Add patch version to repo tags (v1.1.0 instead of v1.1)

[andrejvanderzee]

The go mod tool does not recognize SemVersion without the patch version. Therfor it falls back to the v0.9.1 version as its the only tag with patch number in your repo. Could you please tag the repo for v1.1.0 and v1.0.0?

[frasercobb]

+1 for this.
As a workaround I have forked this repo and added the tag myself, then replaced this package in my go.mod like so:

replace github.com/SermoDigital/jose => <PATH_TO_FORKED_REPO>/jose

[andrejvanderzee]

You can also add this to go.mod:

exclude github.com/SermoDigital/jose v0.9.1

That will force master as there are no other correct SemVer tags on the repo.

[NickCiao]

+1 for this.

[coolaj86]

@ericlagergren Would you mind running this command for us please:

git clone git@github.com:SermoDigital/jose.git
cd jose/
git checkout v1.1
git tag v1.1.0
git push --tags

It would help a ton. Please and thank you!

[kerak19]

So is this package still active or should someone create a fork? Because without modules support using this package is going to be awkward.

[coolaj86]

@kerak19 Here's an open source social experiment that may be worth trying:

1. Create a fork
2. Open an issue titled "Official maintenance fork: <>" with a description of your goals for the project
3. Message the other forkers to inform them of your fork (and maybe try to merge some things)
4. See if you can actually get people to agree to continue development / maintenance.

I think someone just has to have enough "skin in the game" to make it happen, but it looks like there aren't any people aside from the author with more than 2 commits, so it's a tough sell.

Being a maintainer is a thankless job... :-/

[ericlagergren]

Hi guys. It's been a while since I've worked here.

I reached out and got confirmation that a fork is the best way to move forward right now.

[coolaj86]

Do any of you have a vested interested in maintaining a fork of this project and vetting others to add who want to help?

All those who have contributed or forked

@ericlagergren, @mark-adams, @zgiber, @ifraixedes, @magiconair, @tw1nk, @yageek, @eliquious, @TheHippo, @supershabam, @kmulvey, @andrefreitas, @tooooolong, @30mw002, @akutz, @Andresferreira3191, @bmpickford, @briankassouf, @BryanSingh, @cognusion, @cpl-qlik, @DavadDi, @Gluoo, @robbyoconnor, @sharonjl, @golint-fixer, @husnifirmansyah, @insionng, @jayantnd, @josuehennemann, @jvthanh, @kavonm, @lanziliang, @ll837448792, @melotusme, @MentalPower, @MEX7, @mohammed90, @mudzot, @naufalfmm, @niksmith, @onef9day, @oren, @owenliu1122, @PattaraponLertratananont, @peterwillcn, @presto78, @rjansen, @sevaorlov, @showz, @smartrevolution, @bhanditz, @spivegin, @sthapaun, @stonewl897, @svarlamov, @tirithen, @tomwganem, @vadimline, @winonone, @zensh

How I got that list

I grabbed everyone's names with this by visiting https://github.com/SermoDigital/jose/graphs/contributors and running this:

var usernames = {};
$$('[data-hovercard-type="user"]').forEach(function (el) {
  usernames[el.href.replace("https://github.com/", "@").toLowerCase()] = true;
});
console.log(Object.keys(usernames).join(", "));

and then going to https://github.com/SermoDigital/jose/network/members and running this:

var usernames = {};
var lastList = "" // but with the last list instead of an empty string
lastList.split(/,\s+/).forEach(function (name) {
  usernames[name.toLowerCase()] = true;
});
$$('[data-octo-dimensions="link_type:self"]').forEach(function (el) {
  usernames[el.href.replace("https://github.com/", "@").toLowerCase()] = true;
});
console.log(Object.keys(usernames).join(", "));

[coolaj86]

@ericlagergren Is there a way that you can have the README updated to point to a "blessed" fork or transfer ownership of the repo, assuming someone speaks up?

If within 72 hours no one else responds, I'd be happy to create a fork and bless myself, but it would be primarily just to establish a simple contributor policy, vet potential contributors, and enable them to get patches in and potentially share responsibility (I don't want to be a sole maintainer).

[jefferai]

We've mostly moved away from this package because it creates RFC-incompatible JWTs that can only be verified by itself.

[robbyoconnor]

I'm not up to maintaining a fork myself... -- go ahead @coolaj86

[kerak19]

@coolaj86 i don't know if i'am competent enough - i haven't read the RFCs yet.

