Closed KateGo520 closed 4 years ago
@ryanuber @dadgar Could you help me review this issue? Thx :p
@KateGo520 Thank you for opening this! Great detail. I think what's happened here is that the v2
tag was created so long ago (2014!) that these conventions didn't yet exist. However, adding the go.mod
file in January of this year likely caused this issue to crop up for numerous Go projects.
We had added go.mod
for some projects to use it, however it appears that these projects have resorted to using 2.1.0 (before go.mod was introduced) instead, via `github.com/ryanuber/columnize v2.1.0+incompatible". That's a good signal that we should just remove it, so I think your assessment is correct.
Again, thanks for being the one to actually point this out to me. I appreciate it!
Thanks for your efforts and feedback. @ryanuber
Background
The
github.com/ryanuber/columnize
uses Go modules and the current release version isv2
. And it’s module path is"github.com/ryanuber/columnize"
, instead of"github.com/ryanuber/columnize/v2"
. It must comply with the specification of "Releasing Modules for v2 or higher" available in the Modules documentation. Quoting the specification:Steps to Reproduce
GO111MODULE=on, run
go get
targeting any version >= v2.1.1 of theryanuber/columnize
:run
go get github.com/ryanuber/columnize
, the version will stuck in v2.1.0:SO anyone using Go modules will not be able to easily use any newer version of
ryanuber/columnize
.Solution
1. Kill the go.mod files, rolling back to GOPATH.
This would push them back to not being managed by Go modules (instead of incorrectly using Go modules). Ensure compatibility for downstream module-aware projects and module-unaware projects projects
2. Fix module path to strictly follow SIV rules.
Patch the
go.mod
file to declare the module path asgithub.com/ryanuber/columnize/v2
as per the specs. And adjust all internal imports. The downstream projects might be negatively affected in their building if they are module-unaware (Go versions older than 1.9.7 and 1.10.3; Or use third-party dependency management tools, such as: Dep, glide,govendor…).*[]** You can see who will be affected here: [160 module-unaware users, i.e., revnav/Centroid-OCI, HewlettPackard/terraform-provider-oneview, pydio/cells ] https://github.com/search?o=desc&q=ryanuber%2Fcolumnize+filename%3Avendor.conf+filename%3Avendor.json+filename%3Aglide.toml+filename%3AGodep.toml&s=indexed&type=Code
If you don't want to break the above repos. This method can provides better backwards-compatibility. Release a v2 or higher module through the major subdirectory strategy: Create a new v2
subdirectory
(github.com/ryanuber/columnize/v2) and place a new go.mod file in that subdirectory. Themodule path
must end with/v2
. Copy or move the code into the v2 subdirectory. Updateimport statements
within the module to also use/v2
(import "github.com/ryanuber/columnize/v2/…"). Tag the release withv2.x.y
.3. Suggest your downstream module users use hash instead of a version tag.
If the standard rule of go modules conflicts with your development mode. Or not intended to be used as a library and does not make any guarantees about the API. So you can’t comply with the specification of "Releasing Modules for v2 or higher" available in the Modules documentation. Regardless, since it's against one of the design choices of Go, it'll be a bit of a hack. Instead of
go get github.com/ryanuber/columnize@version-tag
, module users need to use this following way to get theryanuber/columnize
: (1) Search for thetag
you want (in browser) (2) Get thecommit hash
for thetag
you want (3) Rungo get github.com/ryanuber/columnize@commit-hash
(4) Edit the go.mod file to put a comment about which version you actually used This will make it difficult for module users to get and upgraderyanuber/columnize
.*[]** You can see who will be affected here: [574 module users, e.g., kataras/iris, talos-systems/talos, hashicorp/vault] https://github.com/search?o=desc&q=ryanuber%2Fcolumnize+filename%3Ago.mod&s=indexed&type=Code
Summary
You can make a choice to fix DM issues by balancing your own development schedules/mode against the affects on the downstream projects.
For this issue,
Solution 1
can maximize your benefits and with minimal impacts to your downstream projects the ecosystem.References