Conversation

Notices

1. Embed this notice
   Golang Weekly (golang_discussions@mastodon.social)'s status on Friday, 03-Nov-2023 17:00:51 JST Golang Weekly

   People do change what a particular version is of a Go module

   https://utcc.utoronto.ca/~cks/space/blog/programming/GoPeopleRedoModuleVersions

   Discussions: https://discu.eu/q/https://utcc.utoronto.ca/~cks/space/blog/programming/GoPeopleRedoModuleVersions

   #golang #programming #security

   • Embed this notice
     gnutelephony (gnutelephony@floss.social)'s status on Friday, 03-Nov-2023 17:00:50 JST gnutelephony

     in reply to

     @golang_discussions this is a failure in maintanence, not a failure in go. I have made and tagged bad release versions in the past. I NEVER replace a tag I have already published. It is far better to burn it and yes, do a new release, with a new tagged version. This is not true just about in Go, but is WRONG TO EVER DO regardless of language.

   • Embed this notice
     gnutelephony (gnutelephony@floss.social)'s status on Friday, 03-Nov-2023 17:05:05 JST gnutelephony

     in reply to

     @golang_discussions what do you do if you accidently put a password in your repo and its part of the tagged commit? You delete the tag, you delete or rewrite the history as needed, and you just SKIP that version. NEVER EVER reuse a version tag with a changed commit FOR ANY REASON whatsoever, period. If you do so, you should be publicly shamed. The tooling is doing the correct thing here.

   • Embed this notice
     gnutelephony (gnutelephony@floss.social)'s status on Friday, 03-Nov-2023 17:23:57 JST gnutelephony

     in reply to

     @golang_discussions if you had deleted an old tag, but still needed it for a lts release, you can sub-version it. For example, v1.2.0 can become v1.2.0.1. If your answer begins "I will reuse" a past tag with a different commit for any reason your answer is WRONG. If you fucked up and had a lot of tags you had to kill, and need to put back some after you have rewritten a history, put in the work to do it correct, or don't bother doing it all! There is enough crap out there, don't add to it.

   • Embed this notice
     gnutelephony (gnutelephony@floss.social)'s status on Monday, 13-Nov-2023 00:58:36 JST gnutelephony

     in reply to

     • Pär Björklund

     @Paxxi @golang_discussions very true

   • Embed this notice
     Pär Björklund (paxxi@hachyderm.io)'s status on Monday, 13-Nov-2023 00:58:37 JST Pär Björklund

     in reply to

     • gnutelephony

     @gnutelephony @golang_discussions rewriting history in a published repo tend to lead to all sorts of bad things. The secret is burned no matter what you do so might as well just add another commit removing it