[ISSUE] go-1.21+ will silently download alternate toolchains by default

[ISSUE] go-1.21+ will silently download alternate toolchains by default

[atweiden]

[-- Attachment #1: Type: text/plain, Size: 5171 bytes --]

New issue by atweiden on void-packages repository

https://github.com/void-linux/void-packages/issues/44578

Description:
TLDR: `export GOTOOLCHAIN=local` to opt out

With Go 1.21, it will become necessary to set the `GOTOOLCHAIN` environment variable in order to opt out of automatic silent downloads of alternate go toolchains:

> To improve forwards compatibility, Go 1.21 now reads the `go` line in a `go.work` or `go.mod` file as a strict minimum requirement: `go 1.21.0` means that the workspace or module cannot be used with Go 1.20 or with Go 1.21rc1. This allows projects that depend on fixes made in later versions of Go to ensure that they are not used with earlier versions. It also gives better error reporting for projects that make use of new Go features: when the problem is that a newer Go version is needed, that problem is reported clearly, instead of attempting to build the code and instead printing errors about unresolved imports or syntax errors.
>
> To make these new stricter version requirements easier to manage, the `go` command can now invoke not just the toolchain bundled in its own release but also other Go toolchain versions found in the `PATH` or downloaded on demand. If a `go.mod` or `go.work` `go` line declares a minimum requirement on a newer version of Go, the go command will find and run that version automatically. The new `toolchain` directive sets a suggested minimum toolchain to use, which may be newer than the strict `go` minimum. See “Go Toolchains” for details.

https://tip.golang.org/doc/go1.21

> Starting in Go 1.21, the Go distribution consists of a `go` command and a bundled Go toolchain, which is the standard library as well as the compiler, assembler, and other tools. The `go` command can use its bundled Go toolchain as well as other versions that it finds in the local `PATH` or downloads as needed.
>
> The choice of Go toolchain being used depends on the `GOTOOLCHAIN` environment setting and the `go` and `toolchain` lines in the `main` module’s `go.mod` file or the current workspace’s `go.work` file. As you move between different `main` modules and workspaces, the toolchain version being used can vary, just as module dependency versions do.
>
> In the standard configuration, the `go` command uses its own bundled toolchain when that toolchain is at least as new as the `go` or `toolchain` lines in the `main` module or workspace. For example, when using the `go` command bundled with Go 1.21.3 in a `main` module that says `go 1.21.0`, the `go` command uses Go 1.21.3. When the `go` or `toolchain` line is newer than the bundled toolchain, the `go` command runs the newer toolchain instead. For example, when using the `go` command bundled with Go 1.21.3 in a `main` module that says `go 1.21.9`, the `go` command finds and runs Go 1.21.9 instead. It first looks in the `PATH` for a program named `go1.21.9` and otherwise downloads and caches a copy of the Go 1.21.9 toolchain. This automatic toolchain switching can be disabled, but in that case, for more precise forwards compatibility, the `go` command will refuse to run in a `main` module or workspace in which the `go` line requires a newer version of Go. That is, the `go` line sets the minimum required Go version necessary to use a module or workspace.
>
> Modules that are dependencies of other modules may need to set a minimum Go version requirement lower than the preferred toolchain to use when working in that module directly. In this case, the `toolchain` line in `go.mod` or `go.work` sets a preferred toolchain that takes precedence over the `go` line when the `go` command is deciding which toolchain to use.
>
> The `go` and `toolchain` lines can be thought of as specifying the version requirements for the module’s dependency on the Go toolchain itself, just as the `require` lines in `go.mod` specify the version requirements for dependencies on other modules. The `go get` command manages the Go toolchain dependency just as it manages dependencies on other modules. For example,
>
>     go get go@latest
>
> updates the module to require the latest released Go toolchain.
>
> The `GOTOOLCHAIN` environment setting can force a specific Go version, overriding the `go` and `toolchain` lines. For example, to test a package with Go 1.21rc3:
>
>     GOTOOLCHAIN=go1.21rc3 go test
>
> The default `GOTOOLCHAIN` setting is `auto`, which enables the toolchain switching described earlier. The alternate form `<name>+auto` sets the default toolchain to use before deciding whether to switch further. For example `GOTOOLCHAIN=go1.21.3+auto` directs the `go` command to begin its decision with a default of using Go 1.21.3 but still use a newer toolchain if directed by `go` and `toolchain` lines. Because the default `GOTOOLCHAIN` setting can be changed with `go env -w`, if you have Go 1.21.0 or later installed, then
>
>     go env -w GOTOOLCHAIN=go1.21.3+auto
>
> is equivalent to replacing your Go 1.21.0 installation with Go 1.21.3.
>
> The rest of this document explains how Go toolchains are versioned, chosen, and managed in more detail.

https://tip.golang.org/doc/toolchain

Re: go-1.21+ will silently download alternate toolchains by default

[paper42]

[-- Attachment #1: Type: text/plain, Size: 229 bytes --]

New comment by paper42 on void-packages repository

https://github.com/void-linux/void-packages/issues/44578#issuecomment-1603877454

Comment:
go 1.21 is not even released yet, but I will keep it in mind when bumping the package

