4 ms·

I will probably remember Sirupsen forever for his move of breaking Golang projects by renaming his github username. This led to go modules freaking out because

I will probably remember Sirupsen forever for his move of breaking Golang projects by renaming his github username. This led to go modules freaking out because different project used different name casing for the dependency. He has a popular logging library and go modules are angry when you rename github usernames..

Chris2048 6y ago
Does go-lang not have "official" repos, including clones of popular repos, to avoid deps on personal repos? Or is this an "unofficial but popular" library?
- Macha 6y ago
  Go imports are done by direct github URL mostly.
  - Chris2048 6y ago
    And to personal repos? Yikes. They should learn from the npm left-pad incident..
    - Macha 6y ago
      Yeah, the suggestion is that you should run a caching mirror or manually vendor your dependencies. Other unconventional ideas about go packaging is that new major versions should have a new package name or be available in a subdirectory with the old version existing in perpetuity, and the minimal version selection approach to dependency conflicts. I'm sure these things work well inside Google, but at least for me the package management situation is a big turn off for the language.
    - randomswede 6y ago
      It is not (quite) as bad as it sounds. If you have built a module-enabled Go binary yesterday with a specific version of an external dependency, you will get that exact version of the dependency tomorrow when you rebuild (IFF you have version-controlled your go.mod and go.sum, which you should). And if someone tries to be sneaky and move the release tag, the checksum will no longer match, and your build will fail. If you want to upgrade the version of a dependency, that is doable (with plenty of toll assistance), but it requires a positive action. Theer is, however, no good solution for the "first use". But, that is pretyt much standard.
      - Macha 6y ago
        The left-pad issue is about the package being gone, not modified. Without a cache of your own, there's nothing to prevent that?
        randomswede 6y ago
        That is probably to some extent correct. Although this would bite you on a new build, not for anything that is already running in production. My understanding is that that is/was not necessarily the case for leftpad.
Brian_K_White 6y ago
The problem was definitely not that someone renamed their personal account on a website.

Chris2048 6y ago

Does go-lang not have "official" repos, including clones of popular repos, to avoid deps on personal repos? Or is this an "unofficial but popular" library?

Macha 6y ago
Go imports are done by direct github URL mostly.
- Chris2048 6y ago
  And to personal repos? Yikes. They should learn from the npm left-pad incident..
  - Macha 6y ago
    Yeah, the suggestion is that you should run a caching mirror or manually vendor your dependencies. Other unconventional ideas about go packaging is that new major versions should have a new package name or be available in a subdirectory with the old version existing in perpetuity, and the minimal version selection approach to dependency conflicts. I'm sure these things work well inside Google, but at least for me the package management situation is a big turn off for the language.
  - randomswede 6y ago
    It is not (quite) as bad as it sounds. If you have built a module-enabled Go binary yesterday with a specific version of an external dependency, you will get that exact version of the dependency tomorrow when you rebuild (IFF you have version-controlled your go.mod and go.sum, which you should). And if someone tries to be sneaky and move the release tag, the checksum will no longer match, and your build will fail. If you want to upgrade the version of a dependency, that is doable (with plenty of toll assistance), but it requires a positive action. Theer is, however, no good solution for the "first use". But, that is pretyt much standard.
    - Macha 6y ago
      The left-pad issue is about the package being gone, not modified. Without a cache of your own, there's nothing to prevent that?
      - randomswede 6y ago
        That is probably to some extent correct. Although this would bite you on a new build, not for anything that is already running in production. My understanding is that that is/was not necessarily the case for leftpad.

Brian_K_White 6y ago

The problem was definitely not that someone renamed their personal account on a website.