x/pkgsite: package removal request for github.com/google/TPM/bindings/go

[josephlr]

We (Google) are currently publishing Golang bindings to the TPM 2.0 Reference implementation (in C) at:

https://pkg.go.dev/github.com/google/TPM

However, early on in our development, we inadvertently published a module at:

https://pkg.go.dev/github.com/google/TPM/bindings/go

which ended up not working due to restrictions on CGO and symlinks (see #44482). We now need to remove the github.com/google/TPM/bindings/go module from pkg.go.dev, it no longer exists in our latest release (v0.0.5) but the old version (v0.0.2) still shows up. See the picture:

This is similar to the issue described in: #78882

[madelinekalil]

Did you already publish a retraction for the module? https://go.dev/ref/mod#go-mod-file-retract

[josephlr]

I haven't.

The github.com/google/TPM/bindings/go module no longer exists, just the github.com/google/TPM module exists now, so I don't think we can retract the entire github.com/google/TPM/bindings/go module.

Is this correct?

[seankhliao]

You'll need to retract it with something like
retract [v0.0.0-0, v0.0.6] tagged in bindings/go/v0.0.6. It does not have to be on the main branch as long as it is tagged.

A retraction is necessary to fix any issues with go get.

[hyangah]

Please retract following the instruction in #79794 (comment)
Otherwise, the packages in v0.0.5 or in the future version (e.g. https://pkg.go.dev/github.com/google/TPM) won't be usable with the go command either. Removing pkgsite just hides the package from the documentation site.

However, looking at the current main branch, it looks like the go binding or go module is completely removed from the repo.
Does it mean that this repo is no longer used for Go?

[gopherbot]

Timed out in state WaitingForInfo. Closing.

(I am just a bot, though. Please speak up if this is a mistake or you have the requested information.)