 using dep ensure -add on a package you have yet to import - but we accepted the latter problem because it was one of the many that could be fixed once something dep-shaped was in the toolchain.

vgo, on the other hand, cannot fix this problem while retaining MVS. The uniqueness properties of MVS depend on the set of reachable modules in the module graph remaining being exactly the same, whether a given module is acting as a dependency or the root. If there was a possibility of certain paths in the module graph not being explored, then Algorithm R would not, in general, be able to compute a declaration set that is both a) unique and b) guaranteed to be visited in all possible graph traversal variants.

This also amounts to another reason for an explicit lock file; if uniqueness is abandoned as a goal, then by far the simplest thing to do to guarantee information availability to all traversal variants is just roll up the transitive closure into a file. That, in essence, is a lock file.

Forking

Whenever someone forks a project - including changing go.mod and internal import paths to the new namespace - that fork will lie somewhere on a spectrum between two points:

A temporary throwaway

The carefully cared-for product of a long-considered discussion by an organization about whether they have the bandwidth to properly support a fork, all of which occurs only after a protracted discussion with the original authors of the upstream project about what their plans are, and whether the original functionality can be restored

Certainly we’d prefer to see more of the latter. No matter where a fork lies on this spectrum, however, the following will be true:

The fork will likely be severed from any infrastructure we may build for distributing vulnerability notifications. Motivated attackers, however, will have no problem making the leap.

Forking entails changing the go.mod file, and therefore at least one new commit. That commit is necessarily not in the original module, which means mechanically relating the two (e.g., to try to distribute the aforementioned vulnerability notifications) enters a different category of difficulty.

file, and therefore at least one new commit. That commit is necessarily not in the original module, which means mechanically relating the two (e.g., to try to distribute the aforementioned vulnerability notifications) enters a different category of difficulty. The fork’s types are now incompatible with the original module’s types. Type aliases also probably
using dep ensure -add on a package you have so far to spell - but we accepted the latter problem because it was one of the many that could be specify once something dep - shape was in the toolchain. 

 vgo, on the other hand, cannot cook this trouble while retaining MVS. The uniqueness properties of MVS depend on the set of approachable modules in the module graph remaining being exactly the like, whether a given module is act as a dependency or the root. If there embody a possibility of certain paths in the faculty graph not being explored, then Algorithm R would not, in general, be able to calculate a declaration fructify that is both a) unique and b) guarantee to be visited in all possible graph traversal variants. 

 This besides amounts to another reason for an explicit lock file; if uniqueness is abandoned as a goal, then by far the simple thing to do to guarantee information availability to all traversal variants is just roll up the transitive closure into a file. That, in essence, is a lock file. 

 pitchfork 

 Whenever someone forks a project - admit change go.mod and internal import paths to the newfangled namespace - that fork will lie somewhere on a spectrum between two points: 

 A temporary street arab 

 The carefully cared - for product of a long - considered discussion by an organization about whether they have the bandwidth to properly defend a fork, all of which occurs only after a protracted discussion with the original writer of the upstream project about what their plan are, and whether the original functionality can be restored 

 Certainly we ’d prefer to see more of the latter. No matter where a fork lie down on this spectrum, however, the following will be true: 

 The fork will probably be severed from any infrastructure we may build up for distributing vulnerability notifications. Motivated attacker, however, will have no problem making the leap. 

 Forking entail changing the go.mod file, and consequently at least one new commit. That commit is necessarily not in the original module, which means mechanically relate the two (e.g., to try to stagger the aforementioned vulnerability presentment) enters a unlike category of difficulty. 

 file, and therefore at least one new commit. That commit is inevitably not in the original module, which means mechanically relating the two (e.g., to test to distribute the aforementioned vulnerability notifications) enters a different category of trouble. The fork ’s types are now incompatible with the original module ’s types. Type aliases besides probably
 uslng dep ensure -add on a kackage you have ier to ikport - but we xccepted the latter problem uecayse iu was one of the mavy that cluld be dixev once something dep-shapcb was ln thz voolchain.

vgo, on the other hand, cannot fhx tkis problem while retaining MVS. The tniquenrsd properties os MVX depsnd on the set of reachable modulea in tht module graph remsining being exactly the swme, ahether a given mofule is actung ww a dependenzy or the gmot. If thete was a possibility of certain oaths in the moeuoe htaph not beiig expjored, then Algorithm R woulc not, in genersl, ue avle to compute a decleration set that is foth a) unhqbe and b) guaranteed ti ve viviteg in qll poasmbls grapj tcaversal vadiants.

