1

It's a go module question. My PC is running with go 1.13 and go module mode is on.

This my go env:

GO111MODULE="on"
GOPRIVATE=""
GOPROXY="https://goproxy.io,direct"

At first I wrote a public package for testing and uploaded it to github. And then I "go get" this package for independence. After that I made it private and even deleted it from github (I tried "git clone" and couldn't download it again). But I could "go get" it after I removed it from github. Soon I realized it that maybe this package was cached in goproxy.io or other proxy databases. So I set GOPROXY="direct" and "go get" this package again and failed. This action proved my guess.

Now it's my question:

  1. How to remove this whole package from goproxy.io or other database.
  2. Is there a safe way to use go module, I don't want to upload my private code to other databases by mistake.

I tried to STFW and found nothing. Thank U to all people for reading and answering this question.

alessiosavi
  • 2,753
  • 2
  • 19
  • 38
mrchang2017
  • 39
  • 1
  • 7
  • You can use Go modules and publish your packages to a private repository. – Adrian Feb 07 '20 at 17:10
  • Per the [goproxy.io homepage](https://goproxy.io/) you can use `GOPRIVATE=*.corp.example.com` to specify domains that house private repos explicitly while still using the proxy for public repos. – Adrian Feb 07 '20 at 17:13
  • 4
    You published your package publicly; it is (or at least, that version was) not a private package. Once published, anyone could have downloaded it, saved it, republished it - it's the internet, once something is published you can unpublish it but you can never take it back. – Adrian Feb 07 '20 at 17:17

2 Answers2

4

If you accidentally published a package / module you intend to be private, then go.dev: About page:

Removing a package

If you would like a package removed, please send an email to go-discovery-feedback@google.com, with the import path or module path that you want to remove.

But as Adrian mentioned in the comments, there is no guarantee that no one downloaded your published packages.

If you want some packages / modules to remain private, you may enumerate them (using glob patterns) in the GOPRIVATE, GONOPROXY, GONOSUMDB environment variables, which are respected by the go tool.

Command go: Environment variables:

GOPRIVATE, GONOPROXY, GONOSUMDB
  Comma-separated list of glob patterns (in the syntax of Go's path.Match)
  of module path prefixes that should always be fetched directly
  or that should not be compared against the checksum database.
  See 'go help module-private'.

From command go help module-private:

The GOPRIVATE environment variable controls which modules the go command considers to be private (not available publicly) and should therefore not use the proxy or checksum database. The variable is a comma-separated list of glob patterns (in the syntax of Go's path.Match) of module path prefixes.

These vars can also be set using the go env -w command. You may get more help about it using go help env.

icza
  • 389,944
  • 63
  • 907
  • 827
0

For Question2, I have tried several times today. If u want to build a private package safely, the most important thing you should do is setting the GOPRIVATE BEFORE u build your package. And GONOPROXY,GONOSUMDB will be automatically set to same as GOPRIVATE. Now u can write the code and git push to a private remote repo and try to go get it, and u will fail and see some error message like it:

fatal: could not read Username for 'https://github.com': terminal prompts disabled Confirm the import path was entered correctly. If this is a private repository, see https://golang.org/doc/faq#git_https for additional information.

The link show us that we should use https link with your username/password or just replace your https link with ssh link if u upload a key to remote ropo. After doing it, u will succeed to go get it from your source address (your package name) but NOT PROXY.

Futhurmore, let's delete all go module cache by using go clean -modcache and set GOPRIVATE="". I will test whether our private package was uploaded to proxy.

case 1: Set GOPROXY="https://goproxy.io" or other proxy and thenen go get the private package. u will face a 404 Not Found which show u that u find NOTHING from proxy (it meant nothing was cached/stored in proxy) .

case 2: Set GOPROXY="direct"(use the direct address of your pacakage name) and then go get the private package. u will face error message like it:

verifying {PACKAGENAME}: {PACKAGENAME}: initializing sumweb.Conn: checking tree#{ID}: Get https://sum.golang.org/tile/8/2/000.p/11: dial tcp {IP}:{PORT}: i/o timeout.

The go get function will try to check the checksum from golang.org database with your package (I can't link to google server directly so it shows timeout error / I guess u will get 404 if u can link to google server). It shows that if we try to go get a private package with not setting GOPRIVATE, u will fail because u can not pass the check.

Suggestion: If you want to build your private go package, u should set your GOPRIVATE firstly and make sure it is wide enough to INCLUDE your package name.

Thank U to all people for reading and answering this question.

mrchang2017
  • 39
  • 1
  • 7