mod: justify mod style

[sysulq]

In this way, we can get the right tag like v1.1.3, instead of pseudo-version

A good example would be shown below

https://github.com/stretchr/testify/blob/master/go.mod
https://github.com/andrewstuart/go-robinhood/blob/master/go.mod#L8

go-robinhood imports github.com/stretchr/testify/assert and got the right version

github.com/stretchr/testify v1.2.2

[sysulq]

@ugorji please consider to merge this PR, thanks

[ugorji]

I don't understand why this is necessary, why it works, or what exactly it does.

What problem did it fix? Why do I need a go.sum that is very clearly incomprehensible to me, the author?

[sysulq]

maybe this wiki would help you understand go.sum

https://github.com/golang/go/wiki/Modules#should-i-commit-my-gosum-file-as-well-as-my-gomod-file

and the key point here is to specify the module name as github.com/ugorji/go, which avoids pseudo-version like github.com/ugorji/go/codec v0.0.0-20190204201341-e444a5086c43.

etcd-io/etcd#10481 (diff)

[ugorji]

But github.com/Ugorji/go is not the module. The module is .../codec. This repo might morph to be a multi-module repo.

…

On Wed, Feb 20, 2019, 8:30 AM Sophos ***@***.*** wrote: maybe this wiki would help you understand go.sum https://github.com/golang/go/wiki/Modules#should-i-commit-my-gosum-file-as-well-as-my-gomod-file and the key point here is to specify the module name as github.com/ugorji/go, which avoids pseudo-version like github.com/ugorji/go/codec v0.0.0-20190204201341-e444a5086c43. etcd-io/etcd#10481 (diff) <etcd-io/etcd#10481 (diff)> — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#284 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/ABKlwtEV_DTIlY6xVxPGfbh6nwMOKjfxks5vPU4DgaJpZM4bE8aX> .

[sysulq]

yep, we could use codec as submodule of github.com/ugorji/go, which follows the go mod style better :-)

just like github.com/stretchr/testify did

[ugorji]

Right. But submodules are so ... intrusive and messes up the git history. I would rather wait a bit and let the bug be fixed, so that subdirectory works just as well.

[sysulq]

this is just the rule declaimed by go mod, I do hope you merge this pull request to avoid pseudo-version, and submodule of go mod works perfectly, it's not the same thing like git submodules.

[ugorji]

This PR is not a submodules, I don't understand the changes in go.sum, and I don't know what it's fixing.

I can't merge that.

I will be happy to merge something that I understand and agree with how/what it fixes. Some if that requires some education of me.

[sysulq]

alright, let's talk subdirectory instead of submodules...and the submodule I mentioned is just the same as package's subdirectory.

actually, the go.sum generated in this PR comes from https://github.com/golang/tools/blob/master/go.sum
because github.com/ugoji/go needs github.com/golang/tools.

as the go modules wiki said, go.sum is used to check the download copies and provides enough information for reproducible builds

go.sum contains the expected cryptographic checksums of the content of specific module versions.

If someone clones your repository and downloads your dependencies using the go command, they will receive an error if there is any mismatch between their downloaded copies of your dependencies and the corresponding entries in your go.sum.

Or if you do not accept the go.sum, I can even remove this, because this is not the key point of this PR... instead the go.mod file is

[sysulq]

and this go.sum is auto generated by go mod tidy

[ugorji]

I don't know what you're fixing. Can you demonstrate a reproducer?

[ugorji]

See #279

[ugorji]

@hnlq715 can you please try this again with go 1.12 (just released)? Maybe that is why you see a problem, but I don't know what you see, so I cannot reproduce.

[ugorji]

Closing this, as I don't even know what it is trying to fix, or if there is a problem here, and OP is now unresponsive.