Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

x/pkgsite: package removal request for https://pkg.go.dev/github.com/kkrypt0nn/logger.go #62726

Closed
kkrypt0nn opened this issue Sep 19, 2023 · 8 comments
Labels
pkgsite/package-removal Issues for package removal. See https://pkg.go.dev/about#removing-a-package pkgsite
Milestone

Comments

@kkrypt0nn
Copy link

kkrypt0nn commented Sep 19, 2023

What is the path of the package that you would like to have removed?

https://pkg.go.dev/github.com/kkrypt0nn/logger.go

Are you the owner of this package?

Yes

What is the reason that you could not retract this package instead?

Repository has been renamed, seeing it hasn't worked properly I've deleted it and created a new repository for the new name.

When visiting the page with the new name it's redirecting to the old one, same when using go install ....

Currently created the repository again for the retract directive but unsure if that's accurate.

@kkrypt0nn kkrypt0nn added the pkgsite/package-removal Issues for package removal. See https://pkg.go.dev/about#removing-a-package label Sep 19, 2023
@gopherbot gopherbot added this to the Unreleased milestone Sep 19, 2023
@bcmills
Copy link
Contributor

bcmills commented Sep 19, 2023

Repository has been renamed

The retract directive is designed to work with GitHub redirects. You should be able to add a retract directive in the go.mod file at the new location retracting the range of versions that were published for the old path.

And I notice that you did attempt to do that. It is possible that your repo has run into #61415, which may prevent the proxy from fetching it going forward.

@suzmue, is it possible to remove the proxy's cached origin data for this module path?

@kkrypt0nn
Copy link
Author

kkrypt0nn commented Sep 19, 2023

You should be able to add a retract directive in the go.mod file at the new location retracting the range of versions that were published for the old path.

How would that work if the old module had v1.0.0 and the new starts at v1.0.0 - means I would have to add the retract directive to the new repository, publish a higher version, remove the directive and publish a higher version?

At the moment when going on the new module URL with the @ version indicator, it redirects to the old URL with a "retracted" notice at the top.

@bcmills
Copy link
Contributor

bcmills commented Sep 19, 2023

If the two module paths share the same repository location, they cannot also share a given version number.

If you want to be able to restart at v1.0.0, I would suggest leaving the old repo in place at the old path and creating a new repository (perhaps a fork of the repository with all prior version tags removed?) at the new path.

@kkrypt0nn
Copy link
Author

Both modules are separated at the moment in different repositories. One tagged version v1.6.0 - on pkg.go.dev it's on v1.5.1 and marked as retracted (which I want to be entirely removed) and the new one tagged v1.0.1 which I want to not redirect to the old one which it currently does.

@bcmills
Copy link
Contributor

bcmills commented Sep 19, 2023

Due to the security properties of the checksum database, the contents of the version for a given repo path cannot be changed once it has been fetched and checksummed.

https://proxy.golang.org/cached-only/github.com/kkrypt0nn/acrux/@v/v1.5.1.info unfortunately shows that the proxy has already processed v1.5.1 for that path, so the remaining options at this point are to pick up at v1.6.0 or so (instead of v1.0.0), to retract the old versions pointwise and use the next patch number after the old version (`v1.0.2, v1.1.2, v1.2.1, etc.), or to abandon that repo path and start fresh with an entirely new one.

@kkrypt0nn
Copy link
Author

So I could make a new tag v2.0.0 for acrux and it would be just fine?

@bcmills
Copy link
Contributor

bcmills commented Sep 19, 2023

Yep! But you'd also need a /v2 import path to match it: module github.com/kkrypt0nn/acrux/v2.

@kkrypt0nn
Copy link
Author

That sounds amazing, I can live with the v2! Will do that tomorrow :)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkgsite/package-removal Issues for package removal. See https://pkg.go.dev/about#removing-a-package pkgsite
Projects
None yet
Development

No branches or pull requests

3 participants