x/pkgsite: retract request for github.com/prometheus/prometheus

[roidelapluie]

We would like to retract pre-go-mod releases.

What is the path of the package that you would like to have removed?

github.com/prometheus/prometheus

Are you the owner of this package?

yes

What is the reason that you could not retract this package instead?

I tried:

tag v1.99.0-retract (which also retracts itself): prometheus/prometheus@fd8d965

tag v2.35.0-retract (which also retracts itself):
prometheus/prometheus@edcf27b

Somehow this does not seem to work. I do not understand what's wrong. it also seems that the self-retraction of the v1.99.0-retract package does not work at all.

The version we want our users to see as "latest" is v0.35.0-rc1. That tag has a proper retract list:
https://github.com/prometheus/prometheus/blob/5b80eaa3ca27beb3a831c460edaf53ac4e47c610/go.mod

How can we achieve that?

[thepudds]

Hi @roidelapluie, I haven't looked at the details here, but are you only placing your retract directives in versions with pre-release tags?

For example, v1.99.0-retract, v2.35.0-retract, and v0.35.0-rc1 are all semver pre-release tags:

9. A pre-release version MAY be denoted by appending a hyphen and a series of dot separated identifiers immediately following the patch version.

If you have only tried with pre-release tags so far, that might explain at least part of the issue.

From https://go.dev/ref/mod#go-mod-file-retract :

To retract a version, a module author should add a retract directive to go.mod, then publish a new version containing that directive. The new version must be higher than other release or pre-release versions; that is, the @latest version query should resolve to the new version before retractions are considered.

And also from the go mod ref, here is an explanation of what @latest means (including latest will not resolve to a pre-release tag once a non-pre-release tag is available, which makes sense as desirable behavior I think):

The string latest, which selects the highest available release version. If there are no release versions, latest selects the highest pre-release version. If there no tagged versions, latest selects a pseudo-version for the commit at the tip of the repository’s default branch.

[roidelapluie]

I will try with a proper tag, thanks!

[roidelapluie]

Thank you! That fixed the issue!!!! Awesome!