Dependency update [lightstep-tracer-go/go-opencensus]

[ChrisHines]

Fixes #1000

[ChrisHines]

/CC @vrazdalovschi

[peterbourgon]

Did you manually remove this (and other) lines from go.sum, or was it done automatically somehow?

[ChrisHines]

Just go mod tidy.

[vrazdalovschi]

Yes, go mod tidy

[peterbourgon]

Strange, I thought go.sum was append-only.

[ChrisHines]

The checksum database is append only, and go.sum used to be append only, but see golang/go#26381 for when the thought process changed and https://golang.org/ref/mod#go for where it is documented that go mod tidy removes unnecessary entries.

[ChrisHines]

Also the upgrade button in the go.mod file provided by VS Code. No manual edits by me though.

…

On Mon, Nov 2, 2020, 7:53 PM Peter Bourgon ***@***.***> wrote: ***@***.**** commented on this pull request. ------------------------------ In go.sum <#1029 (comment)>: > @@ -1,11 +1,12 @@ cloud.google.com/go v0.26.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= -cloud.google.com/go v0.34.0/go.mod h1:aQUYkXzVsufM+DwF1aE+0xfcU+56JwCaLick0ClmMTw= Did you manually remove this (and other) lines from go.sum, or was it done automatically somehow? — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#1029 (review)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AAIC6Z7V2TKASXB272CEAVLSN5IALANCNFSM4TIDG3GA> .

[peterbourgon]

Sure, although I want to observe that this won't actually fix the problem. Go modules' solving algorithm, MVS, can substitute a given dependency+version with any "compatible" version of that dependency, and "compatibility" under major version 0 is basically "any version".

$ tree
.
├── a
│   ├── a.go
│   ├── go.mod
│   └── go.sum
└── b
    ├── go.mod
    ├── go.sum
    └── main.go

$ cat a/go.mod a/a.go
module a

go 1.15

require (
        github.com/lightstep/lightstep-tracer-go v0.22.0
)

package a

import (
        "github.com/lightstep/lightstep-tracer-go"
)

func Version() string {
        return lightstep.TracerVersionValue
}

$ cat b/go.mod b/main.go
module b

go 1.15

require (
        a v0.0.1
)

replace (
        a => ../a
        github.com/lightstep/lightstep-tracer-go => github.com/lightstep/lightstep-tracer-go v0.18.1
)

package main

import (
        "a"
)

func main() {
        println(a.Version())
}

$ cd b ; and go build ; and ./b
0.18.1

[ChrisHines]

Sure, although I want to observe that this won't actually fix the problem. Go modules' solving algorithm, MVS, can substitute a given dependency+version with any "compatible" version of that dependency, and "compatibility" under major version 0 is basically "any version".

replace (
a => ../a
github.com/lightstep/lightstep-tracer-go => github.com/lightstep/lightstep-tracer-go v0.18.1
)

Of course the main module can override anything with a replace in its go.mod. That's what replace is for and outside the scope of anything that we should worry about in the Go kit go.mod file.