Tbh for starters i think Go modules support would be sufficient

[ifraixedes]

Unfortunately, I cannot participate on it for now; I used this package more than 2.5 years ago, I'm not competent enough in such RFCs and right now I don't have that much free time.
Thanks for the ping.

[josuehennemann]

Unfortunately I don't have that much free time in this moment. I only tested this package, don´t really used he. Thanks Em qui, 14 de fev de 2019 às 19:07, AJ ONeal <notifications@github.com> escreveu:

…

Do any of you have a vested interested in maintaining a fork of this project and vetting adding others to help? @ericlagergren <https://github.com/ericlagergren>, @mark-adams <https://github.com/mark-adams>, @zgiber <https://github.com/zgiber>, @ifraixedes <https://github.com/ifraixedes>, @magiconair <https://github.com/magiconair>, @tw1nk <https://github.com/tw1nk>, @yageek <https://github.com/yageek>, @eliquious <https://github.com/eliquious>, @TheHippo <https://github.com/TheHippo>, @supershabam <https://github.com/supershabam>, @kmulvey <https://github.com/kmulvey>, @andrefreitas <https://github.com/andrefreitas>, @tooooolong <https://github.com/tooooolong>, @30mw002 <https://github.com/30mw002>, @akutz <https://github.com/akutz>, @Andresferreira3191 <https://github.com/Andresferreira3191>, @bmpickford <https://github.com/bmpickford>, @briankassouf <https://github.com/briankassouf>, @BryanSingh <https://github.com/BryanSingh>, @cognusion <https://github.com/cognusion>, @cpl-qlik <https://github.com/cpl-qlik>, @DavadDi <https://github.com/DavadDi>, @Gluoo <https://github.com/Gluoo>, @robbyoconnor <https://github.com/robbyoconnor>, @sharonjl <https://github.com/sharonjl>, @golint-fixer <https://github.com/golint-fixer>, @husnifirmansyah <https://github.com/husnifirmansyah>, @insionng <https://github.com/insionng>, @jayantnd <https://github.com/jayantnd>, @josuehennemann <https://github.com/josuehennemann>, @jvthanh <https://github.com/jvthanh>, @kavonm <https://github.com/kavonm>, @lanziliang <https://github.com/lanziliang>, @ll837448792 <https://github.com/ll837448792>, @melotusme <https://github.com/melotusme>, @MentalPower <https://github.com/MentalPower>, @MEX7 <https://github.com/MEX7>, @mohammed90 <https://github.com/Mohammed90>, @mudzot <https://github.com/mudzot>, @naufalfmm <https://github.com/naufalfmm>, @NikSmith <https://github.com/NikSmith>, @onef9day <https://github.com/onef9day>, @oren <https://github.com/oren>, @owenliu1122 <https://github.com/owenliu1122>, @PattaraponLertratananont <https://github.com/PattaraponLertratananont>, @peterwillcn <https://github.com/peterwillcn>, @presto78 <https://github.com/presto78>, @rjansen <https://github.com/rjansen>, @sevaorlov <https://github.com/sevaorlov>, @showz <https://github.com/showz>, @smartrevolution, @bhanditz, @spivegin, @sthapaun, @stonewl897, @svarlamov, @TheHippo <https://github.com/TheHippo>, @tirithen, @tomwganem, @vadimline, @winonone, @zensh — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#43 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABxKQcTh-YjxBmcAcEbvmGesF-xq54FDks5vNc_-gaJpZM4WUzWL> .

[brianvoe]

https://github.com/brianvoe/sjwt

[macinnir]

+1 for this.
As a workaround I have forked this repo and added the tag myself, then replaced this package in my go.mod like so:

replace github.com/SermoDigital/jose => <PATH_TO_FORKED_REPO>/jose

+1
This is a pretty simple change of adding a proper semver tag. In the meantime, I also have a fork:
https://github.com/macinnir/jose

[andrefreitas]

Shall we close this issue?

[robbyoconnor]

Was it done? If not, then no.

[sgmheyhey]

Using go mod, how to avoid to get v0.9.1 but get v1.1
(not as v1.1.0 but as v0.9.2)

1. make go.mod file

go mod init jwt

go mod tidy

1. get a pseudo-version for not tagged version

go get github.com/SermoDigital/jose@master

go get: upgraded github.com/SermoDigital/jose v0.9.1 => v0.9.2-0.20180104203859-803625baeddc