Unable to install a pinned version using `go install`

[kameshsampath]

/question

As developer trying to use docker-credential-gcr, I tried installing using go install

go install github.com/GoogleCloudPlatform/docker-credential-gcr@v2.1.6

It results in the following error,

go: github.com/GoogleCloudPlatform/docker-credential-gcr@v2.1.6: github.com/GoogleCloudPlatform/docker-credential-gcr@v2.1.6: invalid version: module contains a go.mod file, so module path must match major version ("github.com/GoogleCloudPlatform/docker-credential-gcr/v2")

Based on the error I tried doing,

go install github.com/GoogleCloudPlatform/docker-credential-gcr/v2@v2.1.6

Which also results in same error as above.

If I do go install github.com/GoogleCloudPlatform/docker-credential-gcr@latest it works, but I need to pin to a version of the binary.

Any clues?

[eriksw]

Weird and probably related: If you install via an @<git sha> you get something that claims to be 1.5.1 but with the (much newer than 1.5.1) sha suffix at the end: https://github.com/GoogleCloudPlatform/docker-credential-gcr/issues/115

[rosmo]

I believe there would be need to copy the v2.0+ changes to a v2/ directory (and perhaps roll back the main directory to the last v1 release). (ref: https://go.dev/blog/v2-go-modules)

[sudo-bmitch]

I believe this can be resolved by changing: https://github.com/GoogleCloudPlatform/docker-credential-gcr/blob/62afb2723512fd6572c6300024e0c94f734b0ae3/go.mod#L1

From

module github.com/GoogleCloudPlatform/docker-credential-gcr

to

module github.com/GoogleCloudPlatform/docker-credential-gcr/v2

This also requires updating all imports in the various child packages so that they don't pull v1 code.

[liam-verta]

The bug here is that people can't install a pinned version.

WORKAROUND: As @eriksw noted above, go install github.com/GoogleCloudPlatform/docker-credential-gcr@<commit-sha> installs the commit specified as expected. The version number looks strange, but the code is correct.

II think the v.1.5.1 in the version string is a side-effect of the go module version numbering rules around major versions (as noted with the error above): since github.com/GoogleCloudPlatform/docker-credential-gcr doesn't have /v2/ in it, the Go module system uses the the next reasonable v1 incremental number. There's already a v1.5.0, so commits after that tag must be at least v1.5.1-<something>.

I've done a file diff and verified that the code being pulled matches the commit-sha. docker-credential-gcr v2.1.8 and docker-credential-gcr 62afb2723512 are functionally the same. Only the version number is different.

[rafibarash]

I'm a little hesitant to approve https://github.com/GoogleCloudPlatform/docker-credential-gcr/pull/138 - I don't believe I've used other github packages that need the /<version> suffix.

Could this instead be fixed with a change to the .goreleaser.yml file?

[eriksw]

@rafibarash No change to goreleaser configuration or bazel build rules could ever address this card. This tool needs to be buildable via normal "go install" and in order to do that it must comply with the requirement of a major version suffix. https://go.dev/ref/mod#major-version-suffixes

If there had never been any >=2 tags created then things could have carried on as is, but that ship has sailed.

[rafibarash]

Sounds good, I'll create another release. Thanks for the fix!

[rafibarash]

Well, look like a new but similar error popped up after https://github.com/GoogleCloudPlatform/docker-credential-gcr/releases/tag/v2.1.10.

rbarash:🏠 ❯ go install github.com/GoogleCloudPlatform/docker-credential-gcr@v2.1.10

go: github.com/GoogleCloudPlatform/docker-credential-gcr@v2.1.10: github.com/GoogleCloudPlatform/docker-credential-gcr@v2.1.10: invalid version: go.mod has post-v2 module path "github.com/GoogleCloudPlatform/docker-credential-gcr/v2" at revision v2.1.10

Will look into a fix

[rafibarash]

Actually nvm, I forgot about adding the /v2 suffix when installing.

rbarash:🏠 ❯ go install github.com/GoogleCloudPlatform/docker-credential-gcr/v2@v2.1.10
go: downloading github.com/GoogleCloudPlatform/docker-credential-gcr/v2 v2.1.10

In hindsight, this should have been a major release change (v3.0.0) instead of a minor one. My apologies for not realizing that before merging your fix. I'm planning on leaving this be, but feel free to re-open the comment if you think it's necessary to also do a major version release.