cmd/go: include vcs revision in module .info files
seankhliao opened this issue · 7 comments
It would be nice to have a way to tell which revision the proxy saw when it got a version from upstream. While this information isn't needed most of the time, it is helpful in debugging sum mismatches / moved tags. Currently to do so we can only download from both upstream and the proxy and diff the directories.
proxy.golang.org just forwards on the .info files generated by the go command.
It wouldn't be too hard to add optional fields to .info files.
But I should point out that these files aren't authenticated, and it's possible they can change over time or be reported differently by different proxies. I think the go command would have to ignore this information when reporting security errors.
cc @matloob as well.
I agree they shouldn't be considered for reporting security errors just for humans identifying issues, I don't think the information would be reliably available either (old versions, mod as vcs)
It would be easier to investigate issues like #46348 if the vcs revision info was available.
I agree, this would make life a lot easier than e.g the steps that I had to take here:
argoproj/argo-rollouts#2065 (comment)
Which took about 1-2 hours of troubleshooting to pin down. Maybe someone who is more familiar would be faster but that was not me. In particular the Go command abstracts a lot and cleans up downloaded files, so it's not easy to verify, what is the proxy URL being hit, what is the command being run to fetch data from the upstream, etc.
Did #53644 solve this? In particular, see: https://go-review.googlesource.com/c/go/+/411397
This is done. If you run with GOPROXY=off you will see them in all your info files that come from git.
If you are using a proxy then it depends on what the proxy serves.
By default Go uses proxy.golang.org, which serves the vcs info in info files it has gathered since Go 1.19 was released.
For example: https://proxy.golang.org/golang.org/x/build/@v/v0.0.0-20220810151148-671cb44b90c4.info
Older info files known to the proxy have not been refreshed, so you will see a mix of with and without vcs that way.