index.golang.org: package paths are case-sensitive, which could lead to unexpected results

[dannykopping]

I'm not sure if this a bug or a feature, but I thought I'd mention it lest this gets abused:

I was searching for all available versions of the logrus package against the index, when I hit upon something odd.

Running this command curl https://index.golang.org/index -s | grep logrus | grep -i sirup | jq '.Version' | sort | uniq -c produces an unexpected result:

      1 "v0.0.0-20150423025312-26709e271410"
      1 "v0.0.0-20180523074243-ea8897e79973"
      1 "v0.7.3"
      1 "v1.0.3"
      1 "v1.0.6"
      1 "v1.1.0"
      1 "v1.1.1"
      1 "v1.2.0"
      1 "v1.3.0"
      1 "v1.4.0"
      2 "v1.4.1"   # <------ this is the interesting line

Upon further inspection, there are duplicate versions because of case-sensitivity:

{"Path":"github.com/Sirupsen/logrus","Version":"v1.4.1","Timestamp":"2019-04-11T18:48:56.838718Z"}
{"Path":"github.com/sirupsen/logrus","Version":"v1.4.1","Timestamp":"2019-04-15T13:53:12.353413Z"}

Note the Sirupsen and sirupsen variations in the Path.

[seankhliao]

go import paths are case sensitive and are treated as separate modules.

This can be an issue when the same module is imported through different names such as with logrus sirupsen/logrus#570 (comment)

[dannykopping]

Oh wow, thanks for that detail @seankhliao 👍