golang package thrift fails to install

[brad-jones]

Attempting to use go.mozilla.org/sops/decrypt, installing in a go modules based project with go v1.12

$ go get go.mozilla.org/sops/decrypt
go: finding go.mozilla.org/sops/decrypt latest
go: finding go.mozilla.org/sops latest
go: finding github.com/mozilla-services/yaml latest
go: finding github.com/goware/prefixer latest
go: finding github.com/howeyc/gopass latest
go: finding golang.org/x/oauth2/google latest
go: finding github.com/Azure/azure-sdk-for-go/services/keyvault/2016-10-01/keyvault latest
go: finding github.com/Azure/azure-sdk-for-go/services/keyvault/auth latest
go: finding github.com/Azure/azure-sdk-for-go/services/keyvault/2016-10-01 latest
go: finding github.com/Azure/azure-sdk-for-go/services/keyvault latest
go: finding github.com/Azure/azure-sdk-for-go/services latest
go: finding golang.org/x/oauth2 latest
go: finding google.golang.org/api/cloudkms latest
go: finding google.golang.org/grpc/codes latest
go: finding google.golang.org/grpc/status latest
go: finding go.mozilla.org/gopgagent latest
go: finding git.apache.org/thrift.git v0.12.0
go: git.apache.org/thrift.git@v0.12.0: unknown revision v0.12.0
go: error loading module requirements

It would appear the thrift project is now located at https://github.com/apache/thrift

[brad-jones]

This might be old news to some but just discovered this really neat feature of go modules, called replace.

For anyone else using go modules, just add the following into your go.mod:

replace git.apache.org/thrift.git => github.com/apache/thrift v0.12.0

see: https://github.com/golang/go/wiki/Modules#when-should-i-use-the-replace-directive

[autrilla]

This looks like an issue with your dependency management and not with sops? We vendor all our packages so this shouldn't happen at all.

[brad-jones]

For those that are using go modules or some other dependency management tool I have tracked down the root cause.

• go.mozilla.org/sops/decrypt depends on:
  • various packages such as golang.org/x/* which depend on:
    • cloud.google.com/go which depends on:
      • go.opencensus.io which depends on:
        • git.apache.org/thrift.git

see: census-instrumentation/opencensus-go#993

I believe this should resolve it's self once they release a new version with this commit census-instrumentation/opencensus-go@3b8e272

Until then the replace directive above works just fine.