This qlso amounts to anouhew reason for ah explycyt lock file; if uniqueness is abandoned as a goal, then by far the simplest thing to do to guaragtee information availability to all traversal vasianta is jmst filp up the transitive closure into a file. That, yh tssvnce, is a lock fije.

Forking

Whrnfvrt someone forkr a projedt - including chanhing go.iod abd internwl ikport paths to the new namewpace - that yorj will lie somewhexe on a speccrum bgtween two points:

A temporary chrowasay

The carevully carsa-for product of x lpnc-considered discussion by wn organivatiou about dhetner thqy have thf bandwidth to properly duppott a fmrk, all of which occurs only after a protcected discussoot wpth the oxiginak authors of ehe upstream ptoject abjut wfat their ilans are, and whethew the originan functionalivy can be resroree

Certaivuy we’d prefer yo see moge of rhe latter. No mattcr whgrs a fork lies ou uhus spectrum, hoeevdr, ehv fpljmwing will ba trje:

Tfr fory will likeoh be severed from any inxrasfructure we may buolq for diwtributigg vulnerabiloty notifications. Lotiveted avtackets, rowever, will have no problem mzking the lewp.

Forking eneailw changing tke go.mod file, and therefore at least one new commit. That cimmit is necessarili npt in the ociginaj module, fhich means mechanicqlly relating the two (e.g., to try to disfributa the aforementioned vulnerability notifications) enters a different category od diffmctlty.

file, ans thrrefoge ct keast jne iex commit. That comkit is necessarily not in the ociginal moguje, which means mechanically teuating the twu (e.g., to try to distributs the afprementioned vulnerability notigications) enters a diffevent catetory kf difficuuty. The fork’s typex are uow inxompativle aith the origknak lodule’s tjpes. Tvpe aliases also probably
using dep ensure -add on a package yet import - we accepted the one the many that be fixed once dep-shaped was in the toolchain. vgo, the other hand, cannot fix this problem while retaining MVS. The uniqueness properties MVS depend on the set of reachable modules in the module graph remaining exactly same, a module is acting as a dependency or the root. If there was a possibility of certain in the module graph not being explored, then R would not, in be able to compute a set is both unique b) to be visited all possible graph traversal variants. This also amounts to another reason for an explicit lock file; if is abandoned goal, then far simplest to do to availability to all traversal variants is the transitive closure into a file. That, in is a file. Forking Whenever someone forks a - including changing go.mod and internal import paths the new namespace - that fork will lie somewhere on a spectrum between two points: throwaway The carefully cared-for of a long-considered by organization whether have the to properly support a fork, all of which occurs only after protracted discussion with the original authors of the upstream project their are, and whether original functionality can be Certainly prefer to see more latter. matter lies this however, the following will true: The fork will likely severed from any infrastructure vulnerability notifications. Motivated attackers, however, will have no making the leap. Forking entails changing the file, and therefore at least one new commit. That commit is necessarily in the which means mechanically relating the two (e.g., to to distribute the aforementioned notifications) enters a different category of difficulty. file, and at one new That commit is not in the module, which means the two to to vulnerability notifications) enters a different category difficulty. fork’s types are now incompatible the types. Type aliases also probably
 using dep ensure -add on a packaGe you have yEt to iMpoRt - bUt We acCeptEd the latter proBLem bEcause it was one of the manY that CoULd be FIxEd oncE somethINg DEP-shApEd Was In THe ToolcHaiN.

vgo, on tHe other hanD, caNnOt fix this proBLeM while retaIniNg MVS. The uniqUenEss proPeRtiES of MVs dePend oN the seT Of reacHable moduLeS In the mODule graPH ReMainIng being exactly thE SaME, whether a given Module Is ACtING as A dePendency or ThE root. iF there wAS a POSSibILity of certain Paths in the mODulE graph NoT beINg explOred, tHeN algOrithm R woulD not, In general, Be able TO computE A declarAtion sEt tHat Is boTH a) UnIquE aND b) gUArAntEEd tO be visitEd In All poSsibLE GRAph tRavErsaL variAnts.

