| ▲ | quectophoton 3 hours ago | |
> you can use the 'replace' statement in your go mod to change where the Go build system will try to pull the dependencies from Heads up for anyone who doesn't know: this only works at the "top level". Any replace directives in your dependencies will be ignored[1]. So for example if you have a dependency tree like [main -> thirdpartyframework -> golang.org/x/net/http2], and thirdpartyframework uses a vulnerable version of `golang.org/x/net/http2`, you can't just fix it by patching the thirdpartyframework repository with a replace directive; no, because that would be too convenient. Instead, the replace directive needs to be at the main module, where it doesn't make sense and is inconvenient. Even though I like Go, it really seems like they don't care about anything other than monorepos. As soon as you need to work with forks, mirrors, or even just private modules[2][3], the tooling actively works against you. Also using your custom module proxy is a pain. [1] See: https://go.dev/ref/mod#go-mod-file-replace:~:text=replace%20... [2]: If you've only used private modules hosted on GitHub you might not have noticed too much pain because the Go tooling has hardcoded behavior specifically for GitHub and a few mainstream forges. You don't find out about this until you try to self-host something like Forgejo on your own domain thinking it would Just Work(tm), but it doesn't, and now you're left wondering why tf it works with GitHub but not with your own forge instance. [3]: I think there's no hardcoded code for SourceHut, so you might be able to experience the inconvenience by hosting private modules in there. | ||
| ▲ | Joker_vD 30 minutes ago | parent [-] | |
> Instead, the replace directive needs to be at the main module, where it doesn't make sense and is inconvenient. Wait, what? If you decide, in your own application, to force all your dependencies to use a specific version of golang.org/x/net/http2, then obviously you'd want to be able to put this directive into your own application's source instead of going around patching 3rd-party repositories (that's just rude). | ||