search

WireGuard / wgctrl-go

Package wgctrl enables control of WireGuard interfaces on multiple platforms.
https://godoc.org/golang.zx2c4.com/wireguard/wgctrl
MIT License
727 stars 85 forks source link

go.mod is requiring a revoked wireguard version #102

Closed d1ss0nanz closed 3 years ago

d1ss0nanz commented 3 years ago

https://github.com/WireGuard/wgctrl-go/blob/bd2cb7843e1b98193f01eb288793e741a814a269/go.mod#L12 is requiring golang.zx2c4.com/wireguard v0.0.20200121 but it seems like there's no such version?


go: warning: golang.zx2c4.com/wireguard@v0.0.20200121: retracted by module author
go: to switch to the latest unretracted version, run:
    go get golang.zx2c4.com/wireguard@latest
go get: upgraded golang.zx2c4.com/wireguard v0.0.0-20210412221935-c7cd2c9eab6a => v0.0.20200121```
AlekSi commented 3 years ago

Among other things, that breaks Dependabot checks

AlekSi commented 3 years ago

I took a slightly deeper look into that. Currently, wireguard-go has the following tags:

0.0.20180514
0.0.20180519
0.0.20180524
0.0.20180531
0.0.20180613
0.0.20181001
0.0.20181018
0.0.20181222
0.0.20190409
0.0.20190517
0.0.20190805
0.0.20190908
0.0.20191012
0.0.20200121
0.0.20200320
0.0.20201118
0.0.20210212
0.0.20210323
0.0.20210424
v0.0.20201121

All except the last one do not have v prefix and are not considered valid module version by the go command. The last tag is interesting: it was created four days ago, after this issue was created. I guess the tag was removed and recreated? It also tags this commit that is not a part of any branch: https://github.com/WireGuard/wireguard-go/commit/1ce8790e7ace24b3fd964977f28c8752d746304f

@zx2c4 May you help us there? What is going on? What is the way forward for wgctrl-go users?

AlekSi commented 3 years ago

Found at https://github.com/golang/go/issues/44306

Because I've removed all tags from my repository. I did this because tagging versions didn't make sense for it (just as it doesn't make sense for x/sys, while it does make sense for x/text). The intended effect was that go get ... would then give people the latest commit, rather than the latest tag. Unfortunately, due to the above weirdness, it gives people an old no longer existing tag.

Currently, v0.0.20201121 is still there.