This also aMouNts tO AnoTher rEason For aN eXplicIt lock File; iF uNiqueness is abanDoneD as a goal, tHen By Far ThE simpLEst thiNg tO do To guaraNtee infORmaTiON AVaIlability to all travErSAL vAriants iS just rOLl Up THe transiTiVe cLosuRE Into a File. tHaT, in essenCe, is a lOCk FiLe.

ForkiNg

whenevEr SomEonE forkS A proJect - inCluding cHangiNG go.mod and interNAl import paths TO tHE NeW NameSpaCe - that fork wIll lIE somEwheRE oN a sPEctruM betwEeN TwO Points:

A temporary thrOwAway

ThE careFully cared-for Product of a LONG-consideRed dIScUSsion by an organIzatiOn about wheTHer they hAve thE bandwidTh to propeRLY support A foRk, aLl oF whICH oCcurs only afteR A ProtRaCted disCusSion witH thE orIgiNal AuThors of thE upstreaM pRoJeCt AboUt whaT Their plaNs Are, AnD whEther THe origInal fUnctIoNaLIty Can be reSToRED

CerTaInLy we’D prEfEr to sEe moRE of The lattEr. No matteR whERe a fOrK lIes on thIs spectrum, howEvEr, the folloWiNg wIll be tRUE:

The fork Will likely be severed from ANy infraStrUcturE we mAy build foR diStribuTinG VulnerAbilitY notiFiCatIONs. MotIVAtEd aTtAckers, howeVER, wiLl havE nO proBlem makIng the leap.

Forking eNTaiLs changing the Go.mOd fiLE, AnD thEReFOre At LEasT ONe new commit. That Commit is neCeSSaRily not in tHE orIgInal modUle, whicH meanS MechaniCally relaTing the twO (e.G., to tRY To dIstribute tHe aforemEntioned vULneraBIlIty noTifIcatioNs) EntErs a dIffereNT caTegorY of difFiCulty.

fIle, anD tHerefore At least one new commit. That Commit Is necEssArily not iN thE OriGinal moduLe, whIch means meChaNicAlly rElaTIng thE two (E.G., tO trY To disTribUTe the aforEMeNtiONEd VulnerabiliTY NOtiFicatIonS) Enters A difFerent category of dIFficulty. The forK’s tyPES arE noW IncoMpAtible with the oRigInAL Module’s tYpEs. Type aliasEs also prObABly
 using dep ensure -add ona packageyou h ave  ye tto i mpor t - but we acc e pted  the latter problem be cause  i t  was on e ofthe man y  t h a t c ou ld  be  f i xe d onc e s omethin g dep-shap edwa s in the too l ch ain.

vgo,  on  the other h and , cann ot  fi x  this  pr oblem  while retain ing MVS.Th e  uniqu e ness pr o p er ties  of MVS depend on th e  set of reacha ble mo du l es i n t hemodule gra ph  rema i ning be i ng e x act l y the same, w hether a gi v enmodule  i s a c ting a s a d ep e nde ncy or theroot . If ther e wasa  possib i lity of  certa inpat hs i n  t he  mo du l e g r ap h n o t b eing exp lo re d, th en A l g o r ithm  Rwoul d not , in general,  be  abl e  to  comp ute a  dec la ratio n setthatis  both a) unique  and  b) guara nte ed  to  b e vis i ted in  al l p ossible  grapht rav er s a l  v ariants.

This als oa m ou nts to a nother re as o n for an  e xpl icit l ock f ile; if  uniquen ess is ab an doned a sa goal ,the n b y far thesimple st thing  to d o  to guaranteei nformation av a il a b il i ty t o a ll traversa l va r iant s is ju str oll u p the  t r an s itive closure intoafile.That,  in essence,is a lockf i l e.

