Don't couple your Go code to GitHub

bbirdculture about 4 hours ago 25 commentsRead Article on iain.rocks

RU version is available. Content is displayed in original English for accuracy.

⚡ Community Insights

Discussion Sentiment

56% Positive

Analyzed from 934 words in the discussion.

Discussion (25 Comments)Read Original on HackerNews

thih9•about 1 hour ago

> In my opinion, every commerical software development team using Go should be using custom domains for namespacing their internal libraries and packages.

I’d remove “go” from the above, i.e. I think same applies to other stacks.

Even using GitHub domain links in code comments gets problematic long term. Ie when a migration happens and those links start pointing nowhere.

mort96•about 1 hour ago

I mean yeah, but other languages don't make it quite so easy to make this mistake. Once your Go project gets to a size where it makes sense for different files to live in different folders (which, given Go's folder-based module system, often happens at just a couple hundred lines of code), the most straightforward way which the tooling nudges you towards means putting GitHub URLs (or URLs to whatever git host website you happen to use) in your source code.

handoflixue•about 1 hour ago

I'm confused by the article, and this comment, treating these URLs as difficult to replace.

Why can't you just search-and-replace? Presumably all of them refer to "GitHub.com" and not much else code will, so I'd think this was an exceptionally easy case.

Even easier for comments, since them being obsolete for a few hours during a migration doesn't exactly break anything.

mort96•42 minutes ago

I've gone through such a migration. Huge Go code base distributed across a lot of git repositories had to be moved to a different git host.

It was horrible. A team of people spent weeks. Different projects depended on different versions of the same internal libraries, we had to create a branch for each depended-on commit and make a version of that commit with the new URLs. The expressed goal was to end up with a system that's "exactly the same" as the old, just on a new host. Changing which version of libraries projects depends on would introduce unnecessary risk.

And the result is a code base where bisects are broken and where it's impossible to build an old version of any of the code without a ton of work.

mbreese•5 minutes ago

What about anyone else using your code? You can find and replace your own code, but do you have access to all of the code relying on your go library? Is it all yours? Customers? Other developers?

Even in the case where it’s an internal only Lu array, it can be complicated to refactor a library name.

lelandbatey•38 minutes ago

Even easier than that, you can use the 'replace' statement in your go mod to change where the Go build system will try to pull the dependencies from; you can point to a folder on disk or to another forge, and if you want total control you can indirect everything to your own artifact cache via GOPROXY (which can be something as simple as a static folder of source code).

The "module name is network path" is a convenient convention but not at all some "limitation" of the tooling.

mort96•36 minutes ago

And now all your source files contain URLs to abandoned infrastructure. Is that what you'd want long term?

gravypod•about 1 hour ago

It's harder to replace in history.

gumby•about 1 hour ago

Seems like an error to use a URL. This is perfect for a URN or some other form of URI.

It could be a URN that used the DNS as a back end (though that’s a lot like a URL) so better would be something more abstract with multiple possible resolvers and a signature.

dewey•34 minutes ago

> That is, if you move your git hosting to GitLab then you have to change your code!

You can also just use "replace github.com/example/example => gitlab.com/example/example" in your go.mod file and everything will keep working. That seems like a very pre-mature optimization for something that doesn't really matter.

mort96•25 minutes ago

And you'll just leave references to abandoned infrastructure in your code forever?

SenHeng•about 3 hours ago

GitHub is almost forever. Your custom domain disappears when you stop paying the bills, which if you’re an open source developer has a higher likelihood than GitHub disappearing.

One day, we’re all going back to vendoring dependencies.

otterley•about 3 hours ago

Why did we stop vendoring dependencies in the first place?

collabs•about 1 hour ago

Because it sucks. But maybe it should suck? It would make us think twice before adding dependencies.

I use dotnet and I never liked seeing dlls and binary files in my diffs. I would argue if we are adding vendor code to our projects, we should demand the FULL source code instead of dlls. Maybe it is already possible with things like x unit. I have never given it much thought... But then that vendoree code has to come from somewhere as well, right? I mean there is something to be said about provenance or something here?

Sorry if this feels like a stream of consciousness because it is ↔

otterley•14 minutes ago

Vendoring dependencies doesn’t necessarily mean you have to include binary objects in your repo. They could be content-addressable artifacts in your org’s private blob store.

metaltyphoon•about 1 hour ago

Because its not as convenient

otterley•15 minutes ago

Can you elaborate?

prasadvara•about 4 hours ago

Isn't this going to introduce the dependency of domain management? I understand the positive side of it, but put some infra level manamgment layer to individual Open Source devs, just a thought. But yeah, positives vs negatives weigh and pick.

andreashaerter•about 3 hours ago

There are also a few Hugo templates for vanity import paths.

Here's mine: https://github.com/foundata/hugo-theme-govanity (e.g. used at https://golang.foundata.com/ )

And yes I'm aware of the irony of hosting this on GitHub... still figuring out a good workflow for maintaining our OSS on Codeberg and GitHub in parallel fed from the internal forge. The dependency on our own domain is real but we favor it.

bionsystem•43 minutes ago

braid has been a treat for us to manage external dependencies. Much cleaner than submodules.

0xbadcafebee•41 minutes ago

Even better reason: you can later point this domain at an artifact registry. This not only gives you reliability and flexibility, it also secures your software supply chain. You don't need an SBOM or anything fancy to get started, just pull all your artifacts into a central source and improve it over time. Install an artifact registry anywhere you can run a container, use dumb static shared credentials, and start with "proxy mode". Later on you can pin or restrict versions, verify checksums, implement SSO, etc. This is going to become table stakes in the new security landscape.

prasadvara•11 minutes ago

You don't need an SBOM or anything fancy to get started

-- Curious how this avoids SBOM need?

skybrian•about 1 hour ago

Not really convinced. I'd rather it stayed on Github so it doesn't disappear. Particular for businesses whose priorities might change.

racingmars•41 minutes ago

> I'd rather it stayed on Github so it doesn't disappear. Particular for businesses whose priorities might change.

People can delete projects from GitHub. Businesses whose priorities might change may not keep an old project set to public up on GitHub because they won't want people to continue contacting them for support, or they don't want to be responsible for updating security vulnerabilities for projects they are abandoning so they'd rather just pull it offline, etc.

Whether the library you're importing is hosted on GitHub or not, never assume it will be there tomorrow. *Always vendor your dependencies.*

skybrian•15 minutes ago

I believe they'd also be cached by proxy.golang.org? But companies should probably run their own proxy.