Re: go-1.21+ will silently download alternate toolchains by default

[atweiden]

[-- Attachment #1: Type: text/plain, Size: 236 bytes --]

New comment by atweiden on void-packages repository

https://github.com/void-linux/void-packages/issues/44578#issuecomment-1690741207

Comment:
https://github.com/void-linux/void-packages/commit/4c22fd9b486b04541461f3d21405c947d0aa801d

Re: [ISSUE] [CLOSED] go-1.21+ will silently download alternate toolchains by default

[atweiden]

[-- Attachment #1: Type: text/plain, Size: 5174 bytes --]

Closed issue by atweiden on void-packages repository

https://github.com/void-linux/void-packages/issues/44578

Description:
TLDR: `export GOTOOLCHAIN=local` to opt out

With Go 1.21, it will become necessary to set the `GOTOOLCHAIN` environment variable in order to opt out of automatic silent downloads of alternate go toolchains:

> To improve forwards compatibility, Go 1.21 now reads the `go` line in a `go.work` or `go.mod` file as a strict minimum requirement: `go 1.21.0` means that the workspace or module cannot be used with Go 1.20 or with Go 1.21rc1. This allows projects that depend on fixes made in later versions of Go to ensure that they are not used with earlier versions. It also gives better error reporting for projects that make use of new Go features: when the problem is that a newer Go version is needed, that problem is reported clearly, instead of attempting to build the code and instead printing errors about unresolved imports or syntax errors.
>
> To make these new stricter version requirements easier to manage, the `go` command can now invoke not just the toolchain bundled in its own release but also other Go toolchain versions found in the `PATH` or downloaded on demand. If a `go.mod` or `go.work` `go` line declares a minimum requirement on a newer version of Go, the go command will find and run that version automatically. The new `toolchain` directive sets a suggested minimum toolchain to use, which may be newer than the strict `go` minimum. See “Go Toolchains” for details.

https://tip.golang.org/doc/go1.21

> Starting in Go 1.21, the Go distribution consists of a `go` command and a bundled Go toolchain, which is the standard library as well as the compiler, assembler, and other tools. The `go` command can use its bundled Go toolchain as well as other versions that it finds in the local `PATH` or downloads as needed.
>
> The choice of Go toolchain being used depends on the `GOTOOLCHAIN` environment setting and the `go` and `toolchain` lines in the `main` module’s `go.mod` file or the current workspace’s `go.work` file. As you move between different `main` modules and workspaces, the toolchain version being used can vary, just as module dependency versions do.
>
> In the standard configuration, the `go` command uses its own bundled toolchain when that toolchain is at least as new as the `go` or `toolchain` lines in the `main` module or workspace. For example, when using the `go` command bundled with Go 1.21.3 in a `main` module that says `go 1.21.0`, the `go` command uses Go 1.21.3. When the `go` or `toolchain` line is newer than the bundled toolchain, the `go` command runs the newer toolchain instead. For example, when using the `go` command bundled with Go 1.21.3 in a `main` module that says `go 1.21.9`, the `go` command finds and runs Go 1.21.9 instead. It first looks in the `PATH` for a program named `go1.21.9` and otherwise downloads and caches a copy of the Go 1.21.9 toolchain. This automatic toolchain switching can be disabled, but in that case, for more precise forwards compatibility, the `go` command will refuse to run in a `main` module or workspace in which the `go` line requires a newer version of Go. That is, the `go` line sets the minimum required Go version necessary to use a module or workspace.
>
> Modules that are dependencies of other modules may need to set a minimum Go version requirement lower than the preferred toolchain to use when working in that module directly. In this case, the `toolchain` line in `go.mod` or `go.work` sets a preferred toolchain that takes precedence over the `go` line when the `go` command is deciding which toolchain to use.
>
> The `go` and `toolchain` lines can be thought of as specifying the version requirements for the module’s dependency on the Go toolchain itself, just as the `require` lines in `go.mod` specify the version requirements for dependencies on other modules. The `go get` command manages the Go toolchain dependency just as it manages dependencies on other modules. For example,
>
>     go get go@latest
>
> updates the module to require the latest released Go toolchain.
>
> The `GOTOOLCHAIN` environment setting can force a specific Go version, overriding the `go` and `toolchain` lines. For example, to test a package with Go 1.21rc3:
>
>     GOTOOLCHAIN=go1.21rc3 go test
>
> The default `GOTOOLCHAIN` setting is `auto`, which enables the toolchain switching described earlier. The alternate form `<name>+auto` sets the default toolchain to use before deciding whether to switch further. For example `GOTOOLCHAIN=go1.21.3+auto` directs the `go` command to begin its decision with a default of using Go 1.21.3 but still use a newer toolchain if directed by `go` and `toolchain` lines. Because the default `GOTOOLCHAIN` setting can be changed with `go env -w`, if you have Go 1.21.0 or later installed, then
>
>     go env -w GOTOOLCHAIN=go1.21.3+auto
>
> is equivalent to replacing your Go 1.21.0 installation with Go 1.21.3.
>
> The rest of this document explains how Go toolchains are versioned, chosen, and managed in more detail.

https://tip.golang.org/doc/toolchain