Module 'taken over'

[mx-psi]

If you go to github.com/cobaugh/osrelease you can see that someone has created a cobaugh org to try to 'take over' the dependency (I am guessing since @acobaugh's old Github name was 'cobaugh').

If you use a Go proxy like proxy.golang.org then you will still be served the old code version and nothing will break, but if you don't this will be a problem. From a security point of view, if you use the proxy or if you were using the dependency before the 'take over', this is also harmless since the go.sum entry will prevent you being served a malicious version of the code.

I don't think much can be done to fix things (unless either Github or the author of the take over repo wants to collaborate) but I wanted to post this here so it can be linked as an explanation elsewhere.

[acobaugh]

Thanks for the heads up. The fix for consumers would be to update their imports to use github.com/acobaugh/osrelease.

You are correct, I changed my name from cobaugh to acobaugh for consistency across my personal accounts.

[mx-psi]

Thanks for the quick reply @acobaugh :) I will leave up to you if this issue should be linked on the 'taken over' repo in some way or not.