modules: unable to import latest tagged version (v2.2.0)

[theckman]

Summary

Because the go.mod file at v2.2.0 doesn't include the SIV component of its import (/v2), you cannot go get github.com/securego/gosec/v2@v2.2.0.

Steps to reproduce the behavior

go get github.com/securego/gosec/v2

go get github.com/securego/gosec/v2@v2.2.0

Expected behavior

Package installs successfully.

Actual behavior

The command fails with different cryptic errors:

$ go get -u github.com/securego/gosec@v2.2.0
go get github.com/securego/gosec@v2.2.0: github.com/securego/gosec@v2.2.0: invalid version: module contains a go.mod file, so major version must be compatible: should be v0 or v1, not v2

$ go get -u github.com/securego/gosec/v2
go get github.com/securego/gosec/v2: module github.com/securego/gosec@upgrade found (v0.0.0-20200401082031-e946c8c39989), but does not contain package github.com/securego/gosec/v2

$ go get -u github.com/securego/gosec/v2@v2.2.0
go get github.com/securego/gosec/v2@v2.2.0: github.com/securego/gosec@v2.2.0: invalid version: module contains a go.mod file, so major version must be compatible: should be v0 or v1, not v2

If you pull master it works, but that's not super ideal:

$ go get -u github.com/securego/gosec/v2@master
go: downloading github.com/securego/gosec v0.0.0-20200330112059-e030aa4f768b
go: downloading github.com/securego/gosec/v2 v2.2.1-0.20200424144625-ee3146e63716
go: github.com/securego/gosec/v2 master => v2.2.1-0.20200424144625-ee3146e63716
go: downloading github.com/securego/gosec v0.0.0-20200316084457-7da9f46445fd
go: downloading golang.org/x/tools v0.0.0-20200422022333-3d57cf2e726e
go: golang.org/x/tools upgrade => v0.0.0-20200502202811-ed308ab3e770
go: golang.org/x/xerrors upgrade => v0.0.0-20191204190536-9bdfabe68543
go: downloading golang.org/x/tools v0.0.0-20200502202811-ed308ab3e770

Proposed Fix

I think this can be addressed by cutting v2.3.0 on a commit on or after c6e10af

[ccojocar]

This should be fixed in the upcoming release c6e10af

[ccojocar]

The v2.3.0 was just released and now this seems to work properly:

$ go get github.com/securego/gosec/v2@v2.3.0
go: downloading github.com/securego/gosec/v2 v2.3.0

Closing it for now. Thanks for reporting!