{"id":15761769,"url":"https://github.com/kuritka/go-modules-demo","last_synced_at":"2025-03-31T09:30:23.399Z","repository":{"id":84233008,"uuid":"243525252","full_name":"kuritka/go-modules-demo","owner":"kuritka","description":null,"archived":false,"fork":false,"pushed_at":"2020-07-22T07:58:20.000Z","size":10,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"master","last_synced_at":"2024-10-11T11:21:20.094Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/kuritka.png","metadata":{"files":{"readme":"Readme.MD","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2020-02-27T13:25:05.000Z","updated_at":"2020-07-22T07:58:23.000Z","dependencies_parsed_at":"2023-05-24T01:45:08.798Z","dependency_job_id":null,"html_url":"https://github.com/kuritka/go-modules-demo","commit_stats":null,"previous_names":["kuritka/gomodules"],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuritka%2Fgo-modules-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuritka%2Fgo-modules-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuritka%2Fgo-modules-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/kuritka%2Fgo-modules-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/kuritka","download_url":"https://codeload.github.com/kuritka/go-modules-demo/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246446667,"owners_count":20778857,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-10-04T11:04:16.976Z","updated_at":"2025-03-31T09:30:23.372Z","avatar_url":"https://github.com/kuritka.png","language":"Go","funding_links":[],"categories":[],"sub_categories":[],"readme":"# go modules\n\nThe demo is testing go modules \n\n\n\n### init\n\ninitialize  project \n```bash\ngo mod init github.com/kuritka/gomodules\n```\n\nwhich creates \n```bash\n\nmodule github.com/kuritka/gomodules\n\ngo 1.12\n\n```\n\n\nafter downloading  `go get github.com/gorilla/mux` file `go.sum` will appear and \n`require  github.com/gorilla/mux v1.7.3 //indirect` will appear.\n`//indirect` says that dependency is not used yet. After using mux and rebuild , `//indirect` dismiss \n\n\n\n - `go list` - shows module we are working on\n\n - `go list all` - shows all dependencies which we rely\n\n - `go list -m all` - shows all modules we use and their versions\n     ```bash\n    github.com/kuritka/gomodules\n    github.com/gorilla/mux v1.7.4\n     ```\n \n - `go list -m -versions github.com/gorilla/mux` touch repo and shows all available versions, i.e.\n `github.com/gorilla/mux v1.2.0 v1.3.0 v1.4.0 v1.5.0 v1.6.0 v1.6.1 v1.6.2 v1.7.0 v1.7.1 v1.7.2 v1.7.3 v1.7.4`\n \n \n ## go.sum\n \n go.sum contains info like :\n ```bash\ngithub.com/gorilla/mux v1.7.4 h1:VuZ8uybHlWmqV03+zRzdwKL4tUnIp1MAQtp1mIFE1bc=\ngithub.com/gorilla/mux v1.7.4/go.mod h1:DVbg23sWSpFRCP0SfiEN6jmj59UnW/n46BH5rLB71So=\n``` \n\nhash is retreived after go downloaded dependency. It is uniqueue based on source code.\nWe can verify by `go mod verify` \n\n\n`%GOPATH%/pkg/mod/` - after `go get ` package is downloaded here. This is module chash . It is loaded here and build system looks here for downloaded packages.\n\nIf I modify file manually within `%GOPATH%/pkg/mod/github.com/gorilla.MUX/..` than `go verify` will generate another hash and saying that's wrong.\n\nBUT: `go build .` will still work!! , thre reason why verifying is splitted from building is that **verifying is expensive operation** because all dependencies must be recalculated.  \nhash is also computed from file date, so even if you have two identical files with different date, hash will differ! \n\n### it means that in the build pipeline `go mod verify` must be called before `go build` in PROD \n     \nOnly one way how to fix corrupted module is to delete from  `%GOPATH%/pkg/mod/` and than tun `go get \\ go mod vendor` again.\n    \n     \n## managing modules\n\nLet's imagine that after refactoring app you don't need some library packages anymore (i.e. remove gorilla/mux).\n After investigate `go build .` you find that `go.mod` is not modified and and references are still there. And reference is not `//indirect`\n\ngo.mod looks like this:  \n```bash\nmodule github.com/kuritka/gomodules\n\n//gomodules will be the name of executable\n\ngo 1.12\n\nrequire github.com/gorilla/mux v1.7.4\n```\n\nTo remove unused dependencies we call \n\n```bash\ngo mod tidy\n```\n        \n        \n## Versions\n\n`v1.5.3-pre1` - true accross all module version\n\n - `v` - required\n \n - `1` - **major version**, within major version we guarantee backward compatibility! Anything with major version 1 should be compatible with major version 1\n        \n - `5` - **minor revision** - if we add new features (no changes in current API, don't break existing contracts), Doesn't break backward compatibility\n \n - `3` - **patch** - bug fixes, no new features, doesn't break backward compatibility\n  \n - `pre1` - **pre-release identifier** - text is arbitrary. ordered in alphabetical manner. `pre1` is less than `pre2` and `alfa` is less then `beta`. If we don't specify conrete version with identifier, lates version without identifier is downloaded by default.