saschagrunert / ccli Goto Github PK

Hi,

I just built a MWE with your example and wanted to build in 1.21 and 1.20 in Docker:

$ docker run -it --rm mcr.microsoft.com/devcontainers/go:1.21-bookworm

Then try to compile:

root ➜ /go $ mkdir src/ccli-test && cd src/ccli-test

root ➜ /go/src/ccli-test $ wget -q https://raw.githubusercontent.com/saschagrunert/ccli/master/example/main.go

root ➜ /go/src/ccli-test $ go mod init
go: creating new go.mod: module ccli-test
go: to add module requirements and sums:
	go mod tidy

root ➜ /go/src/ccli-test $ go get
go: downloading github.com/urfave/cli v1.22.14
go: downloading github.com/urfave/cli/v2 v2.25.7
go: downloading github.com/saschagrunert/ccli v1.0.1
go: downloading github.com/cpuguy83/go-md2man/v2 v2.0.2
go: downloading github.com/xrash/smetrics v0.0.0-20201216005158-039620a65673
go: downloading github.com/russross/blackfriday/v2 v2.1.0
go: ccli-test imports
	github.com/saschagrunert/ccli/v2: cannot find module providing package github.com/saschagrunert/ccli/v2

root ➜ /go/src/ccli-test $ go get github.com/saschagrunert/ccli/v2
go: module github.com/saschagrunert/ccli@upgrade found (v1.0.1), but does not contain package github.com/saschagrunert/ccli/v2

If I use the non-v2-import of ccli, I got of course a type mismatch due to the incompatibility from ccli/v1 with cli/v2.

Any hints?

Dependabot can't resolve your Go dependency files.

As a result, Dependabot couldn't update your dependencies.

The error Dependabot encountered was:

dmitri.shuralyov.com/gpu/[email protected]: unrecognized import path "dmitri.shuralyov.com/gpu/mtl" (https fetch: Get https://dmitri.shuralyov.com/gpu/mtl?go-get=1: EOF)

If you think the above is an error on Dependabot's side please don't hesitate to get in touch - we'll do whatever we can to fix it.

View the update logs.

Background

The github.com/saschagrunert/ccli uses Go modules and the current release version is v2. And it’s module path is "github.com/saschagrunert/ccli", instead of "github.com/saschagrunert/ccli/v2". It must comply with the specification of "Releasing Modules for v2 or higher" available in the Modules documentation. Quoting the specification:

A package that has opted in to modules must include the major version in the import path to import any v2+ modules
To preserve import compatibility, the go command requires that modules with major version v2 or later use a module path with that major version as the final element. For example, version v2.0.0 of example.com/m must instead use module path example.com/m/v2.
https://github.com/golang/go/wiki/Modules#releasing-modules-v2-or-higher

Steps to Reproduce

GO111MODULE=on, run go get targeting any version >= v2.0.0 of the saschagrunert/ccli:

$ go get github.com/saschagrunert/[email protected]
go: finding github.com/saschagrunert/ccli v2.0.1
go: finding github.com/saschagrunert/ccli v2.0.1
go get github.com/saschagrunert/[email protected]: github.com/saschagrunert/[email protected]: invalid version: module contains a go.mod file, so major version must be compatible: should be v0 or v1, not v2

run go get github.com/saschagrunert/ccli, the version will stuck in v1.0.8:

$go get github.com/saschagrunert/ccli
go: downloading github.com/saschagrunert/ccli v1.0.1
go: github.com/saschagrunert/ccli upgrade => v1.0.1
go: downloading github.com/cpuguy83/go-md2man v1.0.8

SO anyone using Go modules will not be able to easily use any newer version of saschagrunert/ccli.

Solution

1. Kill the go.mod files, rolling back to GOPATH.

This would push them back to not being managed by Go modules (instead of incorrectly using Go modules).
Ensure compatibility for downstream module-aware projects and module-unaware projects projects

I see these dependencies in your go.mod file, which need modle awareness. So you'd better not use third-party tools(such as: Dep, glide, govendor…).

github.com/urfave/cli/v2 v2.2.0

You also need to update the import path to:

import github.com/urfave/cli/…

2. Fix module path to strictly follow SIV rules.

Patch the go.mod file to declare the module path as github.com/saschagrunert/ccli/v2 as per the specs. And adjust all internal imports.
The downstream projects might be negatively affected in their building if they are module-unaware (Go versions older than 1.9.7 and 1.10.3; Or use third-party dependency management tools, such as: Dep, glide,govendor…).

If you don't want to break the above repos. This method can provides better backwards-compatibility.
Release a v2 or higher module through the major subdirectory strategy: Create a new v2 subdirectory (github.com/saschagrunert/ccli/v2) and place a new go.mod file in that subdirectory. The module path must end with /v2. Copy or move the code into the v2 subdirectory. Update import statements within the module to also use /v2 (import "github.com/saschagrunert/ccli/v2/…"). Tag the release with v2.x.y.

3. Major version bump / repository change

Leave v2 as a dead version and bump to v3 with the path changes.

4. Suggest your downstream module users use hash instead of a version tag.

If the standard rule of go modules conflicts with your development mode. Or not intended to be used as a library and does not make any guarantees about the API. So you can’t comply with the specification of "Releasing Modules for v2 or higher" available in the Modules documentation.
Regardless, since it's against one of the design choices of Go, it'll be a bit of a hack. Instead of go get github.com/saschagrunert/ccli@version-tag, module users need to use this following way to get the saschagrunert/ccli:
(1) Search for the tag you want (in browser)
(2) Get the commit hash for the tag you want
(3) Run go get github.com/saschagrunert/ccli@commit-hash
(4) Edit the go.mod file to put a comment about which version you actually used
This will make it difficult for module users to get and upgrade saschagrunert/ccli.

[*] You can see who will be affected here: [2 module users, e.g., saschagrunert/go-modiff, fspace/go-playground]
https://github.com/search?q=saschagrunert%2Fccli+filename%3Ago.mod&type=Code

Summary

You can make a choice to fix DM issues by balancing your own development schedules/mode against the affects on the downstream projects.

For this issue, Solution 2 can maximize your benefits and with minimal impacts to your downstream projects the ecosystem.

References

• https://github.com/golang/go/wiki/Modules#semantic-import-versioning
• https://golang.org/cmd/go/#hdr-Module_compatibility_and_semantic_versioning
• https://github.com/golang/go/wiki/Modules#releasing-modules-v2-or-higher