Understanding pseudo-version, stricter rules for it in Go1.13+ and new features in Go1.14+ for modules

1. Understanding Pseudo-Versions
Moving to Go 1.13
What is in Go 1.14+ for Modules
By Mitali Bisht

2. WHO AM I ?
Mitali Bisht
Software Engineer @JFrog
GoCenter.io Developer
@EngrMitaliB
#gocenter

3. ●
●
●
https://bit.ly/GolangDCJFrog

4. BY THE END OF THIS TALK YOU WILL KNOW
▪ About pseudo-versions
▪ Go 1.13 pseudo-version verification
▪ Fixing Incorrect pseudo-versions for Go Modules
▪ What is Go 1.14+ bringing for modules

5. WHAT IS A GO MODULE?
module github.com/containers/common
go 1.12
require (
github.com/BurntSushi/toml v0.3.1
github.com/containers/image/v5 v5.4.3
github.com/containers/storage v1.19.1
github.com/opencontainers/runc v1.0.0-rc9
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 //
indirect
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
golang.org/x/sys v0.0.0-20200327173247-9dae0f8f5775
….
)
Release versions (Semantic Versions)
• A module is a collection of Go packages stored in a file tree with a go.mod file at its root. The
go.mod file defines the module’s module path, which is also the import path used for the root
directory, and its dependency requirements, which are the other modules needed for a
successful build. Each dependency requirement is written as a module path and a specific
semantic version
•
•Go command uses Semantic version vX.Y.Z as the standard form to describe Module version
X- MAJOR- Incompatible changes
Y- Minor- Backward compatible functionality added
Z - PATH- Backwards compatible bug fixes
•
•Normal releases are being preferred by Go
•Module version is introduced by tagging a revision in source repo

6. WHAT IS A GO MODULE?
module github.com/containers/common
go 1.12
require (
github.com/BurntSushi/toml v0.3.1
github.com/containers/image/v5 v5.4.3
github.com/containers/storage v1.19.1
github.com/opencontainers/runc v1.0.0-rc9 Pre-release version
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 //
indirect
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
golang.org/x/sys v0.0.0-20200327173247-9dae0f8f5775
….
)

7. WHAT IS A GO MODULE?
module github.com/containers/common
go 1.12
require (
github.com/BurntSushi/toml v0.3.1
github.com/containers/image/v5 v5.4.3
github.com/containers/storage v1.19.1
github.com/opencontainers/runc v1.0.0-rc9
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 //
indirect
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
golang.org/x/sys v0.0.0-20200327173247-9dae0f8f5775 Pseudo-versions
….
)

8. USING PSEUDO-VERSIONS
▪ Untagged revision
▪ Dependent project has not published any semantic version tags
▪ Develop against a commit which has not been tagged yet
•The go command will accept the plain commit hash and translate it into a pseudo-version (or
a tagged version if available) automatically. It also helps to compare the revisions based on
generated timestamp. This is an example of gomodule query
•There are pseudo-versions that are edited by hand or generated by third party tools
•Through Go 1.12, Pseudo-version with arbitrary combination of version string and date, would
resolve to the underlying revision (typically a Git commit hash) as long as that revision existed
by Go

9. DON’T UPDATE PSEUDO-VERSIONS MANUALLY
● The pseudo-version participates in minimal version selection.
● The commit date within the pseudo-version provides a total order among
pseudo-versions.
The pseudo-version participates in minimal version selection. If its version prefix is inaccurate,
the pseudo-version may appear to have higher precedence that the releases that follow it,
effectively “pinning” the module to that commit.

10. BEFORE GO 1.13 AFTER GO 1.13
-> go version
go version go1.13.5 darwin/amd64
-> go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a
go: finding golang.org
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a:
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a: invalid pseudo-version: does not
match version-control timestamp
(2019-08-13T06:44:41Z)
-> go version
go version go1.12.14 darwin/amd64
-> go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: downloading golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: extracting golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys latest
-> cat go.mod
module demo/go12
go 1.12
require golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a //
indirect

11. GO 1.13 PSEUDO-VERSIONS VALIDATION
module github.com/containers/common
go 1.12
require (
github.com/BurntSushi/toml v0.3.1
github.com/containers/image/v5 v5.4.3
github.com/containers/storage v1.19.1
github.com/opencontainers/runc v1.0.0-rc9
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 //
indirect
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
golang.org/x/sys v0.0.0-20200327173247-9dae0f8f5775
…..
)
1. 3.2.
1. The tag from which the pseudo-version derives points to the named revision or one of
its ancestors as reported by the underlying VCS tool, or the pseudo-version is not
derived from any tag i.e. has a "vX.0.0-" prefix before the date string and uses the
lowest major version appropriate to the module path).
2. The date string within the pseudo-version matches the UTC timestamp of the revision
as reported by the underlying VCS tool.
3. The short name of the revision within the pseudo-version is the same as the short
name generated by Go command. Specifically, if the short name is a SHA-1 prefix, it
must use the same number of hex digits (12)

12. GO 1.13 PSEUDO-VERSIONS VALIDATION
4. '+incompatible' suffix
5. Checksum server validation
4. The pseudo-version includes a '+incompatible' suffix only if it is needed for the
corresponding major version, and only if the underlying module does not have a go.mod file
5 . In each module's root, alongside go.mod, the go command maintains a file named go.sum
containing the cryptographic checksums of the module's dependencies. As of Go1.13, with go
get command it will validate module version against checksum server(which is a transparent
log of all public module checksums)

13. FIXING INCORRECT PSEUDO-VERSIONS
● Direct dependencies
● Transitive dependencies
replace golang.org/x/sys v0.0.0-20190726091711-fde4db37ae7a
=> golang.org/x/sys fde4db37ae7a
require {
golang.org/x/sys fde4db37ae7a
}

14. HOW GoCenter AS GOPROXY CAN HELP
▪ GoCenter changes the metadata in the .info with the correct version when the
module download was requested for incorrect pseudo-version.

15. BEFORE GO 1.13 AFTER GO 1.13
-> export GOPROXY=https://gocenter.io/
-> go version
go version go1.13.5 darwin/amd64
-> go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a
go: finding golang.org/x
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org
v0.0.0-20190726091023-fde4db37ae7a
go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a:
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a: proxy returned info for version
v0.0.0-20190813064441-fde4db37ae7a instead
of requested version
-> export GOPROXY=https://gocenter.io/
-> go version
go version go1.12.14 darwin/amd64
-> go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys
v0.0.0-20200515095857-1151b9dac4a9
go: downloading golang.org/x/sys
v0.0.0-20200515095857-1151b9dac4a9
go: extracting golang.org/x/sys
v0.0.0-20200515095857-1151b9dac4a9
-> cat go.mod
module proxydemo/go12
go 1.12
require golang.org/x/sys
v0.0.0-20190813064441-fde4db37ae7a //
indirect

16. HOW GoCenter AS GOPROXY CAN HELP
▪ For Go 1.13 change in Go Command will automatically update correct
pseudo-version
go get <module_name>@<commit_hash>

17. WHAT IS IN GO 1.14+ FOR MODULES ?
● go get -modfile = /Documents/example1.mod
● go get -mod = readonly /path/to/module
● “go get” upgrade to an +incompatible major version automatically
● plain-text error messages from module proxies and other HTTP servers
● SVN

18. Questions?
@EngrMitaliB
#gocenter
https://bit.ly/GolangDCJFrog