x/pkgsite: package removal request for github.com/open-policy-agent/OPA

[charlieegan3]

What is the path of the package that you would like to have removed?

github.com/open-policy-agent/OPA (note uppercase OPA)

Are you the owner of this package?

I am a maintainer of the OPA project.

What is the reason that you could not retract this package instead?

We are looking to remove a package rather than particular versions.

Notes

We seem to have ended up with two packages for the OPA project:

• https://pkg.go.dev/github.com/open-policy-agent/OPA
• https://pkg.go.dev/github.com/open-policy-agent/opa

We would like to point users to the correct one at: github.com/open-policy-agent/opa but are unsure how best to go about this. Hopefully this is the right place 🙏

[bcmills]

We would like to point users to the correct one at: github.com/open-policy-agent/opa but are unsure how best to go about this.

The canonical module path is what is declared in the go.mod file. It looks like [github.com/open-policy-agent/opa](https://pkg.go.dev/github.com/open-policy-agent/opa) added a go.mod file with the current path as of v0.15.0.

Both paths resolve to the same underlying repo and the go command intentionally disregards the module path when processing retract directives, so it should suffice to retract all versions prior to v0.15.0 in the go.mod file at the repo root and publish those retractions in some tagged release (such as v0.49.3 or v0.50.0).

[charlieegan3]

Thanks @bcmills! I think we can do that. I presumed that since the module path was different that we were in some edge case here. I’ll reopen if we still have the issue after adding the retracts.

[charlieegan3]

Hi again, we've retracted the module now. I can see there's a message at the top of the page which is an improvement. However, it could still be confusing for a user since there's no link or redirect to the current module. Since the page also returns 200OK, I guess it's unlikely to be removed by search engines too.

Do we have any other options here?

[bcmills]

@charlieegan3, the comment from the retract directive is printed at the top of the page. If you start the retract message with the advice to use the updated module path, then it should be straightforward for folks to notice it.

Perhaps something like:

// Use the path github.com/open-policy-agent/opa (lower-case), not …/OPA.
// Before 0.15.0 OPA was not using go modules and the correct import path was not enforced.
retract [v0.1.0-rc1, v0.14.2]

[charlieegan3]

Ahh I see. We can change the message to include a link instead. Thanks again!