gitgocachinggitops

go get referring invalid tag

I have been developing a go based binary and there was a strange issue that I can across with.

So I do have package A and package B, where package B is directly referred in package A.

Main App (Package A) uses Package B and package B is referred via it's mod file.

So I have added the tagged release of package B for package A via go get packageB-ref@v1.1.0, but as I encountered some issue, I deleted that release and tag locally and on remote (Github) and created a tag based on the newer commit. Github confirms that the new release is based on the new reference, however while I was referring the same tag via the new commit, it was actually referring to the same old code version.

And most recently, just to fix and come over with the issue, I created a tag named v1.1.1, however though it fixed the issue, now even by the time I refer v1.1.0, it gives me the following message in the end.

root@CaesarPrime-AcerE5:/mnt/d/AppA# go get github.com/xxxx/B@master
go: downloading github.com/xxxx/B v1.11.0
go: downloading github.com/xxxx/xxxxz v0.3.2
go: downloading github.com/xxxx/xxxxd v1.1.1
go: downloading golang.org/xxxx/xxxxv v0.0.0-20220127200216-cd36cc0744dd
go: downloading golang.org/xxxx/xxxxb v0.3.7
go: downloading github.com/xxxx/xxxx v0.0.0-20170810143723-de5bf2ad4578
go: upgraded github.com/xxxx/B v1.1.0 => v1.1.1

I believe that this would be due to some caching issue as I do neither see tag v1.1.1 in either remote or my local. But how can this happen if go git is pulling content from a remote repository as it had been pulling some deleted late tags.

Or am I doing something awkwardly wrong here in package management?

Solution

  • You are right, the deleted tags probably exist in Go's public proxy

    The go docs say:

    Once a tag is created, it should not be deleted or changed to a different revision. Versions are authenticated to ensure safe, repeatable builds. If a tag is modified, clients may see a security error when downloading it. Even after a tag is deleted, its content may remain available on module proxies.

    You may retract a version by putting a stanza like this in go.mod:

    retract (
    v1.0.0 // Published accidentally.
    v1.0.1 // Contains retractions only.
)