* Jan Mercl <0xj...@gmail.com> [210120 15:27]: > On Wed, Jan 20, 2021 at 9:03 PM Marvin Renich <m...@renich.org> wrote: > > > I still cannot find any mention of reserved import paths in any > > documentation (go help modules/importpath/gopath). It's just an issue > > on the tracker. > > When an important part of the implementation is undocumented then it's > a documentation bug, hence the issue.
Absolutely. I note the bug has been open for more than 18 months. > Import path is not an URL. The Go build system in GOPATH does not > interpret import paths as URLs. It's only the go get command that uses > a well defined function for going from import path to URL to > download/update repositories. > > From the POV of the build system, Import paths refer to file system > locations, again using a well defined function for that. Agreed. However, what I seem to be hearing about module mode is different. Perhaps I am misunderstanding. > > Changing this for GOPATH > > mode would, in my mind, be a major breaking change. > > IMO it's a security issue that needs to be fixed. If anything puts a > replacement of some stdlib package in your $GOPATH then you may have a > problem. > > Even on an uncompromised system, using the reserved path may in future > clash with a new package of the same name added to stdlib, producing a > log of confusion about why this bunch of packages build just fine and > the rest does not. GOPATH build mode searches GOROOT first, so no security issue. Name clash with future stdlib package is an issue, but much easier to deal with. Public discussion about reserving an import namespace is still important. If we had had this discussion prior to Go 1, I would have suggested using one, well-known name for the first component of standard library packages; perhaps "_stdlib". Too late for that now. > > I have never seen any mention of this issue on golang-nuts, though I > > certainly could have missed it. Perhaps some discussion took place on > > golang-dev. For a change this important, I would expect it to be > > publicized much better. If this is only going to affect module mode, > > that is a different matter. > > I don't recall where I became aware of the linked issue. It's too long ago. I did not intend for this to sound like a complaint directed at you. I appreciate your pointing it out to me. If the developers working on this intend to make GOPATH mode fail for a large number of existing local packages, I would appreciate it if they would say something on golang-nuts. This is somewhat different from deprecating the use of first-level, non-dot names, but still allowing them if they don't clash with stdlib packages. ...Marvin -- You received this message because you are subscribed to the Google Groups "golang-nuts" group. To unsubscribe from this group and stop receiving emails from it, send an email to golang-nuts+unsubscr...@googlegroups.com. To view this discussion on the web visit https://groups.google.com/d/msgid/golang-nuts/20210120215112.f6hzzkpwhrjrqzep%40basil.wdw.
