Docs say that recommended go version for trillian@v1.6.1 is go 1.22, but it appears to require go 1.22.6

[niels-moller]

Hi, I'm looking at the release notes for v1.6.1, and it says recommended go version is 1.22. See https://github.com/google/trillian/releases/tag/v1.6.1

However, if I create a go module with go.mod saying

module local
go 1.22
require github.com/google/trillian v1.6.1

and a source file dummy.go

package local
import _ "github.com/google/trillian"

and run go mod tidy, go mod tidy insists on changing that to go 1.22.6, and if I insists and change back to go 1.22, build fails, "go: updates to go.mod needed; to update it: go mod tidy" (which is go's way of saying that some dependency wants a more recent go version than specified in go.mod).

If the version dependency that rules out plain go 1.22 is intended, it would be nice to say that in release notes. I don't know if it is common for go modules to depend on patch version, but I was a bit surprised that I couldn't update to latest trillian after I finally upgraded the required go version in my project to go 1.22. For now, I'm on trillian@v1.6.0, which seems to work fine in this setting.

[AlCutter]

Hi @niels-moller, you're right - #3491 was just merged and should fix it for you.

[AlCutter]

I've just cut https://github.com/google/trillian/releases/tag/v1.7.1 with the change, in case that's helpful.

[niels-moller]

I think it is almost fixed. If I compile the same dummy.go file with a go mod file that looks like

module local

go 1.22.0

require github.com/google/trillian v1.7.1

require (
	golang.org/x/net v0.34.0 // indirect
	golang.org/x/sys v0.29.0 // indirect
	golang.org/x/text v0.21.0 // indirect
	google.golang.org/genproto/googleapis/rpc v0.0.0-20241209162323-e6fa225c2576 // indirect
	google.golang.org/grpc v1.69.2 // indirect
	google.golang.org/protobuf v1.36.1 // indirect
)

compilation succeeds. But If I change the go line to just go 1.22, it fails with go: updates to go.mod needed. I'm no go guru, but from the docs at https://go.dev/doc/modules/gomod-ref, I get the impression that two component form like go 1.22 is the expected usage, and adding a patch version like go 1.22.x, even with x=0, seems a bit obscure and unusual to me.

(And regarding the toolchain directive: I don't yet understand what the implications are and when that makes sense for a library to use. So far, none of our projects use it in their go.mod files).

[mhutchinson]

golang/go#62278 looks relevant. In particular: golang/go#62278 (comment) says that one needs to specify a full version (including patch) in either the go or toolchain directive.

[niels-moller]

That's a bit confusing. The authoritative(?) docs at https://go.dev/ref/mod#go-mod-file doesn't say anything of patch version, and doesn't use it in any of the examples, as far as I've been able to find. "A go directive indicates that a module was written assuming the semantics of a given version of Go. The version must be a valid Go version, such as 1.9, 1.14, or 1.21rc1." The linked Go version page says "The language version for a Go version is the result of truncating everything after the N: 1.21, 1.21rc2, and 1.21.3 all implement language version 1.21."

So probably my confusion is about "Go version" vs "Go language version". I expect the go directive to specify language version, and language version in turn to define the "semantics" referred to in the above definition of the go directive, but it seems I might be wrong in that.