x/exp/cmd/gorelease: report requirements on retracted module versions

[jayconrod]

A mechanism for retracting module versions is described in #24031, specifically in this comment.

gorelease should report an error if the module requires a retracted module version directly or transitively. This will help module authors avoid depending on retracted versions.

[jeanbza]

Impl note: go list -m -u, go list -retracted, and go get will note whether a dependency is retracted.

Impl note: definitely should report direct dependencies, maybe transitive.

[jayconrod]

In particular, the command below will list retracted dependencies in a machine-readable format.

go list -m -retracted -f '{{with .Retracted}}{{.Path}}@{{.Version}}{{end}}' all

[myitcv]

Arrived here on the back of trying out module retractions

Impl note: definitely should report direct dependencies, maybe transitive.

I would say definitely should report transitive deps. After all, a module is marked as retracted for at least the following reasons:

• A severe security vulnerability has been identified.
• A severe incompatibility or bug was discovered.
• The version was published accidentally or prematurely. (proxy.golang.org: accidentally publishing a major version interplays poorly with Go modules #34189)

(quoting #24031 (comment))

I would suggest this is a fairly important feature to land "soon". Reason being, gorelease will then become the go-to tool for people running CI checks on their modules (which is a good place to be).

[jeanbza]

(starting work in https://go-review.googlesource.com/c/exp/+/310370)

[gopherbot]

Change https://golang.org/cl/310370 mentions this issue: cmd/gorelease: report a diagnostic error for retracted dependencies

[jeanbza]

In particular, the command below will list retracted dependencies in a machine-readable format.

go list -m -retracted -f '{{with .Retracted}}{{.Path}}@{{.Version}}{{end}}' all

Note: this format seems to not work for me :(

deklerk at deklerk1 in /tmp/gorelease-load714449427
$ go list -m -u -retracted -f '{{with .Retracted}}{{.Path}}@{{.Version}}{{end}}' all
template: main:1:21: executing "main" at <.Path>: can't evaluate field Path in type []string
deklerk at deklerk1 in /tmp/gorelease-load714449427
$ go list -m -u all
gorelease-load-module
example.com/retract v0.0.0-gorelease [v0.0.1] => /tmp/gorelease892838020
example.com/retractdep v1.0.0 (retracted) [v1.0.1]

I'm able to get programmatic output with -json, though!

deklerk at deklerk1 in /tmp/gorelease-load714449427
$ go list -m -u -json all
{
	"Path": "gorelease-load-module",
	"Main": true,
	"Dir": "/tmp/gorelease-load714449427",
	"GoMod": "/tmp/gorelease-load714449427/go.mod",
	"GoVersion": "1.12"
}
{
	"Path": "example.com/retract",
	"Version": "v0.0.0-gorelease",
	"Replace": {
		"Path": "/tmp/gorelease892838020",
		"Dir": "/tmp/gorelease892838020",
		"GoMod": "/tmp/gorelease892838020/go.mod",
		"GoVersion": "1.12"
	},
	"Update": {
		"Path": "example.com/retract",
		"Version": "v0.0.1",
		"Time": "0001-01-01T00:00:00Z"
	},
	"Dir": "/tmp/gorelease892838020",
	"GoMod": "/tmp/gorelease892838020/go.mod",
	"GoVersion": "1.12"
}
{
	"Path": "example.com/retractdep",
	"Version": "v1.0.0",
	"Time": "0001-01-01T00:00:00Z",
	"Update": {
		"Path": "example.com/retractdep",
		"Version": "v1.0.1",
		"Time": "0001-01-01T00:00:00Z"
	},
	"Dir": "/tmp/gorelease_test-gocache487883119/pkg/mod/example.com/retractdep@v1.0.0",
	"GoMod": "/tmp/gorelease_test-gocache487883119/pkg/mod/cache/download/example.com/retractdep/@v/v1.0.0.mod",
	"GoVersion": "1.12",
	"Retracted": [
		"retracted by module author"
	]
}