\n \n    ```bash\n    go list -m -versions rsc.io/quote\n    rsc.io/quote v1.0.0 v1.1.0 v1.2.0 v1.2.1 v1.3.0 v1.4.0 v1.5.0 v1.5.1 v1.5.2 v1.5.3-pre1\n    ```\n   \n   ```bash\n   go get rsc.io/quote\n   # downloads v1.5.2 as default \n   ```\n   \n   \n     \n \n https://semver.org  \n \n i.e. `ithub.com/gorilla/mux v1.2.0 v1.3.0 v1.4.0 v1.5.0 v1.6.0 v1.6.1 v1.6.2 v1.7.0 v1.7.1 v1.7.2 v1.7.3 v1.7.4`\n \n ---\n \n ### rules\n There are still a lot of libraries out there which didn't follow go versioning rules.\n \n####rules for version v2+####\n - backward compatibility should be preserved within major version\n \n - Each major vesrion has unique import path:\n    `import github.com/gorrile/mux/v2`  \n    \n    btw: it is just illustration, gorrila doesnt have v2\n    ```bash\n        $ go list -m -versions github.com/gorilla/mux/v2\n        go: finding github.com/gorilla/mux/v2 latest\n        github.com/gorilla/mux/v2\n    ```\n   \n   \n```bash\ngo list -m -versions rsc.io/quote\nrsc.io/quote v1.0.0 v1.1.0 v1.2.0 v1.2.1 v1.3.0 v1.4.0 v1.5.0 v1.5.1 v1.5.2 v1.5.3-pre1```\n\ngo list -m -versions rsc.io/quote/v2\nrsc.io/quote/v2 v2.0.0 v2.0.1\n\ngo get rsc.io/quote\n# within go.mod you find this: require rsc.io/quote v1.5.2 // indirect\n```\n\n## regardiong example - if you don't explicitly give version 2 or higher, it downloads always latest from v1 !!## \n\nyou may have multiple versions simultaniously  \n```bash\n\u003cgo.mod\u003e\n    require (\n\t    rsc.io/quote v1.5.2\n\t    rsc.io/quote/v2 v2.0.1\n    )\n\n\u003cgo.mod\u003e\n    import (\n    \t\"rsc.io/quote\"\n    \tquotev2 \"rsc.io/quote/v2\"\n    )\n\n\u003cmain.go\u003e\n\tfmt.Println(quote.Hello())\n\tfmt.Println(quotev2.Hello())\n```\n\nWe can pull\n \n - specific version `@v1.7.2` \n - version prefix `@v1`\n - Latest `@latest`;  `go get github.com/gorilla/mux@latest`\n - Specific commit `@c9b2812`\n - Specific commit `@master` ; `go get github.com/gorilla/mux@master` - shows v1.7.4-c9282.. because it presunmes that newer version is 1.7.4 (command was exexcuted during time when 1.7.3 was the highest)  \n - Comparison `@\u003e=1.7.2`\n\n\nI can download gorilla mux by `go get github.com/gorilla/mux@v1.7.2` and `go get github.com/gorilla/mux@v1.6.1`\nWhat will be in go mod file ?\nFirst `go.mod` contains `github.com/gorilla/mux@ v1.7.2` and than it is changed to `github.com/gorilla/mux@ v1.6.1` .\nIf the major version is same it means that there is backward compatibility \n\n  \n## Advanced go mod techniquest\n\n### get\n\n`go mod get` downloads package from repo or cache and modify `go.mod`, `go.sum`\n\n### why\nanalytical tool  explores where module comes from\n\nThis is shown for `// indirect` \n```bash\ngo mod why github.com/gorilla/mux\n(main module does not need package github.com/gorilla/mux)\n```\n\n\nThis is shown for `// indirect` \n```bash\ngo mod why github.com/gorilla/mux\n(main module does not need package github.com/gorilla/mux)\n```\n\nand dependency graph is shown if gorrila mux is used :\n```bash\ngo mod why github.com/gorilla/mux\n# github.com/gorilla/mux\ngithub.com/kuritka/gomodules\ngithub.com/gorilla/mux\n```\n\n### graph\n\ngraph shows what is dependent on the left and dependencies on the right.\nif package has dependencies, it is shown in the table. In the example below you see  rsc.io has dependencies. \n```bash\ngo mod graph\ngithub.com/kuritka/gomodules github.com/gorilla/mux@v1.7.4\ngithub.com/kuritka/gomodules rsc.io/quote@v1.5.2\nrsc.io/quote@v1.5.2 rsc.io/sampler@v1.3.0\nrsc.io/sampler@v1.3.0 golang.org/x/text@v0.0.0-20170915032832-14c0d48ead0c\n```\n\n### edit\n \n`go mod edit` is commad used for scripting go mod file\n\n- `go mod edit -require github.com/gorilla/context@v1.1.1` adds  line to require\n- `go mod edit -go 1.10` change version in `go.mod` file to `go 1.10`\n- `go mod edit -droprequire github.com/gorilla/context` drops line where `github.com/gorilla/context v1.1.1` appear\n- `go mod edit -exclude  github.com/gorilla/mux@v1.7.2` excludes `gorilla/mux@v1.7.2`. If we downloadin `gorilla/mux@v\u003e=1.7.1` it excludes `1.7.2` so `1.7.3` will be downloaded\n- `go mod edit -print` prints mod file\n- `go mod help` shows all posisible commands\n\n\n### download\n\n`go mod download` downloads all dependencies from `go.mod` file to `module cache`\n\n### vendor\nanalyze project , and finds all references. Creates `vendor` directory and populate that. \n`go mod vendor` vendors all repos. If you don't want to download from internet in production pipeline, or you are out of `%GOPATH%` , you can vendor your dependencies.\n\nIf you use `vendor` directories, you import all references from `vendor` . Not some of them from `vendor` and some of them from `module cache`.\n\n`vendor` is good thet you can deploy exact package versions with your code without downloading from the internet\n\nbecause `vendor` analyze your references, it also updates `go.mod` file automatically by package version it downloads\n\n\n### cleaning cache\n```shell script\ngo clean -modcache\n```\n\n### readonly \n\n`go build -mod=readonly .` says that nobody can modify mod file when build is under way. reccomendation is to use that in production build .\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkuritka%2Fgo-modules-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fkuritka%2Fgo-modules-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fkuritka%2Fgo-modules-demo/lists"}