Dependency issue

[cyrildever]

When doing a dependency update on one of my project where your btcd module is one of my indirect dependency, I face the following error trace:

go get: github.com/sammyne/bip32@v1.0.1 requires
	github.com/btcsuite/btcd@v0.0.0-20181013004428-67e573d211ac updating to
	github.com/btcsuite/btcd@v0.18.1: parsing go.mod:
	module declares its path as: github.com/gcash/bchd
	        but was required as: github.com/btcsuite/btcd

My fix so far is to use the following trick (but it's not a good idea in the long run IMO):

replace github.com/btcsuite/btcd v0.18.1 => github.com/btcsuite/btcd v0.22.0-beta

[c0mm4nd]

Interesting, visiting https://pkg.go.dev/github.com/btcsuite/btcd , but the project name is "bchd" (bchd is an alternative full node bitcoin cash implementation written in Go (golang).

[jcvernaleo]

Do you know if that page is auto generated or something? Because that definitely is not right.

[jcvernaleo]

I don't offhand see a place to request a correction.

[c0mm4nd]

AFAIK, it is auto generated when the first guy pulls (go get) the version through the google's goproxy server. But I dont understand how it occurs (maybe using the replace in gomod?).

[Roasbeef]

Weird, bchd is just a fork of this repo, and we've never pushed a tag related to it...

[Roasbeef]

If you click the version and select our latest version it shows up: https://pkg.go.dev/github.com/btcsuite/btcd@v0.22.0-beta

Maybe the issue was the bchd project not properly updating their modules file, and the go modules proxy just accepting w/e they pushed?

[cyrildever]

Actually, if you switch to tag v0.18.1, you'll see that the go.mod file refers to module github.com/gcash/bchd on the first declaration line.

I think that go mod download when used with Docker might have some weird way to fetch the latest version because it stops its search at v0.18.1, not "seeing" the v0.22.0-beta (as if it doesn't like / understand what means the -beta suffix). You might want to push a v0.22.1 version.

[chappjc]

Oh, I think I know what may have happened. Is it possible a btcd maintainer had a git workspace that had a bchd remote configured in the workspace as well? If in creating one of these recent legit btcutil tags, a git push --tags was done, that would have pushed all tags regardless of remote. I'm guessing when one of the recent btcutil tags were pushed, the bchd tags were accidentally pushed too.

[chappjc]

The module proxy feed at index.golang.org does seem to confirm that all the bchd tags were pushed to the btcd repository on Jan 11, 2022. https://index.golang.org/index?since=2022-01-11T03:33:21.831209Z&limit=300

{"Path":"github.com/btcsuite/btcd","Version":"v0.18.1","Timestamp":"2022-01-11T03:33:21.831209Z"}
...
{"Path":"github.com/btcsuite/btcd","Version":"v0.15.0","Timestamp":"2022-01-11T03:34:34.17333Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.14.6","Timestamp":"2022-01-11T03:34:34.265464Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.16.3","Timestamp":"2022-01-11T03:34:34.385764Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.16.4","Timestamp":"2022-01-11T03:34:34.617725Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.14.4","Timestamp":"2022-01-11T03:34:37.052558Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.16.5","Timestamp":"2022-01-11T03:34:38.846891Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.14.7","Timestamp":"2022-01-11T03:34:39.083168Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.14.2","Timestamp":"2022-01-11T03:34:39.249363Z"}
...
{"Path":"github.com/btcsuite/btcd","Version":"v0.17.1","Timestamp":"2022-01-11T03:34:43.761289Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.15.2","Timestamp":"2022-01-11T03:34:43.817043Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.14.1","Timestamp":"2022-01-11T03:34:43.979998Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.14.0","Timestamp":"2022-01-11T03:34:47.38878Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.18.0","Timestamp":"2022-01-11T03:34:48.080115Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.15.1","Timestamp":"2022-01-11T03:34:49.292897Z"}
{"Path":"github.com/hykuan/google-photos-api-client-go/v2","Version":"v2.2.0","Timestamp":"2022-01-11T03:34:51.55728Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.14.5","Timestamp":"2022-01-11T03:34:52.362006Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.16.2","Timestamp":"2022-01-11T03:34:52.746808Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.16.1","Timestamp":"2022-01-11T03:34:52.78377Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.14.3","Timestamp":"2022-01-11T03:34:54.696364Z"}
{"Path":"github.com/btcsuite/btcd","Version":"v0.17.0","Timestamp":"2022-01-11T03:34:56.895847Z"}
...
{"Path":"github.com/btcsuite/btcd","Version":"v0.16.0","Timestamp":"2022-01-11T03:35:02.196516Z"}
...
{"Path":"github.com/btcsuite/btcd","Version":"v0.22.0-beta.0.20220111032746-97732e52810c","Timestamp":"2022-01-11T03:36:13.701485Z"}
...
{"Path":"github.com/btcsuite/btcd/btcutil","Version":"v1.0.0","Timestamp":"2022-01-11T04:04:57.17875Z"}

Since the module sumdb has these recorded in it's transparent log (e.g. https://sum.golang.org/lookup/github.com/btcsuite/btcd@v0.18.1 and https://proxy.golang.org/github.com/btcsuite/btcd/@v/list), I think the only recourse for btcd is to put retract statements in btcd's go.mod for each of these bogus versions.

[Roasbeef]

I think the only recourse for btcd is to put retract statements in btcd's go.mod for each of these bogus versions.

Thanks for digging into this! Yeah I think this is our best option.

[Roasbeef]

Check out this PR: #1805

[Roasbeef]

Should be resolved by: #1805

I think we just need to push a new tag, and the modules proxy will stop serving those old bogus tags?

[theredrad]

I got this problem recently and agree with @Roasbeef to release a new tag