1xyz/pryrite

Pryrite, interactively execute shell code blocks in a markdown file

pryrite's Issues

ensure pyrite can execute https:// markdown

create a demo for hello world

Demo ready

pryrite-hello-world.mp4

Cleanup tasks

1. Move tools to internal

2. remove dependicies on aardlabs in go.mod

3. merge snippet into the graph package

Create release workflow

Create a release workflow so that git tag releases binaries for Linux and Osx (amd64 and arm)

Create examples

Create some examples to show different cases of execution

Clean up config package

Cleanup up the config package to contain minimal number of entries as needed for now

Add an ssh option via command line

Upgrade dependency "github.com/go-resty/resty"

Background

Repo github.com/1xyz/pryrite depends on github.com/go-resty/resty/[email protected].

https://github.com/1xyz/pryrite/blob/main/go.mod#L11

However, comparing version v2.5.0 of github.com/go-resty/resty from proxy.golang.org and github, there are inconsistencies.

commit time of the copy on github.com

"committer": {
      "name": "Jeevanandam M",
      "email": "[email protected]",
      "date": "2021-02-11T10:21:12Z"
    }

commit time of the copy on proxy.golang.org

{"Version":"v2.5.0","Time":"2021-02-11T09:35:23Z"}

So the checksum from the code in github does not match the checksum saved in sum.golang.org. The v2.5.0 tag of github.com/go-resty/resty might have been retagged after a minor edition on github. I guess you use proxy.golang.org to get dependencies, but that also shows that your project is depending on the copy of github.com/go-resty/[email protected] before its edition. Depending upon such inconsistent tag version may also result in some unexpected errors as well as build errors due to different proxy settings.

For example, when someone who does not use proxy.golang.org, say GOPROXY=direct, attempts to get github.com/go-resty/resty/[email protected], the following error occurs.

go: downloading github.com/go-resty/resty/v2 v2.5.0
go: github.com/go-resty/resty/v2@v2.5.0: verifying module: checksum mismatch
        downloaded: h1:GmCjQ7qW3Dzr3Lh7FvTrRJSWgYNWswDdOy+T8sgTAFI=
        sum.golang.org: h1:WFb5bD49/85PO7WgAjZ+/TJQ+Ty1XOcWEfD1zIFCM1c=

SECURITY ERROR
This download does NOT match the one reported by the checksum server.
The bits may have been replaced on the origin server, or an attacker may
have intercepted the download attempt.

For more information, see 'go help module-auth'.

So, this is a reminder in the hope that you can get rid of this problematic version of project github.com/go-resty/resty.

Solution

1. Bump the version of dependency github.com/go-resty/resty

I would recommend bumping the version of github.com/go-resty/resty to a new release to ensure dependency copy in proxy.golang.org and github in sync.

References

• https://proxy.golang.org/

fix project path from github/1xyz/pryrite to github.com/1xyz/pryrite