Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Is go-cose v1.2.0 mis-released? #152

Closed
shizhMSFT opened this issue Jul 3, 2023 · 3 comments
Closed

Is go-cose v1.2.0 mis-released? #152

shizhMSFT opened this issue Jul 3, 2023 · 3 comments
Assignees
@setrofim @qmuntal @thomas-fossati @yogeshbdeshpande
Labels
bug Something isn't working

Comments

@shizhMSFT
Copy link
Contributor

What is the areas you experience the issue in?

Go-COSE Library

What is not working as expected?

dependabot sents PRs for upgrading go-cose from v1.1.0 to v1.2.0. For instance: notaryproject/notation-go#329

The godoc for v1.2.0 is available but there is no tag or release in this repo related to 1.2.0.

@setrofim @yogeshbdeshpande @qmuntal @thomas-fossati Is v1.2.0 mis-released? If so, we should retract the release, and the next release should be v1.3.0.

What did you expect to happen?

In go.mod, have an entry

retract (
    v1.2.0 // Published accidentally.
    v1.2.1 // Contains retractions only.
)

How can we reproduce it?

PS D:\Test\go> go get github.com/veraison/go-cose
go: downloading github.com/veraison/go-cose v1.2.0
go: added github.com/fxamacker/cbor/v2 v2.4.0
go: added github.com/veraison/go-cose v1.2.0
go: added github.com/x448/float16 v0.8.4

Describe your environment

All platforms

What is the version of your Go-COSE Library?

v1.2.0
@shizhMSFT shizhMSFT added the bug Something isn't working label Jul 3, 2023
@setrofim setrofim mentioned this issue Jul 3, 2023
Merged
@shizhMSFT
Copy link
Contributor Author

@setrofim I've noticed that #153 was merged. Would you like to tag b67457d as v1.2.1?

@shizhMSFT
Copy link
Contributor Author

Closing this issue as v1.2.0 has been successfully retracted.

image

@lrascao lrascao mentioned this issue Mar 6, 2024
Closed
alpianon added a commit to alpianon/core-provider that referenced this issue Apr 28, 2024
@alpianon
bump indirect dependency (go-cose) to non-retracted version
ad2be35 
core-provider depends on github.com/Microsoft/[email protected] which
in turn depends on github.com/veraison/[email protected].
However, go-cose v1.2.0 has been retracted and is no longer
available: veraison/go-cose#152
So it needs to be manually bumped to the next (non-retracted)
version, which is v1.2.1

Signed-off-by: Alberto Pianon <alberto@pianon>
@orsenthil
Copy link

Even the 1.2.1 is retracted https://pkg.go.dev/github.com/veraison/go-cose?tab=versions

@shizhMSFT shizhMSFT mentioned this issue Jul 19, 2024
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@setrofim setrofim

@qmuntal qmuntal

@thomas-fossati thomas-fossati

@yogeshbdeshpande yogeshbdeshpande

Labels
bug Something isn't working
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
6 participants
@orsenthil @setrofim @qmuntal @thomas-fossati @yogeshbdeshpande @shizhMSFT