Retract Go functionality - retract older package versions as insecure, incompatible, or broken

264 Views Asked by At

I have a problem with one of my project release, where we did a release 1.0, but it was a mistake that we later analysed and our actual stable release is 0.7 and in future also we will be doing minor changes, so we want to refrain our user to use 1.0 because if they do go get project, it will get the 1.0 version and we can't ask force someone to get the specific version using command go get [email protected].

Better I can implement retract, So if I put retract for v 1.0 then with a new release v0.8, will it work or Do I need to have a release greater than 0.1 ?

I have this confusion after reading all documentation as it is mentioned there- To retract a version, a module author should add a retract directive to go.mod, then publish a new version containing that directive. The new version must be higher than other release or pre-release versions; that is, the @latest version query should resolve to the new version before retractions are considered.

1

There are 1 best solutions below

0
On

I think you need to make a v1.0.1 that retracts both v1.0.0 and v1.0.1 to get the effect you want. Specifically, don't make any changes to a version you've already released, chances are that people will be fetching a cached copy rather than what's been checked in (and if they fetch the updated v1.0.0, they will be getting a checksum mismatch, as sum.golang.org is most likely going to have the checksum from the non-amended version).