Very similar to fsnotify/fsnotify

[niemeyer]

Hello there,

The very recent creation of this repository was brought to my attention, with some concern about the extreme similarity with fsnotify/fsnotify. It sounds somewhat unfortunate to have a project that is so similar to a very well known project, from known contributors to the community, and with the exact same project name.

I would suggest donating this repository to Nathan Youngman in respect for his many contributions, and creating the similar project in a different repository that would more clearly identify itself in a distinct way.

Thanks for your understanding.

[jodok]

it's even worse. if i try to download fsnotify as dependency via gopkg.in the default location for the fsnotify package is this repo. i realized this when trying to build oauth2_proxy:

➜   curl -i gopkg.in/fsnotify.v1
HTTP/1.1 404 Not Found
Date: Tue, 20 Mar 2018 22:53:19 GMT
Content-Length: 106
Content-Type: text/plain; charset=utf-8

GitHub repository at https://github.com/go-fsnotify/fsnotify has no branch or tag "v1", "v1.N" or "v1.N.M"%

[niemeyer]

@jodok Right, gopkg.in always resolves gopkg.in/foo as go-foo/foo, unambiguously.

In other words, it's not just the default.. it's the only place it resolves to.

[niemeyer]

Turns out the issue is even more problematic, because fsnotify/fsnotify was in fact named go-fsnotify/fsnotify before being renamed:

fsnotify/fsnotify@9297c46

As a consequence, there are actual projects in the wild attempting to import this project, and breaking right now. Once there is code here, they will transparently build the diverging code, silently. Unless there is some agreement here, I may have to block this repository, which is a first for gopkg.in.

Ironically, the rename creates exactly the sort of breakage that gopkg.in is meant to avoid in the first place. But we of course can't prevent people from moving the code around.

[xjtian]

I recently had a build break with the same 404 @jodok posted above. It seems like until this repository is taken down, dep ensure will continue to fail.

Out of curiosity, @niemeyer if this was the only place fsnotify resolved to on gopkg.in, how did this dependency ever resolve properly? Does gopkg.in define some kind of fallback repository URL which points at fsnotify/fsnotify?

[niemeyer]

@xjtian I've just responded to that above. Code worked because this was the real repository name before it got renamed. Nothing will fix your code to point to the right location until the code is fixed, because the repository location was changed by the maintainers of fsnotify/fsnotify.

Hi, I just pushed a readme on master to explain what is going on. This account/repository were registered to block potential dependency takeover attacks. The account is in the process of being delegated to Nathan.

[niemeyer]

@go-fsnotify Thanks, but who are you?

Note that there's no reason to register an account to own an organization, and delegate administration to a different user.

[ldionmarcil]

Hey, the go-fsnotify org is now under @nathany 's control. I'll write a short piece about Go dependency injection later this month, I'll be sure to mention it on Gopher's slack.

[niemeyer]

@nathany?

[fabxc]

I'm struggling to understand what all of this is about. It sounds like someone intentionally broke everyone depending on gopkg.in/fsnotify to prove a point?