x/pkgsite: package removal request for github.com/ipfs/go-ipfs-cmds v1 and v2

[lidel]

github.com/ipfs/go-ipfs-cmds has three retracted versions (go.mod):

• v1.0.22
• v2.0.1+incompatible
• v2.0.2+incompatible

The package is still at v0.x.x and we were unable to retract v1 and v2 versions correctly (created before go.mod existed), which leads to ecosystem issues (ipfs/go-ipfs-cmds#254 (comment)).

Is it possible to manually remove these three versions from pkgsite and mark v0 one as the latest?
(We don't have v1 and v2 tags in git repository)

Instead of

$ GOPROXY=https://proxy.golang.org GO111MODULE=on go list -m -versions github.com/ipfs/go-ipfs-cmds
github.com/ipfs/go-ipfs-cmds v0.0.1 v0.0.2 v0.0.3 v0.0.4 v0.0.5 v0.0.6 v0.0.7 v0.0.8 v0.0.9 v0.0.10 v0.1.0 v0.1.1 v0.1.2 v0.1.3 v0.1.4 v0.2.0 v0.2.1 v0.2.2 v0.2.9 v0.3.0 v0.4.0 v0.5.0 v0.6.0 v0.7.0 v0.8.0 v0.8.1 v0.8.2 v0.9.0 v0.10.0 v0.10.1 v0.10.2 v0.11.0 v0.12.0 v0.13.0 v1.0.22 v2.0.1+incompatible

We want:

$ GOPROXY=direct GO111MODULE=on go list -m -versions github.com/ipfs/go-ipfs-cmds
github.com/ipfs/go-ipfs-cmds v0.0.1 v0.0.2 v0.0.3 v0.0.4 v0.0.5 v0.0.6 v0.0.7 v0.0.8 v0.0.9 v0.0.10 v0.1.0 v0.1.1 v0.1.2 v0.1.3 v0.1.4 v0.2.0 v0.2.1 v0.2.2 v0.2.9 v0.3.0 v0.4.0 v0.5.0 v0.6.0 v0.7.0 v0.8.0 v0.8.1 v0.8.2 v0.9.0 v0.10.0 v0.10.1 v0.10.2 v0.11.0 v0.12.0 v0.13.0

[seankhliao]

removal only hides the documentation, it does not affect the versions the go command sees.

[seankhliao]

retractions do work for v2+incompatible, they just have to be on the highest v1 tag.

pkgsite can only hide entire modules, as you still want to use the other versions, i don't think a removal request is right.

[lidel]

@seankhliao thank you, but we did not see retractions of v2+incompatible to be working. Would appreciate some elaboration on what works and what does not, or some hint what we are doing wrong.

We DO have retractions in v0.13.0 (go.mod here) but they are not applied when GOPROXY=https://proxy.golang.org is used. Same with https://pkg.go.dev/github.com/ipfs/go-ipfs-cmds:

Are you saying that v0 updates are ignored by https://proxy.golang.org and the only way to fix this is if we publish v1?

Why retraction of v2+incompatible would work for v1 and not for v0? Is this limitation of proxy.golang.org or go tooling itself?

[seankhliao]

your retraction has to be at v1.0.23 or above (highest version regardless of retraction), the retraction can include itself.