On: GitHub shouldn't allow username reuse

[Demiurge]

I tried to debug Go project once, and the moment I saw that, I was completely shocked that it was importing from github urls, without even tags, or versions as far as I could tell. It seems dangerous to rely on a for-profit host and individual users. If 'network' dependencies are part of the language, it should at least be non-profit, or better Go project managed host. There are many examples, like PyPi, or PECL.

[ovao → Demiurge]

Go doesn't specifically rely on GitHub, but it can pull in dependencies with a simplified URL that points to a git repository hosted on GitHub. This is possible because GitHub renders an HTML meta tag on project pages that the go tool can reference to fetch information about the repository.

Anyone can actually 'reflect' dependencies hosted with various VCS with this method, and gopkg.in does essentially this (while adding version pinning).

[ioddly → ovao]

> Go doesn't specifically rely on GitHub, but it can pull in dependencies with a simplified URL that points to a git repository hosted on GitHub. This is possible because GitHub renders an HTML meta tag on project pages that the go tool can reference to fetch information about the repository.

Is there somewhere I can read more about this tag? Opened up the source of one of my repos and I couldn't find it.

[detaro → ioddly]

https://golang.org/cmd/go/#hdr-Remote_import_paths

<meta name="go-import" ...> tags

[ioddly → detaro]

Thank you! I didn't think to check the Go docs.

[strkek → ovao]

The only drawback I see to this approach is that adding a new method is not trivial, and requires recompiling the `go` executable.

Makes it more difficult to implement a handler for the BitTorrent protocol to `go get` from a DHT, just for the sake of mad science.

[Klathmon → strkek]

That sounds like an incredible idea!

Has anyone tried to do something like this before? I would absolutely run a torrent server to serve up my own and others' open source packages.

[ovao → Klathmon]

To my knowledge it hasn’t been tried. It shouldn’t be too difficult to author a tool to do so, which could itself be made go-gettable. With this you’d avoid the mess of shipping an alternate build of the go tool and all that entails.

[comex → ovao]

This project was fairly close to that idea:

https://github.com/cjb/GitTorrent

I think it’s abandoned though.

[Klathmon → ovao]

Yeah, the more I think about it the easier it seems.

You could probably write "plugins" or shims/wrappers for most package managers out there pretty easily.

And a great MVP would just be the ability to install from a magnet link.

[strkek → Klathmon]

I read somewhere that big companies use BitTorrent internally to update their codebase.

But yeah, I'd really like for someone to develop a VCS like that (even more if it's in Go, with no Cgo, and under BSD, MIT or Apache license). It'd make distribution, immutability and mirroring so much easier.

[detaro → Klathmon]

There is https://github.com/whyrusleeping/gx (based on IPFS instead of torrents, but they work extremely similarly for this use case)

[dewey → Demiurge]

That's what vendoring and dependency tools are for.

[crdoconnor → Demiurge]

That was the first wtf I hit when learning go that made me think that it possibly wasn't all it was cracked up to be.

[sannee → Demiurge]

> It seems dangerous to rely on a for-profit host

Unfortunately, "non-profit" hosts are somewhat in a short supply.