golang: use pkg.go.dev v1beta API for package and version metadata#32
Merged
Conversation
When using the default proxy, FetchPackage now hits /v1beta/module which returns the resolved repository URL (correct for vanity imports), SPDX license types, and the latest version. FetchVersions hits /v1beta/versions which returns commit times and retracted/deprecated flags in a single paginated response, replacing the N+1 .info calls against the proxy. Any pkgsite failure (including 404, since pkg.go.dev can lag the proxy) falls through to the existing goproxy protocol path. Custom proxies skip pkgsite entirely.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The Go team announced a JSON API for pkg.go.dev (https://go.dev/blog/pkgsite-api). This wires it into the golang client when running against the default proxy.
FetchPackagenow calls/v1beta/module/{path}?licenses=true, which gives us the resolvedrepoUrl(so vanity imports likegolang.org/x/syncgethttps://go.googlesource.com/syncinstead of a guessed path thaturlparserrejects), SPDX license types forLicenses, and the latest version forLatestVersion.FetchVersionsnow calls/v1beta/versions/{path}, paginating overnextPageToken. Each item carriescommitTime,retractedanddeprecated, which replaces the N+1.inforequests against the proxy and lets us populateVersion.Statusfor the first time.Any pkgsite error, including 404, falls through to the existing goproxy protocol so a module that has just hit
proxy.golang.orgbut not yet been indexed by pkg.go.dev still resolves. WhenbaseURLis anything other thanhttps://proxy.golang.org(private Athens, Artifactory, etc.) pkgsite is skipped entirely and behaviour is unchanged.The API is
v1beta; the path will change when it goes v1 but the blog post commits to backward compatibility from that point.