x/pkgsite: package removal request for github.com/MicahParks/jwks

[MicahParks]

What is the path of the package that you would like to have removed?

github.com/MicahParks/jwks

Are you the owner of this package?

Yes

What is the reason that you could not retract this package instead?

I have a project, github.com/MicahParks/keyfunc. It was originally named github.com/MicahParks/jwks. After v0.0.5 in March 2021, I renamed the package from jwks to keyfunc. I believe the package was not used in v0.0.5 or earlier versions. The project was renamed form jwks to keyfunc because it better represented the scope of the package (a JWK Set client for a specific JWT package).

• Versions for jwks: https://pkg.go.dev/github.com/MicahParks/jwks?tab=versions
• Versions for keyfunc: https://pkg.go.dev/github.com/MicahParks/keyfunc?tab=versions

I've started a new project under github.com/MicahParks/jwks, this time, it's a server side implementation of a JWK Set.

I attempted the following command and received the below error.

$ go get github.com/MicahParks/jwks@v0.1.0
go: github.com/MicahParks/jwks@v0.1.0: parsing go.mod:
	module declares its path as: github.com/MicahParks/keyfunc
	        but was required as: github.com/MicahParks/jwks

I believe that v0.1.0 was never published for github.com/MicahParks/jwks (until today) as seen by the link to versions on pkg.go.dev above. It may be the case that the Go module proxy is linking github.com/MicahParks/jwks and github.com/MicahParks/keyfunc together somehow.

$ go clean -cache -testcache -modcache
$ GOPRIVATE=github.com/MicahParks go get github.com/MicahParks/jwks@v0.1.0
go: downloading github.com/MicahParks/jwks v0.1.0
go: added github.com/MicahParks/jwks v0.1.0

I would like to reclaim the github.com/MicahParks/jwks namespace from the Go module proxy and unlink it from keyfunc, if applicable.

[seankhliao]

sorry, that's not possible.
https://proxy.golang.org/github.com/!micah!parks/jwks/@v/list lists the tagged versions that the proxy knows about and may have cached, it comes from github's redirect behavior when you rename a repository (something previously requested jwks, github redirects the content to keyfunc, that gets saved/served).

[MicahParks]

I believe GitHub stops the redirection behavior when a new project takes over the original name. It's possible I'm missing some more subtle behavior, but visiting the repository via HTTP and git cloning returns the new project as expected.

https://docs.github.com/en/enterprise-cloud@latest/repositories/creating-and-managing-repositories/renaming-a-repository

Warning: If you create a new repository under your account in the future, do not reuse the original name of the renamed repository. If you do, redirects to the renamed repository will break.

[seankhliao]

yes, but once cached the definition is permanent, especially wrt to the sumdb.
you can use the jwks name, but not with any of the version numbers already cached
you'll also want to retract them, but that won't let you redefine them.

[MicahParks]

I see, so the sumdb holds all the versions from when the redirect was in place, meaning I would need to publish a version higher than the latest version in the sumdb (and retract earlier versions) to reclaim the name for this new project. I understand and appreciate that there's no changing the sumdb.

In this case, the highest tag in the sumdb is already in the release stage, after v1.X.X. So I'll opt to move the new project to another repository. Thank you for explaining this to me.