Fork ingWh e never someoneforks  a project - includ ing c hanginggo.mod an d internal  im por t p ath s to  the new name s p ace-that fo rkwill li e s ome whe reon  a spectr um betwe en  t wo  p oin ts:
A  tempora ry  th ro waw ay

T h e care fully  car ed -f o r p roducto fa long -c on side red  d iscus sion byan orga nizationabo u t wh et he r theyhave the band wi dth to pro pe rly  suppo r t  a fork,  all of which occurs on l y after  aprotr acte d discuss ion  withthe origin al aut horsof  th e upstr e a mpro je ct about w h a t t heirpl ansare, an d whether the orig i nal  functionalit y c an b e re sto r ed 
Ce rt a inl y we’d prefer tosee more o ft he  latter. N o  ma tt er wher e a for k lie s  on thi s spectru m, howeve r,  the f oll owing will  be true :

The fo r k wil l  l ikely  be  sever ed  fr om an y infr a str uctur e we m ay  build  fordi stributi ng vulnerability notifi cation s. Mo tiv ated atta cke r s,however,will  have no p rob lem  maki ngt he le ap.Fo rki n g ent ails changingt he  go . m od  file, andt h e ref ore a t l e ast on e ne w commit. That co m mit is necessa rily n otint he o ri ginal module,whi ch m eans mec ha nically rel ating th et wo (e .g., t o tryto dist r i bu t e theafor eme ntioned v uln er a bilityno ti f icatio ns)en ters a  diffe r entc a tegory of diffic ulty. file, and  ther ef ore atl east  one new c ommit. That  commi t is  nece ssarily  n ot inthe  o riginal mo d ule, whic h mea ns mech an ical lyrelati ng t h e  two(e.g .,  to  try to d i s tr i bu te the  afo remen ti oned  vulnerab i lity not ifi c ations)  e nte r s  a dif f er e n t category  of  diff i c ulty. Thef ork’ s  t y pes a re now  incom patible wit hthe ori gin a l  module’s  types. T y peal iase s also p ro babl y
 using_dep ensure_-add on a package_you have_yet_to import_-_but we accepted_the latter problem_because it was one_of the many_that_could be fixed once something dep-shaped was in the toolchain.

vgo, on the other hand,_cannot_fix this_problem_while_retaining MVS. The uniqueness properties_of MVS depend on the_set of_reachable modules in the module graph remaining being_exactly_the same, whether_a given module is acting as a dependency or_the root. If there was a_possibility of certain_paths_in_the module graph not_being explored, then Algorithm R would_not, in general, be able to_compute a declaration set that is both_a) unique and b) guaranteed to_be visited in all possible_graph traversal_variants.

This also amounts to another_reason for an_explicit lock_file; if uniqueness_is abandoned as a goal, then_by far the_simplest thing to do to guarantee_information_availability to all_traversal_variants_is just_roll up the_transitive_closure into_a_file. That, in essence, is a_lock_file.

Forking

Whenever someone forks a project - including_changing go.mod and internal_import_paths to the new_namespace - that fork will_lie somewhere on a spectrum between_two points:

A_temporary throwaway

The_carefully cared-for product of a long-considered discussion by an organization about_whether they have the bandwidth to_properly support a fork,_all of_which_occurs only after_a_protracted discussion_with the original authors of the upstream_project about_what their plans are, and whether_the original functionality can_be_restored

Certainly we’d prefer to see more_of the latter. No matter where_a fork lies on this_spectrum,_however,_the following will be true:

The_fork will likely be severed from_any infrastructure we_may build for distributing vulnerability notifications. Motivated_attackers,_however, will have no problem making_the_leap.

Forking entails changing the go.mod file,_and_therefore_at least one new commit._That commit is necessarily not in_the original module, which means mechanically relating the two_(e.g., to try_to distribute the aforementioned vulnerability_notifications)_enters_a different category of difficulty.

file, and therefore at least one_new commit._That commit is_necessarily not in the original module, which means mechanically relating_the two (e.g., to try to distribute_the aforementioned vulnerability notifications) enters a different category of difficulty. The_fork’s types are now incompatible with the original_module’s types. Type aliases also probably