Skip to content

x/pkgsite: package VERSION removal request for [github.com/celo-org/celo-blockchain(1.8.5 to 1.8.9)] #72825

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
gastonponti opened this issue Mar 12, 2025 · 3 comments
Labels
pkgsite/package-removal Issues for package removal. See https://pkg.go.dev/about#removing-a-package pkgsite
Milestone

Comments

@gastonponti
Copy link

What is the path of the package that you would like to have removed?

github.com/celo-org/celo-blockchain

Are you the owner of this package?

No. I'm a team member in charge of the repo https://github.com/orgs/celo-org/teams/blockchain
(Read the explanation, this shouldn't remove the package or change anything that a super admin requires to address)

What is the reason that you could not retract this package instead?

Retracting a module, just removes and bans a version from the package manager.
The issue that we have, is that the package manager is pointing to a tag which is not the actual tag of the repo.
We need to remove that entry to be able to update it with the actual tag of the repo.

Explanation

The celo-org/celo-blockchain is a fork of ethereum/go-ethereum.
With the initial fork (almost 6 years ago) we retrieved all the tags from the original repo.
You can reference an old tag, but when you create the same tag, it won't fail (because that tag is new to that fork of the repo) and will override it (without a force or anything like it).
So, basically the celo-blockchain repo was overriding its fork tags that could be referenced.
As the way you have to know if a new version was created is lazy (someone has to ask about it), technically until someone ask for that version, that version is not retrieved at all.

If I start asking for tags from a repo that were part of the original fork, if they didn't replace those, the entries in the package manager will point to those tags

In our case, the version until the 1.8.4 are correct (nobody was asking for those versions, until we create those, overriding the existing ones from upstream, and after that, those were requesting but the new and correct tags were retrived)
But, unfortunately it seems that someone tried to retrieve the 1.8.5 to 1.8.9 before they were overridden.
So, right now the entries that the package manager has, are pointing to "invalid" tags.

Of course reusing the same format from the old fork it was a poor decision, but this is the way we created all the other versions without issues, and in theory this v1.8.9 will be the last version on that repo, so this shouldn't happen again.

Data

curl  https://proxy.golang.org/github.com/ethereum/go-ethereum/@v/v1.8.9.info    
{"Version":"v1.8.9","Time":"**2018-05-28T09:58:22Z**"}%

curl  https://proxy.golang.org/github.com/celo-org/celo-blockchain/@v/v1.8.9.info
{"Version":"v1.8.9","Time":"**2018-05-28T09:58:22Z**","Origin":{"VCS":"git","URL":"https://github.com/celo-org/celo-blockchain","Ref":"refs/tags/v1.8.9","Hash":"ff9b14617e73c07dfa028bc477fe86c1e04d80c5"}}%

The hash of the commit pointed:
celo-org/celo-blockchain@ff9b146 (old commit from the initial fork)

The actual tag of the repo:
https://github.com/celo-org/celo-blockchain/tree/v1.8.9 (pointing to the hash e8d84ad360913761852930cbab06eeea68fcc3bb)

Possible solution

If you can remove those entries (from the 1.8.5 to the 1.8.9), the new retrieval of those packages should fix the issue

@gastonponti gastonponti added the pkgsite/package-removal Issues for package removal. See https://pkg.go.dev/about#removing-a-package label Mar 12, 2025
@gopherbot gopherbot added this to the Unreleased milestone Mar 12, 2025
@seankhliao
Copy link
Member

The only valid removal requests are to hide the documentation for entire modules.
Once a version is observed by the proxy and a checksum for the version contents added to the sumdb, it's considered immutable. There is no way to remove that, or change the contents of a tag (you'll get a checksum mismatch).

@seankhliao seankhliao closed this as not planned Won't fix, can't repro, duplicate, stale Mar 12, 2025
@gastonponti
Copy link
Author

@seankhliao
I know that this was probably going to be the answer, and I understand that this is not going to be fixable now and I'm not seeking for a solution. But isn't this opening a scenario to attack/mess with all the future versions of repos that fork from one that already has higher versions?
For example every fork from the go-ethereum repo

@seankhliao
Copy link
Member

you're ultimately responsible for the tags available in your repo.
if you fork on github, they've recently added a checkbox to only copy the default branch.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
pkgsite/package-removal Issues for package removal. See https://pkg.go.dev/about#removing-a-package pkgsite
Projects
None yet
Development

No branches or pull requests

3 participants