25530), we did not also add a configuration point for the location of the local copy of the checksum database and transparency log. It is currently always located in GOPATH/pkg/sumdb:
https://cs.opensource.google/go/go/+/master:src/cmd/go/internal/cfg/cfg.go;l=422;drc=8fce59eab5cb2facfafca89e047b4b43ba44785f

For consistency, I think we should add such a configuration point as an environment variable akin to GOMODCACHE.

I suggest either GOSUMDBDIR (analogous to GOTMPDIR) or GOSUMDBCACHE (analogous to GOMODCACHE).

(CC @rsc @matloob @golang/tools-team)
@bcmills bcmills added this to the Proposal milestone Apr 5, 2023
@mvdan
Copy link
Member

mvdan commented Apr 5, 2023

Can we not store this inside GOMODCACHE? It is cached information that was fetched about Go modules, after all. I'm not sure that users will see a benefit in keeping the directories and env vars separate.

@bcmills
Copy link
Contributor Author

bcmills commented Apr 5, 2023

It isn't in GOMODCACHE today.

There is a moderate security benefit from not clearing the transparency log when one runs go clean -modcache, but I suspect that if we just special-cased “don't clear the tree head” that would probably be fine. 🤷‍♂️

@mvdan
Copy link
Member

mvdan commented Apr 5, 2023

I understand the directories aren't merged today - I mean to say that we could join them and sidestep the need for GOSUMDBCACHE :) Go already has two "cache" env vars, which many users are confused by, so I'd love to avoid a third. Nearly as much as I'd love to get rid of my GOPATH directory.

@mvdan
Copy link
Member

mvdan commented Jun 8, 2023

I ran into this again today; in a docker environment, I set GOCACHE and GOMODCACHE to mounted volumes to persist them, and HOME=/no-home (with GOPATH unset) to ensure that nothing else was leaking. I got errors in a go mod tidy command, as it was trying to create files under /no-home/go/pkg/sumdb:

go: github.com/protocolbuffers/txtpbfmt@v0.0.0-20230328191034-3462fbc510c0: verifying go.mod: github.com/protocolbuffers/txtpbfmt@v0.0.0-20230328191034-3462fbc510c0/go.mod: open /no-home/go/pkg/sumdb/sum.golang.org/latest: no such file or directory

I had forgotten about my suggestion above already, but I still stand by it. As an end user, I don't see any reason to split the sumdb cache from GOMODCACHE. If anything, it would be an extra bother to set up a third env var :)

@srdfjy
Copy link

srdfjy commented Jul 21, 2023

I also want to move the path of gopath/pkg/sumdb to the go mod directory, but I can't find a way to make this change.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
GoCommand cmd/go modules Proposal
Projects
Proposals
Status: Incoming
Milestone
Proposal
Development

No branches or pull requests
3 participants
@mvdan @bcmills @srdfjy