Explaining pseudo-version, how restrictions have been enforced for pseudo-version in Go 1.13 along with go sumdb, resolving them , features in Go 1.14+ related to modules

1. Understanding Pseudo-Versions
Moving to Go 1.13
What is in Go 1.14+ for Modules
By Mitali Bisht

2. WHO AM I ?
Mitali Bisht
Software Engineer @JFrog
GoCenter.io Developer
@EngrMitaliB
#gocenter

3. ● Presentation Slides
● JFrog T-Shirts Raffle - Win 1 of 3 JFrog Gopher
T-Shirts
https://bit.ly/GoPolandGoCenter

4. BY THE END OF THIS TALK YOU WILL KNOW
▪ About pseudo-versions
▪ Go 1.13 pseudo-version verification
▪ Fixing Incorrect pseudo-versions for Go Modules
▪ What is Go 1.14+ bringing for modules

5. WHAT IS A GO MODULE?
module github.com/containers/common
go 1.12
require (
github.com/BurntSushi/toml v0.3.1
github.com/containers/image/v5 v5.4.3
github.com/containers/storage v1.19.1
github.com/opencontainers/runc v1.0.0-rc9
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 //
indirect
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
golang.org/x/sys v0.0.0-20200327173247-9dae0f8f5775
….
)
Release versions (Semantic Versions)

6. WHAT IS A GO MODULE?
module github.com/containers/common
go 1.12
require (
github.com/BurntSushi/toml v0.3.1
github.com/containers/image/v5 v5.4.3
github.com/containers/storage v1.19.1
github.com/opencontainers/runc v1.0.0-rc9 Pre-release version
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 //
indirect
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
golang.org/x/sys v0.0.0-20200327173247-9dae0f8f5775
….
)

7. WHAT IS A GO MODULE?
module github.com/containers/common
go 1.12
require (
github.com/BurntSushi/toml v0.3.1
github.com/containers/image/v5 v5.4.3
github.com/containers/storage v1.19.1
github.com/opencontainers/runc v1.0.0-rc9
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 //
indirect
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
golang.org/x/sys v0.0.0-20200327173247-9dae0f8f5775 Pseudo-versions
….
)

8. USING PSEUDO-VERSIONS
▪ Untagged revision
▪ Dependent project has not published any semantic version tags
▪ Develop against a commit which has not been tagged yet

9. DON’T UPDATE PSEUDO-VERSIONS MANUALLY
● The pseudo-version participates in minimal version selection.
● The commit date within the pseudo-version provides a total order among
pseudo-versions.

10. BEFORE GO 1.13 AFTER GO 1.13
-> go version
go version go1.13.5 darwin/amd64
-> go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a
go: finding golang.org
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a:
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a: invalid pseudo-version: does not
match version-control timestamp
(2019-08-13T06:44:41Z)
-> go version
go version go1.12.14 darwin/amd64
-> go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: downloading golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: extracting golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys latest
-> cat go.mod
module demo/go12
go 1.12
require golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a //
indirect

11. GO 1.13 PSEUDO-VERSIONS VALIDATION
module github.com/containers/common
go 1.12
require (
github.com/BurntSushi/toml v0.3.1
github.com/containers/image/v5 v5.4.3
github.com/containers/storage v1.19.1
github.com/opencontainers/runc v1.0.0-rc9
github.com/opencontainers/runtime-spec v0.1.2-0.20190618234442-a950415649c7 //
indirect
github.com/docker/docker v1.4.2-0.20191219165747-a9416c67da9f
github.com/syndtr/gocapability v0.0.0-20180916011248-d98352740cb2
golang.org/x/sys v0.0.0-20200327173247-9dae0f8f5775
…..
)
1. 3.2.

12. GO 1.13 PSEUDO-VERSIONS VALIDATION
4. '+incompatible' suffix
5. Checksum server validation

13. FIXING INCORRECT PSEUDO-VERSIONS
● Direct dependencies
● Transitive dependencies
replace golang.org/x/sys v0.0.0-20190726091711-fde4db37ae7a
=> golang.org/x/sys fde4db37ae7a
require {
golang.org/x/sys fde4db37ae7a
}

14. HOW GoCenter AS GOPROXY CAN HELP
▪ GoCenter changes the metadata in the .info with the correct version when the
module download was requested for incorrect pseudo-version.

15. BEFORE GO 1.13 AFTER GO 1.13
-> export GOPROXY=https://gocenter.io/
-> go version
go version go1.13.5 darwin/amd64
-> go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a
go: finding golang.org/x
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org
v0.0.0-20190726091023-fde4db37ae7a
go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a:
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a: proxy returned info for version
v0.0.0-20190813064441-fde4db37ae7a instead
of requested version
-> export GOPROXY=https://gocenter.io/
-> go version
go version go1.12.14 darwin/amd64
-> go get
golang.org/x/sys@v0.0.0-20190726091023-fde4d
b37ae7a
go: finding golang.org/x/sys
v0.0.0-20190726091023-fde4db37ae7a
go: finding golang.org/x/sys
v0.0.0-20200515095857-1151b9dac4a9
go: downloading golang.org/x/sys
v0.0.0-20200515095857-1151b9dac4a9
go: extracting golang.org/x/sys
v0.0.0-20200515095857-1151b9dac4a9
-> cat go.mod
module proxydemo/go12
go 1.12
require golang.org/x/sys
v0.0.0-20190813064441-fde4db37ae7a //
indirect

16. HOW GoCenter AS GOPROXY CAN HELP
▪ For Go 1.13 change in Go Command will automatically update correct
pseudo-version
go get <module_name>@<commit_hash>

17. WHAT IS IN GO 1.14+ FOR MODULES ?
● go get -modfile = /Documents/example1.mod
● go get -mod = readonly /path/to/module
● “go get” upgrade to an +incompatible major version automatically
● plain-text error messages from module proxies and other HTTP servers
● SVN

18. Questions?
@EngrMitaliB
#gocenter
https://bit.ly/GoPolandGoCenter